A medical group's vendor risk program for its business associates: inventory, questionnaires, SOC 2 report review, contract clauses and ongoing monitoring
A multi-clinic medical group with a billing company, an EHR host, a cloud backup provider and other outside vendors that touch patient data.
- Scale
- ~40 vendors reviewed, tiered by the patient data each one handles
- Engagement
- 10 weeks to build, then an annual cycle with monitoring in between
The challenge
The group signed vendor agreements one at a time and kept no single list. It could not say which vendors held patient data, whether each had a business associate agreement, or what had been checked about their security. A billing vendor's incident made the gap obvious, and the group's insurer began asking for proof of how vendors are managed.
A medical group learned about a billing vendor's security incident from the vendor's own notice, and then discovered it could not say which other vendors held patient data. The client is not named on this page, and this is an illustrative engagement that describes the kind of work our team does; details are composite. Under HIPAA a vendor that handles patient data for a practice is a business associate, and the practice stays responsible for choosing it carefully.
The first step was an inventory. For every vendor, our team recorded what the vendor does, which patient data it can reach and how, who in the group owns the relationship, and whether a business associate agreement exists. Vendors were then sorted into tiers. The billing company and the record system host landed at the top, and a landscaping contractor never entered the program.
Review effort followed the tier. Lower tiers received a short questionnaire. Top-tier vendors received a longer one, and we checked the answers against evidence instead of accepting them as written. For vendors with a SOC 2 report, we read it the way an auditor does: the period covered, the scope, the opinion, any exceptions, which parts of the service were carved out to subcontractors, and whether the controls the group depends on were actually tested.
Contracts closed the gaps the reviews found. The group's agreements now state how fast a vendor must report a breach, require the same obligations from its subcontractors, give the group the right to ask for evidence, and say how patient data is returned or deleted when the relationship ends. The group's counsel reviewed the wording, since this work informs the legal terms and does not replace advice from a lawyer.
Monitoring keeps the list alive. Top-tier vendors are re-reviewed each year, public breach news is watched for the vendors on the list, and a checklist runs when a vendor leaves, so access is removed and data is returned. Open gaps are tracked until fixed or accepted in writing by a named person. This is the work our team does under cybersecurity and managed IT services, and it is not legal advice or a certification.
What our team delivered
- A vendor inventory that records what each vendor does, what patient data it can reach and how, and who inside the group owns the relationship
- Tiers by risk, so a vendor with full access to the record system gets a deep review and a supplier of office furniture gets none
- Security questionnaires sized to the tier, with answers checked against evidence instead of accepted at face value
- A review of each SOC 2 report: the scope and period, the auditor's opinion, exceptions, the subservice organizations carved out, and whether the controls the group relies on were tested
- Contract clauses: a business associate agreement, breach notice within a stated time, subcontractor flow-down, audit rights, return or deletion of data at exit, and cyber insurance requirements
- Ongoing monitoring: an annual re-review for the top tier, alerts on public breach news and certificate or domain changes, and an offboarding checklist when a vendor leaves
Result
The group now has one list, one agreement trail and a dated review for every vendor that handles patient data, and it knows which vendors carry the most risk. Gaps are tracked to closure or accepted in writing by a named person. This is an illustrative engagement, a modeled outcome and not a compliance certification or legal advice.
Get this for your company
Related services with fixed prices and a written scope.
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Show 1 more
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Super Intelligence data flow
Every request is classified by sensitivity, so confidential data stays on models inside your walls while routine work can use the best frontier AI.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.