HIPAA and SaaS Vendors

What is HIPAA for SaaS vendors?

HIPAA's privacy and security rules protect health information that identifies a person, called protected health information (PHI). They apply first to covered entities: health plans, health care clearinghouses and health care providers that send standard transactions such as claims electronically, per HHS.

They also reach vendors. A business associate is a company that creates, receives, keeps or sends PHI while doing work for a covered entity. A subcontractor that handles PHI for a business associate is a business associate too. HHS lists cloud providers that store health data, IT contractors and a chatbot vendor on a provider's patient portal among its examples.

Before sharing PHI, the covered entity needs a business associate agreement (BAA). It must limit how the vendor uses the data, require security safeguards and require the vendor to report security incidents and breaches. Business associates need BAAs with their own subcontractors before passing PHI on.

Why it matters to you

If you handle PHI for health care customers, you are a business associate, and every vendor in your stack that touches PHI becomes your subcontractor. You need a BAA with each one.

Encryption is not an escape hatch. HHS says a cloud provider that stores PHI is a business associate even if it stores only encrypted data and has no key, per its cloud computing guidance. Using such a provider without a BAA is a violation by you.

Breach clocks run through you. A business associate must tell the covered entity about a breach without unreasonable delay and no later than 60 days after discovery, per the Breach Notification Rule. Your customers' BAAs may demand faster notice than that, so your vendors need to give you notice faster still.

What to check

• Whether the vendor will sign a BAA at all. A "HIPAA compliant" label on a website is not a signed agreement.
• Whether the BAA covers only some products or plans. Use PHI only in the covered ones.
• The breach and security incident notice period in the BAA, in days or hours. See breach notification clause.
• Whether the vendor's subprocessors that touch PHI are bound by the same terms.
• What happens to PHI when the contract ends: return, destruction, or continued protection if neither is possible.

How Venpo helps

Venpo watches your vendors' terms, DPAs, security pages and subprocessor lists and emails you a plain-English alert when one changes, for example when a new subprocessor appears that may touch health data. The Fine Print Scan also shows how long each vendor keeps data.