Skip to content
HIPAA vendor vetting means asking every vendor that could touch patient information the same set of questions before signing: whether it will sign a business associate agreement, whether it has a current SOC 2 Type II report, where data is hosted, which subprocessors see it, what reaches ad platforms, how fast it reports breaches, and how access ends.
Which marketing vendors does a practice need to vet?
A practice needs to vet any vendor whose tool collects, stores, or passes along information about patients or prospective patients. For a behavioral health practice, that list usually includes the marketing agency, the web developer, call tracking, the website chat widget, the CRM, online scheduling, and any form or intake tool embedded on the site. A chat widget alone can capture a name, a phone number, and a reason for reaching out.
Vendor breaches can be very large. The HHS Office for Civil Rights report to Congress on 2024 breaches found that business associates filed 106 of the large breach reports in calendar year 2024, 16% of the total, yet those reports affected 206,921,071 individuals, 85% of everyone affected that year. The report notes that the largest 2024 breach, a ransomware attack on a health care clearinghouse, affected about 192 million people on its own.
What questions should a practice ask a marketing vendor?
A practice should ask each vendor the same eight questions and get every answer in writing. Several track the terms in the HHS sample business associate agreement provisions, which cover breach reporting, subcontractors, and return or destruction of data at termination.
- Will you sign a business associate agreement, and can we review it before signing?
- Can you share your most recent SOC 2 Type II report, and what period does it cover?
- Where is our data hosted, and does it stay in the United States?
- Which subprocessors handle our data, and do they agree to the same restrictions?
- What exactly does your tool send to ad platforms or analytics services, and what gets hashed or removed first?
- How quickly will you notify us of a breach or security incident?
- Does each of your staff members use a unique login to our accounts?
- When we leave, how do you remove access and return or destroy our data?
Which vendor answers should concern a practice?
Vague answers on breach timing, subprocessors, or ad platform data should concern a practice most, because those are the areas a practice cannot inspect on its own. A vendor that will not name its subprocessors, cannot say what its script sends, or treats the business associate agreement as a formality is showing the practice how it will behave after signing. A vendor that says contact details are hashed before they reach an ad platform should concern a practice too. FTC technology staff wrote that hashes “can still be used to identify users.”
Breach timing has real consequences. In a March 2026 settlement with a patient communication software company whose 2020 incident affected about 15 million people, OCR Director Paula M. Stannard said: “When a breach occurs, business associates must notify affected covered entities without unreasonable delay and within 60 calendar days of discovery.” Beacon’s working standard is to get each vendor’s notification window in writing and to prefer one well inside that limit.
What does this vetting list not cover?
This vetting list does not cover whether a specific vendor, contract, or configuration meets HIPAA requirements. Compliance is the covered entity’s obligation, and a vendor’s agreement or audit report does not make a practice compliant. The list also does not replace the practice’s own HIPAA risk analysis, a technical review of what a vendor’s script sends, or a review of indemnity and liability terms. Substance use disorder programs under 42 CFR Part 2 and practices subject to state health data laws may need additional terms. Clinical software such as the EHR is outside this marketing-focused list.
This page is general information about vetting marketing vendors and what regulators and platforms have published. It is not legal advice. Laws and platform policies change, and a practice with questions about its own obligations should talk to its own attorney or privacy officer.
Frequently asked questions
What is a SOC 2 report?
A SOC 2 report comes from an independent CPA examination of a vendor’s controls. The AICPA describes it as an examination of controls at a service organization relevant to “security, availability, processing integrity, confidentiality, or privacy.” Ask for the Type II report and which period it covers.
Does a signed BAA mean a vendor is safe to use?
A signed business associate agreement sets obligations on paper. How a vendor actually handles data shows up in its answers on hosting, subprocessors, ad platform data, and breach timing. The agreement matters most when something goes wrong, which is why a practice should read its terms before signing.
How often should a practice re-vet its vendors?
Beacon’s working standard is at every renewal and whenever a vendor adds a feature that touches patient data, such as a new tracking script or AI tool. A yearly review of every vendor with account access also catches tools that were added without anyone running through these questions.
The questions an owner should ask about the vendor behind their contact form are covered in What’s Actually Behind Your Practice’s Contact Form?