Third-Party Risk Management
Domain 7 tests how you select, contract with, and monitor organizations that touch PHI. Vendors and business associates sit behind a large share of reported healthcare breaches, so the exam expects operational answers, not just "get a BAA."
Who is a business associate
A person or entity performing functions on behalf of a covered entity that involve PHI - claims processing, hosting, analytics, billing, legal, IT support - or providing a service where PHI access is incidental but possible. Pure conduits (postal service, transport-only ISP) are excluded. Subcontractors of a business associate are themselves business associates and need flow-down terms. HITECH makes business associates directly liable for Security Rule compliance.
Due diligence before signature
Security questionnaire, SOC 2 Type II report (read the exceptions and scope, not just the opinion), HITRUST certification scope, penetration test summary, subcontractor and data-location list, insurance, financial stability, and incident history.
Contract terms that matter
Permitted and required uses, minimum necessary, safeguard commitments, breach notification timelines shorter than the 60-day legal maximum, audit rights, subcontractor flow-down, data return and certified destruction at termination, and indemnification.
Ongoing monitoring
Maintain a complete vendor inventory, tier vendors by PHI volume and criticality, review certifications and SOC reports annually, track fourth parties, and plan the exit before renewal.
Worked example
A hospital moves its EHR to a cloud provider. Reasoning: storing ePHI is not a conduit function, so the provider is a business associate and a BAA is mandatory; the contract must address encryption and key custody, data residency, availability commitments, breach notification, and return or destruction on exit. The hospital keeps accountability - a signed BAA allocates obligations, it does not transfer the covered entity's own liability.
Traps
- Assuming a BAA transfers all liability.
- Ignoring subcontractors and fourth parties.
- Accepting a SOC 2 letter without reading scope and exceptions.
- No verified destruction or data-return step at offboarding.
- Treating a certification as permanent assurance.