When North Carolina rehabilitation centers discovered unauthorized access through a vendor's stolen credentials, they'd already lost control of 4,000 patient records. The intrusion happened in November 2025, but they didn't learn about it until June 2026. Your third-party vendors operate within your security perimeter, but do you control what happens inside their systems?
This checklist addresses the gap between vendor contracts and actual security outcomes. Healthcare organizations face regulatory obligations under the HIPAA Security Rule §164.308(b) for business associate oversight, but compliance requires more than signed agreements. Use this as your operational framework for vendor risk management that prevents breaches, not just documents them after the fact.
What This Checklist Covers
This checklist focuses on third-party vendor security controls for healthcare organizations managing protected health information. You'll implement verifiable security requirements, establish monitoring protocols, and create incident response coordination that works when credentials get stolen or ransomware hits your vendor's network.
Prerequisites
Before starting this checklist, you need:
- Current vendor inventory: Complete list of business associates and subcontractors with access to protected health information, including cloud service providers and IT support vendors.
- Data flow mapping: Documentation showing what patient data each vendor accesses, stores, or transmits.
- Authority to enforce: Executive sponsorship to terminate vendor relationships that don't meet security requirements.
- Incident response plan: Your internal Computer Security Incident Response Team procedures for vendor-originated incidents.
Vendor Security Requirements Checklist
1. Verify Multi-Factor Authentication on All Vendor Access Points
Confirm your vendor enforces MFA on every system touching your data. The November 2025 breach affecting North Carolina rehabilitation centers happened because an attacker used stolen credentials without MFA blocking the login. Request screenshots of MFA configuration or conduct a test login.
Good looks like: Vendor provides evidence that MFA is mandatory on all administrative and user accounts, with no bypass mechanisms and session timeout under 30 minutes.
2. Establish Credential Rotation and Monitoring Requirements
Define maximum credential lifetime (recommend 90 days) and require vendors to monitor for credential compromise indicators. Your contract should specify immediate notification if vendor credentials appear in breach databases or dark web marketplaces.
Good looks like: Vendor demonstrates automated credential scanning, provides quarterly attestation of password rotation compliance, and maintains audit logs showing when credentials were last changed.
3. Require Annual Penetration Testing with Report Sharing
Don't accept "we do security testing" as sufficient. Specify that vendors must conduct annual penetration tests by qualified third parties and share executive summaries showing critical and high findings with remediation timelines.
Good looks like: You receive a penetration test report dated within the past 12 months, showing all critical findings remediated before you renewed the contract, with evidence of fixes.
4. Map Vendor Security Controls to HIPAA Security Rule Requirements
Create a control matrix showing how your vendor implements each applicable HIPAA Security Rule safeguard. This isn't about their SOC 2 report; it's about specific HIPAA requirements like encryption (§164.312(a)(2)(iv)), access controls (§164.312(a)(1)), and audit controls (§164.312(b)).
Good looks like: Vendor completes your HIPAA control questionnaire with specific answers ("We encrypt data at rest using AES-256") rather than generic confirmations, and provides supporting evidence for each control.
5. Define Maximum Breach Notification Timelines
HIPAA's 60-day notification requirement is your regulatory floor, not your vendor's operational target. Require vendors to notify you within 24 hours of discovering unauthorized access, with preliminary details within 48 hours.
Good looks like: Contract specifies notification timelines shorter than regulatory requirements, defines what constitutes "discovery", and includes financial penalties for late notification.
6. Establish Data Exfiltration Monitoring
The Health Trust incident involved 408 gigabytes of exfiltrated data. Your vendor should detect unusual data transfers before threat groups announce the breach. Require vendors to implement data loss prevention controls and network traffic monitoring.
Good looks like: Vendor describes specific DLP tools, threshold alerts for abnormal data transfers, and provides quarterly reports showing monitoring is active.
7. Verify Ransomware-Specific Backup Procedures
Atrium Centers experienced ransomware in October 2025 and is still reviewing files to determine impact. Your vendor needs immutable backups that ransomware can't encrypt. Verify backup frequency, retention, and test restoration quarterly.
Good looks like: Vendor provides evidence of air-gapped or immutable backups, demonstrates successful restoration tests from the past 90 days, and maintains backups for minimum periods matching your data retention requirements.
8. Conduct Vendor Security Reviews Before Contract Renewal
Annual contract renewals are your leverage point. Schedule security reviews 90 days before renewal, giving you time to switch vendors if they don't meet requirements. Don't auto-renew based on last year's assessment.
Good looks like: You maintain a vendor security scorecard updated quarterly, review it with vendor leadership 90 days before renewal, and have executive approval to terminate relationships scoring below your threshold.
Common Mistakes
Accepting SOC 2 reports without reading them: A SOC 2 Type II report doesn't mean the vendor has no security gaps. Read the opinion letter and the exceptions section. If you see qualified opinions or numerous exceptions, dig deeper.
Treating all vendors identically: The vendor managing your email marketing list needs different controls than the vendor processing your EHR data. Risk-tier your vendors and apply proportional requirements.
Skipping subcontractor oversight: Your vendor's subcontractors are your risk. Require vendors to flow down security requirements to their subcontractors and provide you with subcontractor lists.
Waiting for annual audits to check compliance: Quarterly vendor security calls catch problems before they become breaches. Schedule standing calls with high-risk vendors to review security metrics, incident trends, and control changes.
Next Steps
Start with your highest-risk vendors (those with direct EHR access or handling Social Security numbers). Complete items 1, 2, and 5 within 30 days for these vendors. For medium-risk vendors, complete the full checklist within 90 days.
Document vendor responses in a central register. When a vendor can't meet a requirement, you're making a risk acceptance decision. Escalate those decisions to your privacy officer and document the compensating controls you're implementing.
Your vendor contracts should reference this checklist as an exhibit. New vendor onboarding requires checklist completion before data access. Existing vendors get 180 days to comply or you initiate the termination process.
The North Carolina breach took seven months to discover. The Health Trust breach involved unauthorized access before March 2025 but wasn't detected until May 2025. Your vendor security program determines whether you find out about breaches from your monitoring systems or from threat group announcements. Choose accordingly.
