Healthcare Vendor Audits

HEALTHCARE VENDOR AUDIT QUESTIONNAIRE AND AUTHORIZATION

Vendor Identification

Services, Scope, and Contract Information

HIPAA / Business Associate Status

Does the vendor perform functions or activities on behalf of the covered entity that involve access to Protected Health Information (PHI)?: Yes

Is an executed Business Associate Agreement (BAA) in place?: Yes    Effective Date:

If no BAA is in place, describe steps and target date for execution:

Security Controls (Administrative, Technical, Physical)

Indicate which controls are implemented (check all that apply):

Periodic Risk Assessments (documented)

Written Information Security Program and Policies

Multi-factor Authentication for Administrative Access

Encryption of PHI at Rest    Algorithm/Standard:

Encryption of PHI in Transit

Access Logging and Audit Trails

Regular Vulnerability Scanning and Remediation

Annual Penetration Testing

Physical Security Controls at Data Centers

SOC 2 Type II    Period:

HITRUST    Certificate ID:

ISO 27001    Scope:

Data Handling and PHI

Types of PHI received, created, maintained, or transmitted:

Storage locations (e.g., cloud provider, data center locations, on-premises):

Does the vendor de-identify or anonymize PHI prior to use?: Yes

Subcontractors and Third Parties

Will subcontractors or downstream processors have access to PHI?: Yes

Do agreements with subcontractors include equivalent privacy and security flow-down obligations?: Yes

Incident Response, Breach Notification, and Reporting

Does the vendor maintain a documented incident response plan?: Yes

Vendor agrees to notify the covered entity of any unauthorized access, use, or disclosure of PHI within:

Audit Rights, Logistics, and Deliverables

The vendor acknowledges that the covered entity (or its authorized representative) may conduct audits and assessments to verify compliance with contractual obligations and applicable privacy and security law. The audit scope may include systems, policies, personnel interviews, and documentation review.

Onsite audit permitted: Yes    Remote audit permitted: Yes

Required advance notice for audits (calendar days):

Vendor agrees to provide requested documentation within: calendar days of request.

Remediation, Corrective Action, and Costs

Vendor shall implement corrective action for audit findings and provide a written remediation plan within: calendar days following receipt of findings.

Vendor agrees that the costs of corrective actions required due to vendor noncompliance will be borne by: Vendor    Covered Entity

Recordkeeping and Retention

Vendor certifies it will retain evidence relevant to audits (policies, logs, test reports) for a minimum period of: unless otherwise required by law.

Legal Terms, Confidentiality, and Miscellaneous

By executing this questionnaire and authorization, Vendor acknowledges and agrees that: (a) the covered entity or its authorized auditor may assess Vendor's compliance with applicable privacy and security obligations; (b) responses and documentation provided are accurate and complete to the best of Vendor's knowledge; (c) any deficient practices must be remediated promptly; and (d) all information provided to the covered entity in connection with audits will be treated as confidential and used solely for compliance, monitoring, and remediation purposes consistent with the parties' agreements.

Vendor acknowledges that failure to comply with the audit process, to timely remediate material deficiencies, or to provide truthful responses may constitute a material breach of contractual obligations and may give rise to contractual remedies, including termination for cause.

Attachments and Supporting Evidence

List attachments provided with this response (copies of policies, reports, certificates, evidence):

Vendor Certification and Authorized Signature

The undersigned, on behalf of the Vendor identified above, certifies under penalty of perjury that the information provided in this questionnaire is true, complete and accurate. The undersigned warrants they are authorized to bind the Vendor and that responses and any supporting documentation are provided in good faith.

Sign Now