easyaudit.ai

For a small healthcare practice, I’d choose the vendor **less like a normal software-development shop and more like a security/compliance partner**. “HIPAA compliant” is not a certification that makes a product automatically safe; your practice still has responsibilities, including risk analysis and appropriate safeguards. HHS specifically says the Security Rule is scalable to the size and circumstances of the organization. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?form=MG0AV3&utm_source=chatgpt.com) ### 1. First decide whether you actually need a custom portal Before hiring anyone, define what the portal must do: - Patient registration/intake - Secure messaging - Appointment requests - Forms and document exchange - Lab/results delivery - Billing/payment information - Telehealth - Integration with your EHR/EMR - Staff-to-patient communication - Patient identity verification If an established healthcare platform already provides most of these functions, **buying/configuring it is usually much lower risk than commissioning a custom application**. Custom development makes more sense when your workflow is genuinely unusual or you need integrations/functionality existing products can't provide. ### 2. Make the BAA a hard requirement If the vendor will create, receive, maintain, or transmit ePHI for the practice, it will generally be a HIPAA business associate. HHS says a covered entity needs a HIPAA-compliant **Business Associate Agreement (BAA)** with such a provider. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com) Ask every vendor: > **“Will you sign our BAA before we provide you with any PHI, and does the BAA cover all of your subcontractors that will handle ePHI?”** Don't accept “our platform is HIPAA compliant” as an answer. The agreement should address, among other things, permitted uses/disclosures, security safeguards, breach reporting, return/destruction of PHI, and subcontractors. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) ### 3. Evaluate the actual security architecture Have a technically knowledgeable person review the architecture—not just the sales presentation. At minimum, ask about: | Area | What I'd want to see | |---|---| | **Encryption** | Encryption in transit and at rest; understand key management | | **Authentication** | Strong authentication, preferably MFA for staff | | **Authorization** | Role-based/least-privilege access | | **Audit logs** | Who accessed/changed what, when, and from where | | **Session security** | Automatic timeout, secure sessions, account recovery | | **Backups** | Encrypted backups, tested restoration, disaster recovery | | **Monitoring** | Security monitoring and incident detection | | **Development** | Code review, dependency management, vulnerability scanning | | **Testing** | Penetration testing and remediation process | | **Availability** | Uptime commitments and disaster-recovery objectives | | **Data deletion** | What happens to PHI when you terminate the contract | | **Subprocessors** | Complete list and how they are governed | These aren't arbitrary technical preferences: HIPAA's Security Rule includes access controls, audit controls, authentication, integrity protections and transmission security. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?form=MG0AV3&utm_source=chatgpt.com) ### 4. Ask for evidence, not promises A good vendor should be comfortable answering questions such as: - Do you have a current **SOC 2 Type II** report? - Can we review the report under NDA? - When was your last penetration test? - Can we receive an executive summary of the findings? - What critical/high vulnerabilities are currently outstanding? - What is your incident-response process? - When will we be notified of a security incident? - Who has production access to our data? - Are production engineers able to see patient records? - What cloud providers and subprocessors do you use? - How are encryption keys managed? - How do you segregate customers' data? - How do you securely delete our data? - Can we export all of our data in a usable format? Importantly, **HIPAA doesn't itself require a vendor to give you its security documentation or permit customer audits**. HHS notes that you can nevertheless negotiate additional assurances through the BAA, SLA, or other contractual documentation. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) So make the evidence part of vendor selection rather than discovering later that the vendor won't provide it. ### 5. Pay particular attention to integrations This is where otherwise good portal projects can become dangerous. Draw the data flow: **Patient → Portal → Application → EHR → Labs/Pharmacy/etc.** For every arrow, ask: - Is PHI being transmitted? - Who operates that system? - Is there a BAA where required? - Is the connection encrypted? - What authentication mechanism is used? - What happens if the integration fails? - Is PHI cached or stored outside the primary system? - Are logs themselves potentially containing PHI? Your vendor should be able to produce a clear architecture/data-flow diagram. ### 6. Don't let the vendor define "HIPAA compliant" for you I'd give vendors a requirements document containing **specific acceptance criteria**. For example: > The application must support unique user identification, appropriate access controls, MFA for administrative users, audit logging of access to ePHI, encryption of ePHI in transit and at rest, documented backup/recovery procedures, security incident response, and contractual BAA obligations. That turns “HIPAA compliant” from a marketing claim into something you can actually evaluate. ### 7. Score vendors rather than choosing based on price For a small practice, I'd use something roughly like: | Criterion | Weight | |---|---:| | Security architecture & controls | **25%** | | HIPAA/BAA maturity | **20%** | | Healthcare experience | **15%** | | Reliability & disaster recovery | **10%** | | EHR/integration capability | **10%** | | Product usability | **10%** | | Total cost | **10%** | I'd deliberately give **price only 10%**. A $20,000 cheaper project isn't cheaper if you later have to rebuild the authentication, logging, integrations, backup architecture, or security controls. ### 8. Look for these vendor red flags I'd walk away—or at least investigate very carefully—if you hear: - “We're HIPAA compliant because we use AWS/Azure.” - “HIPAA doesn't require a BAA because we can't see the data.” - “We're HIPAA certified.” - “Encryption means you're covered.” - “We don't need audit logs.” - “We can figure security out after development.” - “Our developers are HIPAA trained, so that's sufficient.” - “We don't provide penetration-test information.” - “We don't have a formal incident-response process.” - “You don't need a risk assessment.” - “We can use whatever third-party tools we want.” - “You don't need to worry about our subcontractors.” For example, HHS explicitly says that a cloud provider can still be a business associate even when it stores only encrypted ePHI and cannot decrypt it. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2076/if-a-csp-stores-only-encrypted-ephi-and-does-not-have-a-decryption-key-is-it-a-hipaa-business-associate/index.html?utm_source=chatgpt.com) ### 9. Make the contract protect the practice The development/SaaS agreement should cover more than the BAA: - Ownership of the application and data - Source-code ownership or escrow, if appropriate - Data portability/export - Security obligations - BAA - Subprocessor requirements - Breach/incident notification - Uptime/SLA - Backup and recovery - Disaster recovery - Vulnerability remediation - Penetration testing - Change-management procedures - Termination assistance - Secure deletion/return of PHI - Liability/indemnification - Insurance, including appropriate cyber coverage HHS specifically notes that an SLA can address availability, backup/recovery, data return after termination, security responsibilities, and data retention/disclosure. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2076/if-a-csp-stores-only-encrypted-ephi-and-does-not-have-a-decryption-key-is-it-a-hipaa-business-associate/index.html?utm_source=chatgpt.com) ### 10. Do your own HIPAA risk analysis Don't outsource your entire compliance responsibility to the developer. HHS calls risk analysis **foundational** to the Security Rule, and its Security Risk Assessment Tool is specifically intended to help small and medium-sized healthcare practices. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) A sensible process is: **Practice requirements → risk analysis → vendor requirements → architecture review → vendor selection → BAA/contract → security testing → launch → ongoing monitoring** I'd also have a **healthcare/privacy attorney or HIPAA consultant review the BAA and contract**, particularly if the portal will store clinical records rather than merely facilitate communications. ### My preferred vendor-selection process For a small practice, I'd shortlist **3–5 vendors**, then give each exactly the same requirements and security questionnaire. Have them provide: 1. Architecture/data-flow diagram 2. BAA 3. Security documentation 4. SOC 2 report or equivalent assurance 5. Pen-test summary 6. Subprocessor list 7. Disaster-recovery/backup description 8. Data-export/deletion procedure 9. Sample SLA 10. Three healthcare customer references Then score them using the same rubric. **The biggest mistake I'd avoid:** choosing a developer first and asking them to “make it HIPAA compliant” afterward. Security, identity, logging, data architecture, integrations, backups, and contractual responsibilities need to be designed into the system from the beginning. If you tell me **the practice size, what the portal needs to do, whether you already use an EHR (e.g., Epic, athenahealth, Jane, etc.), and whether you want custom development or are open to an existing platform**, I can narrow this into a practical vendor-selection strategy and a set of questions you can send to prospective vendors. | Area | What I'd want to see | |---|---| | **Encryption** | Encryption in transit and at rest; understand key management | | **Authentication** | Strong authentication, preferably MFA for staff | | **Authorization** | Role-based/least-privilege access | | **Audit logs** | Who accessed/changed what, when, and from where | | **Session security** | Automatic timeout, secure sessions, account recovery | | **Backups** | Encrypted backups, tested restoration, disaster recovery | | **Monitoring** | Security monitoring and incident detection | | **Development** | Code review, dependency management, vulnerability scanning | | **Testing** | Penetration testing and remediation process | | **Availability** | Uptime commitments and disaster-recovery objectives | | **Data deletion** | What happens to PHI when you terminate the contract | | **Subprocessors** | Complete list and how they are governed | These aren't arbitrary technical preferences: HIPAA's Security Rule includes access controls, audit controls, authentication, integrity protections and transmission security. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html?form=MG0AV3&utm_source=chatgpt.com) ### 4. Ask for evidence, not promises A good vendor should be comfortable answering questions such as: - Do you have a current **SOC 2 Type II** report? - Can we review the report under NDA? - When was your last penetration test? - Can we receive an executive summary of the findings? - What critical/high vulnerabilities are currently outstanding? - What is your incident-response process? - When will we be notified of a security incident? - Who has production access to our data? - Are production engineers able to see patient records? - What cloud providers and subprocessors do you use? - How are encryption keys managed? - How do you segregate customers' data? - How do you securely delete our data? - Can we export all of our data in a usable format? Importantly, **HIPAA doesn't itself require a vendor to give you its security documentation or permit customer audits**. HHS notes that you can nevertheless negotiate additional assurances through the BAA, SLA, or other contractual documentation. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) So make the evidence part of vendor selection rather than discovering later that the vendor won't provide it. ### 5. Pay particular attention to integrations This is where otherwise good portal projects can become dangerous. Draw the data flow: **Patient → Portal → Application → EHR → Labs/Pharmacy/etc.** For every arrow, ask: - Is PHI being transmitted? - Who operates that system? - Is there a BAA where required? - Is the connection encrypted? - What authentication mechanism is used? - What happens if the integration fails? - Is PHI cached or stored outside the primary system? - Are logs themselves potentially containing PHI? Your vendor should be able to produce a clear architecture/data-flow diagram. ### 6. Don't let the vendor define "HIPAA compliant" for you I'd give vendors a requirements document containing **specific acceptance criteria**. For example: > The application must support unique user identification, appropriate access controls, MFA for administrative users, audit logging of access to ePHI, encryption of ePHI in transit and at rest, documented backup/recovery procedures, security incident response, and contractual BAA obligations. That turns “HIPAA compliant” from a marketing claim into something you can actually evaluate. ### 7. Score vendors rather than choosing based on price For a small practice, I'd use something roughly like: | Criterion | Weight | |---|---:| | Security architecture & controls | **25%** | | HIPAA/BAA maturity | **20%** | | Healthcare experience | **15%** | | Reliability & disaster recovery | **10%** | | EHR/integration capability | **10%** | | Product usability | **10%** | | Total cost | **10%** | I'd deliberately give **price only 10%**. A $20,000 cheaper project isn't cheaper if you later have to rebuild the authentication, logging, integrations, backup architecture, or security controls. ### 8. Look for these vendor red flags I'd walk away—or at least investigate very carefully—if you hear: - “We're HIPAA compliant because we use AWS/Azure.” - “HIPAA doesn't require a BAA because we can't see the data.” - “We're HIPAA certified.” - “Encryption means you're covered.” - “We don't need audit logs.” - “We can figure security out after development.” - “Our developers are HIPAA trained, so that's sufficient.” - “We don't provide penetration-test information.” - “We don't have a formal incident-response process.” - “You don't need a risk assessment.” - “We can use whatever third-party tools we want.” - “You don't need to worry about our subcontractors.” For example, HHS explicitly says that a cloud provider can still be a business associate even when it stores only encrypted ePHI and cannot decrypt it. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2076/if-a-csp-stores-only-encrypted-ephi-and-does-not-have-a-decryption-key-is-it-a-hipaa-business-associate/index.html?utm_source=chatgpt.com) ### 9. Make the contract protect the practice The development/SaaS agreement should cover more than the BAA: - Ownership of the application and data - Source-code ownership or escrow, if appropriate - Data portability/export - Security obligations - BAA - Subprocessor requirements - Breach/incident notification - Uptime/SLA - Backup and recovery - Disaster recovery - Vulnerability remediation - Penetration testing - Change-management procedures - Termination assistance - Secure deletion/return of PHI - Liability/indemnification - Insurance, including appropriate cyber coverage HHS specifically notes that an SLA can address availability, backup/recovery, data return after termination, security responsibilities, and data retention/disclosure. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2075/may-a-hipaa-covered-entity-or-business-associate-use-cloud-service-to-store-or-process-ephi/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2076/if-a-csp-stores-only-encrypted-ephi-and-does-not-have-a-decryption-key-is-it-a-hipaa-business-associate/index.html?utm_source=chatgpt.com) ### 10. Do your own HIPAA risk analysis Don't outsource your entire compliance responsibility to the developer. HHS calls risk analysis **foundational** to the Security Rule, and its Security Risk Assessment Tool is specifically intended to help small and medium-sized healthcare practices. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) A sensible process is: **Practice requirements → risk analysis → vendor requirements → architecture review → vendor selection → BAA/contract → security testing → launch → ongoing monitoring** I'd also have a **healthcare/privacy attorney or HIPAA consultant review the BAA and contract**, particularly if the portal will store clinical records rather than merely facilitate communications. ### My preferred vendor-selection process For a small practice, I'd shortlist **3–5 vendors**, then give each exactly the same requirements and security questionnaire. Have them provide: 1. Architecture/data-flow diagram 2. BAA 3. Security documentation 4. SOC 2 report or equivalent assurance 5. Pen-test summary 6. Subprocessor list 7. Disaster-recovery/backup description 8. Data-export/deletion procedure 9. Sample SLA 10. Three healthcare customer references Then score them using the same rubric. **The biggest mistake I'd avoid:** choosing a developer first and asking them to “make it HIPAA compliant” afterward. Security, identity, logging, data architecture, integrations, backups, and contractual responsibilities need to be designed into the system from the beginning. If you tell me **the practice size, what the portal needs to do, whether you already use an EHR (e.g., Epic, athenahealth, Jane, etc.), and whether you want custom development or are open to an existing platform**, I can narrow this into a practical vendor-selection strategy and a set of questions you can send to prospective vendors.