Healthcare Vendor Audit Agenda

HEALTHCARE VENDOR AUDIT AGENDA

Vendor Name:   Vendor Contact:

Contact Phone:   Contact Email:

Contract / Agreement ID:   Audit Location / Facility:

Scheduled Start Date:   Scheduled End Date:

PURPOSE AND OBJECTIVES

Purpose: Conduct a focused compliance and controls assessment of vendor operations that support or handle protected health information (PHI), confidential business information, or other regulated data under the applicable contractual and statutory obligations. Objectives include verification of administrative, technical and physical safeguards; validation of contractually required safeguards; and identification of remediation items with timelines.

SCOPE OF AUDIT

The audit will address the following domains (select applicable):

Administrative controls    Technical controls    Physical/security controls

Business Associate Agreement compliance    Privacy practices    Billing / claims processes

Other:

STANDARDS, REGULATORY AND CONTRACTUAL CRITERIA

This audit will assess vendor adherence to applicable legal, regulatory and contractual obligations, including but not limited to:

• HIPAA Privacy Rule and HIPAA Security Rule
• HITECH Act requirements for breach notification
• Contractual obligations set forth in the parties' agreement
• Organization information security policies and industry standard frameworks as applicable

AUDIT TEAM & ROLES

SCHEDULE & LOGISTICS

Day 1 (Onsite): Date   Start Time:   End Time:

Day 2 (If applicable): Date   Start Time:

DOCUMENTS REQUESTED (PRIOR TO ON-SITE)

Business Associate Agreement(s)

Information security policies and procedures

Security and privacy incident logs

Access logs and user access listings

Most recent risk assessment and mitigation plans

Penetration test and vulnerability assessment reports

Employee HIPAA/security training records

Change management records

Subcontractor list and subcontract agreements

Sample patient records (redacted) — quantity:

Requested by (date):   Requested delivery date:

ONSITE PROCEDURES & EVIDENCE COLLECTION

Interviews with staff    Process walkthroughs    Physical observations    Evidence collection and sampling

DATA, PHI HANDLING AND CONFIDENTIALITY

The vendor acknowledges that audit activities may require limited access to PHI and other confidential information. All audit team members will treat PHI as confidential, limit use to audit purposes, and secure collected materials in accordance with applicable law and contractual obligations. Chain-of-custody records will be maintained for any exported data. Any breach or unauthorized disclosure discovered during the audit must be reported immediately per contractual notification requirements.

Acknowledged and agreed by vendor:

NON-DISCLOSURE / CONFIDENTIALITY

By participating in this audit, the vendor reaffirms that all information disclosed to the audit team pursuant to this agenda is confidential. The audit team will treat such information as confidential and use it solely for the purpose of performing the audit and reporting required findings. Nothing in this agenda modifies or supersedes any existing non-disclosure agreement or confidentiality obligations between parties.

NDA on file:   If no NDA on file, vendor agrees to be bound by confidentiality terms as set forth in the contract:

FINDINGS, REPORTING & CORRECTIVE ACTIONS

Draft report delivery (business days):   Final report delivery (business days):

ESCALATION & REMEDIATION CONTACTS

SAMPLING METHODOLOGY

Planned sample percentage of transactions/records:

ACCEPTANCE CRITERIA

Criteria for determining compliant vs. non-compliant findings will be based on evidence of implemented controls, adherence to documented policies, contractual obligations and regulatory requirements. Severity will be categorized and mapped to required remediation timelines.

LOGISTICS & ACCESS REQUIREMENTS

Access credentials required:   Vendor to provide temporary accounts with limited privileges for auditors where applicable.

ATTACHMENTS AND SUPPORTING EVIDENCE

Vendor cooperation acknowledgement: Vendor agrees to provide reasonable access, documents and subject matter experts as requested during the audit.

Sign Now