In February 2024, a cyberattack on a single healthcare technology company disrupted billing operations across thousands of hospitals and physician practices. The company processed claims for a substantial portion of US healthcare providers. For weeks, providers could not submit claims, and some smaller practices faced serious cash flow problems. The root cause was not a hospital. It was a vendor.

The organization that was attacked was a business associate. The covered entities whose operations were disrupted were legally responsible for ensuring that business associate had appropriate security controls in place. Most had not verified that in years.

That incident was a turning point, and regulators certainly noticed. Within weeks, HHS’s Office for Civil Rights opened an investigation and reminded covered entities of their business associate obligations.

What "you outsourced the service, not the liability" actually means

Under HIPAA, a covered entity (a hospital, health system, physician practice, or health plan) remains accountable for ePHI that flows to a business associate. If a billing clearinghouse, SaaS vendor, imaging service, or AI platform mishandles patient data, the covered entity that contracted with them faces potential OCR scrutiny.

This has always been true. What is changing is the enforcement environment and the direction of federal policy. The Office for Civil Rights (OCR) continues to actively enforce the existing HIPAA Security Rule, and HHS has proposed significant updates to that rule that would move business associate verification from a best practice to a defined requirement. Finalization has been delayed and the timeline remains uncertain, but the expectations in the proposal (annual security attestations, documented oversight, and faster incident reporting) are already showing up in what boards, cyber insurers, and auditors ask for.

The practical implication: "We have a signed BAA" is no longer sufficient due diligence. The question regulators and, increasingly, healthcare executives are asking is whether the organization has any actual evidence that the business associate's security controls are adequate. As we've written before, vendor risk is your risk.

The modern healthcare vendor ecosystem is vast and complex

The average health system works with hundreds of vendors who touch ePHI in some form. Clearinghouses and revenue cycle vendors. EHR add-ons and integration platforms. Cloud-hosted imaging systems. AI-powered prior authorization tools. Patient engagement applications. MSPs and IT service providers. Call center platforms. Telehealth vendors. And the manufacturers and service providers behind connected clinical equipment, which is why medical devices are the new OT security battleground.

Each of these relationships represents a potential entry point. The February 2024 attack demonstrated that a single vendor with broad connectivity to covered entities can become an industry-wide vulnerability. It also demonstrated that most healthcare organizations had no practical visibility into the security posture of that vendor beyond the existence of a business associate agreement.

The 2024 HIMSS Healthcare Cybersecurity Survey found that third-party and supply chain risk ranked among the top three cybersecurity concerns for healthcare leaders, yet fewer than half of respondents had formal third-party risk management programs in place.

What stronger vendor oversight looks like

The proposed HIPAA Security Rule update points toward three categories of activity that covered entities should operationalize now. None of them depend on when, or whether, the proposal is finalized. Each one already reduces real risk and aligns with the current, fully enforceable HIPAA Security Rule.

Annual verification means actually confirming, on a defined schedule, that business associates have implemented appropriate security controls. This is not a passive process. It requires either a formal attestation from the vendor or an independent review of their security posture.

Faster incident notification is a centerpiece of the proposed update, and there is no reason to wait for it. Covered entities can write tighter notification timelines into their BAAs today, and they need processes to act on those notifications. That means knowing who your contacts are at every material vendor, what their incident response and recovery procedures look like, and what your contractual remedies are if they fail to notify you promptly.

Procurement is the best point of control. Security requirements built into vendor contracts (required security certifications, right-to-audit provisions, patch management commitments, limits on always-on vendor access, and incident response timeline expectations) are far easier to enforce than requirements added after the relationship is established.

The AI vendor dimension

A newer and rapidly growing category of business associate risk involves AI vendors. Healthcare organizations are adopting AI tools for clinical documentation, prior authorization, diagnostic support, and patient communication. Each of these vendors that touches ePHI is a business associate, subject to the same BAA requirements and the same oversight obligations. And not every AI tool in use was approved through procurement, which is how PHI quietly leaks through shadow AI.

The complication is that AI vendor data practices are often opaque. Does the vendor train models on customer data? Where is that data hosted? What are their retention policies? Who else in their supply chain touches it? (We explored that last question in The Invisible Handshake.) These questions have material HIPAA implications and need to be part of the vendor assessment process from the start, not an afterthought.

Starting with what you know

Third-party risk management does not require a wholesale program overhaul to get started. A practical first step is an inventory of current business associates, tiered by the sensitivity of the data they access and the criticality of the service they provide. That inventory, mapped against the oversight activities currently in place for each vendor, quickly reveals where the most significant gaps are.

From there, a phased program that starts with the highest-risk vendors and works outward is manageable, and it is the kind of work our Governance, Risk & Compliance team supports every day. The alternative is waiting until a vendor incident forces the issue, at which point the gap is no longer yours to manage on your own timeline.

The Healthcare Cybersecurity Readiness Guide includes a readiness checklist that covers vendor and business associate oversight alongside the technical safeguards. It maps controls to today's enforceable HIPAA Security Rule and lays out a phased roadmap you can follow regardless of when the proposed update is finalized.

‍

Find the content useful? Subscribe to The Catch, our exclusive weekly LinkedIn newsletter focused on real-life experiences doing cyber right in the most highly regulated industries.