Vendor Risk for Small Medical Groups: Business Associates and SOC 2 Reports

Start with the answer: list every vendor that touches patient information, sign a business associate agreement with each one that qualifies, and ask the higher-risk vendors for independent evidence such as a SOC 2 report, which you then actually read. A small group cannot audit every vendor, but it can be systematic about who has the data and what each vendor has promised and proven.

Who is a business associate

The U.S. Department of Health and Human Services explains that a business associate is generally a person or entity that performs certain functions or activities for a covered entity that involve the use or disclosure of protected health information, or provides certain services to it. Examples that HHS guidance describes include claims processing, billing, data analysis, quality assurance, legal, accounting, consulting, and data storage and hosting. For a small group, common business associates include the billing service, the cloud or hosting provider that stores records, the IT support firm with access to systems, the transcription or answering service, the e-prescribing and patient portal vendors and shredding or backup companies that handle data.

Some parties are not business associates, for example a health care provider that receives information for treatment of the patient. Cases at the edge, such as a cloud provider that stores encrypted data and says it has no key, are discussed in HHS guidance, so read it and ask counsel when it matters. Do not assume a vendor is outside HIPAA because it says so.

What the agreement must do

HIPAA requires a written contract, a business associate agreement, before a business associate handles protected health information for you. The HHS sample provisions show the usual content: what the vendor may and may not do with the data, a promise to use appropriate safeguards, a duty to report breaches and security incidents, flow-down of the same terms to subcontractors, support for patient access and amendment rights, return or destruction of data at the end, and your right to end the contract if the vendor breaks the terms. Business associates are also directly responsible under the HIPAA Security Rule for safeguarding electronic protected health information.

Have counsel review your template. Check the breach reporting window, who pays for notification, whether the vendor must tell you about subcontractors and where data is stored. And remember the limit of the agreement: it allocates responsibility. It does not make the vendor secure.

What a SOC 2 report is

SOC 2 is an attestation framework from the American Institute of Certified Public Accountants. An independent CPA firm examines a service organization's controls against the Trust Services Criteria, which cover security and may also cover availability, processing integrity, confidentiality and privacy. The AICPA explains that SOC 2 reports are intended for specific users such as customers and business partners who need to understand the controls at a service organization. A SOC 2 report is not a HIPAA certification. HIPAA has no official certification of a vendor, so be wary of anyone who claims one.

How to read one in thirty minutes

• Type. A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months, and is generally the stronger evidence.
• Period. Is it recent? Is there a gap between the end of the period and today?
• Scope. Which services, systems and locations are covered? Your product or data center may not be in scope.
• Criteria. Security is the base. Does the vendor include confidentiality or availability when you need them?
• Opinion. Is it unqualified, meaning clean? A qualified opinion or reported exceptions need follow-up.
• Exceptions. Read the testing section. See what failed, and whether management responded with a fix.
• Subservice organizations. Does the vendor rely on another provider, and is it included or carved out?
• Complementary user entity controls. These are the tasks the report expects you to do, such as removing leavers or enabling multi-factor sign-in. If you skip them, the report does not protect you.

Reports are normally shared under a confidentiality agreement. Keep them in a restricted place, and note the next report date.

A simple program for a small group

• Inventory. Make a list of vendors, the data each touches, who owns the relationship and where the contract is.
• Tier. High: stores or processes records or has system access. Medium: limited data. Low: none.
• Contract. Business associate agreement for every vendor that qualifies, plus security terms, incident notice and exit terms.
• Evidence. For high-tier vendors ask for a recent SOC 2 Type II report or an equivalent assessment, or a completed security questionnaire if no report exists.
• Access. Give vendors the least access needed, use individual accounts with multi-factor authentication and remove access when work ends.
• Review. Reassess high-tier vendors every year and after any incident, ownership change or major service change.
• Exit. Know how you would get your data back and how the vendor would destroy its copy.

When something goes wrong

If a vendor reports a breach, the clock under the HIPAA Breach Notification Rule may start for you as well. Keep vendor contacts, the agreement and your incident process together so you can act quickly, and ask counsel about notice duties under federal and state law.

A short checklist

Vendor inventory, business associate agreements signed and stored, vendors tiered, SOC 2 reports obtained and read for scope, period and exceptions, your own user controls done, access limited, an annual review scheduled and an exit plan for each critical vendor. Our cybersecurity team can help you put this in place. Start with our Cybersecurity service.

Sources

• HHS, Business Associates (HIPAA guidance)
• AICPA, SOC 2 Trust Services Criteria overview

This article is general information, not legal or compliance advice. Rules and product behavior differ by sector, contract and version; confirm details with your counsel, auditor and vendor documentation. Last reviewed November 9, 2026.

Keep reading

Next · InfrastructureImmutable Backups Explained: Object Lock, WORM and Air GapsRansomware crews go after backups first. An immutable backup cannot be altered or deleted until a retention period ends, even by an administrator account. Here is how object lock, WORM storage and air gaps differ, how the main platforms implement them and what still has to be tested.7 min read

• What a Code and Endpoint Security Review Finds in the First 24 Hours7 min
• Before Anyone Scans Your Website: Verification and Written Authorization7 min