Third-Party Risk Management in Healthcare: A Guide

Third-party risk management (TPRM) in healthcare means knowing every vendor that touches patient data or critical systems, ranking them by risk, writing HIPAA and security requirements into contracts, and checking on them until the relationship ends. Most programs struggle with the same three things: an incomplete vendor list, too few staff and vendors that are too critical to replace.

This guide is for compliance officers, security leads and IT directors at hospitals, clinics and health plans who need a program that works with the team they actually have.

Key takeaways

• You can't manage vendors you haven't inventoried, so the list comes first.
• Tier vendors by data access and operational impact, then match the review effort to the tier.
• HIPAA requires a business associate agreement (BAA) before PHI goes to most vendors, and business associates need BAAs with their own subcontractors.
• A BAA is a legal floor, not a risk assessment.
• Monitoring and offboarding matter as much as the first review.

Why is third-party risk harder in healthcare?

Hospitals and health systems depend on a long chain of outside parties: EHR vendors, billing and claims processors, cloud hosts, medical device makers, staffing agencies, transcription services and the small software tools individual departments buy on their own. Many of them handle protected health information (PHI). Some keep clinical operations running. When one of them is breached or goes down, the result can be delayed care, not just exposed records. Our explainer on why and how healthcare data breaches happen shows how often the weak point sits outside the hospital's own network.

The problems teams run into most often:

• Shadow procurement. A department buys a tool on a credit card and security never hears about it.
• Fourth parties. Your vendor's subcontractors may also handle PHI, and you may not know who they are.
• Concentration risk. A handful of vendors support many critical workflows and have no quick substitute.
• Thin teams. A smaller hospital may have one or two people covering all of security and compliance.
• Questionnaire fatigue. Long, generic questionnaires get long, generic answers that tell you little.

What does HIPAA require for vendors?

HHS describes a business associate as a person or organization that performs functions or activities on behalf of a covered entity involving the creation, receipt, maintenance or transmission of PHI. Its examples include claims administrators, billing and practice management vendors, data analysts, EHR and IT vendors, and cloud service providers that handle electronic PHI.

Before sharing PHI, the covered entity needs a BAA. According to HHS guidance on business associates, the agreement must:

• Describe the permitted and required uses and disclosures of PHI.
• Prohibit uses or disclosures beyond what the agreement or the law allows.
• Require compliance with applicable Security Rule requirements.
• Require the business associate to report security incidents, including breaches of unsecured PHI.

Two points people miss. First, a business associate must have its own BAA with any subcontractor before passing PHI along, though you don't need to sign directly with that subcontractor. Second, since the 2013 Omnibus Rule, business associates are directly liable for certain HIPAA provisions. That doesn't make them your safety net. If a vendor leaks your patients' data, your organization still deals with the fallout. For the patient privacy side, see our article on EHR data security and HIPAA compliance.

How do you build a TPRM program that works?

1. Build the inventory

Pull vendor names from accounts payable, contract management, IT asset records and single sign-on logs, then reconcile them. For each vendor, record what data it touches, which systems it connects to and who owns the relationship internally. Expect surprises: AP data usually turns up tools that IT has never seen.

2. Tier by risk

Tier	Typical profile	Review approach
Critical	Large volumes of PHI or supports clinical operations	Full assessment, evidence review, annual reassessment, exit plan
High	Some PHI or network access	Standard questionnaire, BAA, review of independent audit reports
Moderate	Business data, no PHI	Short questionnaire, contract security clauses
Low	No sensitive data or system access	Basic due diligence at onboarding

Tiering is what makes a small team viable. If you spend the same effort on a catering vendor as on your EHR host, you'll run out of time before you reach the vendors that matter.

3. Assess against a shared standard

Use one recognized framework for every questionnaire so answers can be compared over time. The NIST Cybersecurity Framework is widely used. NIST's cybersecurity supply chain risk management project adds deeper guidance, with SP 800-161 Rev. 1 as its foundational publication and a due diligence quick-start guide (SP 1326). For sector-specific practices, HHS publishes the Health Industry Cybersecurity Practices (HICP) and healthcare cybersecurity performance goals through its healthcare cybersecurity portal. Whatever you pick, ask for evidence such as audit reports, policies or screenshots, not just yes or no answers.

4. Put requirements in the contract

Your contract checklist should cover:

• Breach and incident notification timelines.
• Right to audit or to receive independent assessment reports.
• Minimum security controls, such as encryption and multifactor authentication.
• Disclosure of subcontractors that will handle your data.
• Data return or destruction at termination.
• Cyber insurance expectations.

Most of this is easier to win before signature, so connect TPRM to the process in our guide to healthcare IT purchasing decisions.

5. Monitor and offboard

Reassess on a schedule tied to tier. Watch for events that change the risk between reviews: an acquisition, a new subcontractor, a reported breach or a big change in services. When a contract ends, confirm accounts are disabled, integrations are switched off and data is returned or destroyed, and keep written proof.

Who should own vendor risk?

TPRM fails when it belongs to nobody. A split that works in many organizations: procurement triggers the review, security assesses, compliance and legal handle the BAA and contract terms, and the business owner stays accountable for the relationship. Your designated HIPAA privacy and security officers should sign off on the process even if they don't run every review.

HR has a role too. Staffing agencies, benefits administrators and payroll providers hold sensitive employee data, a point covered in our piece on HR's role in cybersecurity and risk management.

Frequently Asked Questions

Is every healthcare vendor a business associate?

No. A vendor is a business associate when it creates, receives, maintains or transmits PHI on behalf of a covered entity. A furniture supplier isn't one. HHS also notes exchanges that don't need a BAA, such as disclosures to a provider for treatment. When in doubt, have counsel review the actual data flows rather than relying on the vendor's own label.

How often should vendors be reassessed?

Base it on tier. Critical vendors are commonly reviewed every year, with extra checks after a major incident, acquisition or change in services. Lower tiers can be reviewed less often or at renewal. Whatever schedule you choose, write it into policy and follow it, because a schedule nobody follows can become an audit finding of its own.

What if a critical vendor fails the assessment?

Few hospitals can switch a critical vendor quickly. Agree on a remediation plan with dates, add compensating controls such as tighter access or extra monitoring, and document the accepted risk with executive sign-off. In parallel, start an exit or backup plan so you have options if the vendor doesn't fix the gaps on time.

What to do next

• Reconcile your vendor list against accounts payable and single sign-on data this month.
• Tier your top fifty vendors and confirm a current BAA exists for every one that touches PHI.
• Set reassessment dates for the critical tier and assign an internal owner to each.
• Pick one framework for all future questionnaires and retire the rest.

Last reviewed: October 2026.

Sources

• Business Associates, U.S. Department of Health and Human Services
• Healthcare and Public Health Cybersecurity, U.S. Department of Health and Human Services
• Cybersecurity Framework, National Institute of Standards and Technology
• Cybersecurity Supply Chain Risk Management, National Institute of Standards and Technology