The Vendor's Subprocessor in a Non-Adequate Country
You are the compliance lead for a US-based healthcare technology company that provides a patient portal to EU hospitals. Your company uses a cloud-based CRM vendor (Vendor A) to manage customer support tickets. Vendor A is headquartered in the US and hosts data in the US. Vendor A uses a subprocessor (Vendor B) in India for Tier 1 support. Vendor A's contract with you includes standard contractual clauses (SCCs) and a DPIA was conducted last year. You have just learned that Vendor B will start handling EU patient data (names, medical record numbers, appointment details) next month. Vendor A claims it has a data processing agreement (DPA) with Vendor B that includes SCCs. However, you have not seen Vendor B's DPA or its security certifications. Your company is subject to HIPAA and GDPR. The EU hospitals are asking for assurance.
1. What are your obligations regarding Vendor B under GDPR and HIPAA, and what steps must you take before Vendor B handles EU patient data?
Read the worked answer
Under GDPR Art. 28, you as the controller (or processor, depending on your role with the hospitals) must ensure that any subprocessor is engaged under a written contract that imposes the same data protection obligations as the contract with the main processor. Vendor A must obtain your prior authorization for subprocessors and must flow down GDPR obligations. You need to review Vendor B's DPA and SCCs. Since Vendor B is in India (not an adequate country), the SCCs must be in place, and you need to conduct a transfer impact assessment (TIA) to evaluate the legal environment in India, particularly government access to data. Under HIPAA, if Vendor B handles protected health information (PHI) on your behalf, it must be a business associate (BA) and sign a business associate agreement (BAA). Vendor A's BAA with you likely requires Vendor A to ensure its subcontractors comply. You must obtain a BAA from Vendor B or ensure Vendor A's BAA covers Vendor B's activities. Before data flows, you should: 1) Obtain and review Vendor B's DPA and SCCs; 2) Conduct a TIA for India; 3) Verify Vendor B's security measures (e.g., ISO 27001, SOC 2) and incident response capabilities; 4) Update your records of processing (Art. 30); 5) Notify the EU hospitals and obtain their consent if required by contract; 6) Ensure Vendor B's personnel are trained on GDPR and HIPAA. If Vendor B cannot meet requirements, you must object to its use and require Vendor A to use an alternative.
2. How would you respond to the EU hospitals' request for assurance, and what documentation would you provide?
Read the worked answer
Respond transparently and promptly. Provide the hospitals with: 1) A summary of the subprocessor arrangement, including Vendor B's role and location; 2) Confirmation that SCCs and a DPA are in place between Vendor A and Vendor B, and that you have reviewed them; 3) The TIA for India, highlighting any supplementary measures (e.g., encryption, pseudonymization) to mitigate risks; 4) Evidence of Vendor B's security certifications (e.g., ISO 27001, SOC 2 Type II) and its most recent audit reports; 5) A description of the data flows and data types; 6) Your incident response and breach notification process involving subprocessors. If you have not yet completed the TIA or reviewed Vendor B's DPA, be honest that it is in progress and provide a timeline. Under GDPR Art. 28(2), you must give the hospitals the opportunity to object to the subprocessor. If a hospital objects, you must work with Vendor A to find an alternative or terminate the processing. Document all communications. Also, update your HIPAA risk analysis and BA agreements. The hospitals may require a right to audit Vendor B or to receive audit reports. Be prepared to negotiate contractual terms that give them sufficient assurance without compromising your own security.