Vendor Risk Management for HIPAA: Assessing Your Business Associates

Covered entities and business associates are responsible for the risk their vendors introduce to protected health information. Medcurity Vendor Risk Management assesses those vendors, tracks Business Associate Agreements, and documents third-party risk, alongside the Security Risk Analysis that HIPAA already requires.

What Medcurity Vendor Risk Management covers

• Vendor assessments scoped to the protected health information each vendor can access.
• Business Associate Agreement tracking, so signed agreements and renewals are documented in one place.
• Third-party risk documentation that supports your Security Risk Analysis under 45 CFR 164.308.
• A BA-only Trust Center option for business associates that need to show their posture to customers.

Why vendor risk is part of HIPAA compliance

The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information, including where vendors handle it. A Security Risk Analysis under 45 CFR 164.308(a)(1)(ii)(A) is stronger when it accounts for the vendors in scope. Vendor Risk Management gives that accounting a repeatable process.

Vendor risk: quick answers

Who needs Vendor Risk Management?
Covered entities and business associates that share protected health information with vendors.

Does Medcurity track Business Associate Agreements?
Yes. BAA tracking is part of Vendor Risk Management.

How does this relate to the Security Risk Analysis?
Vendor risk is an input to your Security Risk Analysis. Medcurity supports both.