A HIPAA Compliance Checklist for Third-Party Risk Management

Security Management Process
Administrative Safeguards
(§ 164.308(a)(1))

(A) Risk analysis (REQUIRED)

A covered entity or business associate must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity or business associate.

The first step in complying with HIPAA regulations is a comprehensive risk assessment – both internally and of third parties that may have access to PHI. While some organizations attempt this with spreadsheet-based questionnaires, that approach does not scale.

Security Management Process
Administrative Safeguards
(§ 164.308(a)(1))

(B) Risk management (REQUIRED)

Implement security measures sufficient to reduce risks and vulnerabilities to a reasonable and appropriate level to comply with [HIPAA Security Standards].

Once risks are identified, organizations must implement controls to minimize risk.

Security Management Process
Administrative Safeguards
(§ 164.308(a)(1))

(D) Information system activity review (REQUIRED)

Implement procedures to regularly review records of information system activity, such as audit logs, access reports, and security incident tracking reports.

Since a lot can change between annual assessments, organizations should perform continuous monitoring of risks, contract performance and service level agreements (SLAs).

Business Associate Contracts and Other Arrangements
(§ 164.308(b)(1))

A covered entity may permit a business associate to create, receive, maintain, or transmit electronic protected health information on the covered entity's behalf only if the covered entity obtains satisfactory assurances, in accordance with § 164.314(a), that the business associate will appropriately safeguard the information. A covered entity is not required to obtain such satisfactory assurances from a business associate that is a subcontractor.

Business associate contracts are required, but smart compliance and security teams will require evidence of compliance and controls.

Security Management Process, Administrative Safeguards
§ 164.308(a)(6)

Implementation specification: Response and reporting (REQUIRED)

Identify and respond to suspected or known security incidents; mitigate, to the extent practicable, harmful effects of security incidents that are known to the covered entity or business associate; and document security incidents and their outcomes.

Some vendors may not know when they have been breached, or may not promptly report incidents which can delay Mean Time to Discovery (MTTD) and Mean Time to Resolution (MTTR), opening an organization up to potential exploits.

Security Management Process, Administrative Safeguards
§ 164.308(a)(8)

Standard: Evaluation. Perform a periodic technical and nontechnical evaluation, based initially upon the standards implemented under this rule and, subsequently, in response to environmental or operational changes affecting the security of electronic protected health information, that establishes the extent to which a covered entity's or business associate's security policies and procedures meet the requirements of this subpart.

All organizations experience personnel changes and periodically implement new policies and procedures. Covered entities must continuously monitor cyber, business, and financial intelligence for visibility into material changes to a vendor’s risk profile between annual internal control assessments.

Policies and procedures and documentation requirements
(§ 164.316(b)(1))

Standard: Documentation

• (i) Maintain the policies and procedures implemented to comply with this subpart in written (which may be electronic) form; and
• (ii) If an action, activity or assessment is required by this subpart to be documented, maintain a written (which may be electronic) record of the action, activity, or assessment.

In the event of an incident or audit, or in the course of a business relationship, organizations are required to produce evidence supporting policies, identified risks, and controls.