hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html

For a small healthcare practice, I’d treat this as **a security/compliance procurement decision first and a software-development decision second**. “HIPAA compliant” is not something a vendor can simply promise; your practice still has obligations, including risk analysis, while vendors handling ePHI generally become business associates and need an appropriate BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Here’s a practical way to choose. ## 1. Define exactly what the portal will handle Before talking to vendors, write a one-page requirements list. For example: - Patient registration/intake - Secure patient-provider messaging - Appointment requests - Forms and document uploads - Lab results or clinical documents - Billing/payment information - Telehealth - Prescription/refill requests - Integration with your EHR - Notifications by email/SMS - Staff/admin dashboard - Patient identity verification Most importantly, mark **where PHI/ePHI enters, is stored, transmitted, and accessed**. HHS specifically recommends identifying ePHI and external vendors that create, receive, maintain, or transmit it as part of your risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ## 2. Make a BAA a gate, not a checkbox If the vendor will handle ePHI on your behalf, you generally need a HIPAA-compliant **Business Associate Agreement (BAA)**. This applies to many portal vendors and cloud providers, even when the data is encrypted. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) Ask every vendor: > “Will you sign our BAA before we put any PHI into the system?” Then ask: - Does your BAA cover **all** services we're buying? - Which subcontractors have access to PHI? - Do your subcontractors sign appropriate agreements? - What happens to our PHI when we terminate? - Can we obtain our data in a usable format? - What are your breach/security-incident notification obligations? - Who owns the data? - Can you use our data for analytics, AI training, advertising, or product development? HHS's sample BAA provisions specifically address safeguards, breach reporting, subcontractors, return/destruction of PHI, and termination rights. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html?utm_source=chatgpt.com) **Red flag:** A salesperson says, “We're HIPAA compliant, so you don't need a BAA.” ## 3. Evaluate the security architecture—not the marketing Ask the vendor for a **security architecture/data-flow diagram** showing: > Patient → Portal → API/backend → database/file storage → EHR/other services You want to understand every system that touches PHI. At minimum, ask about: | Area | What I'd want to see | |---|---| | Encryption | TLS in transit; strong encryption at rest | | Authentication | MFA for staff; strong patient authentication | | Authorization | Role-based/least-privilege access | | Audit logs | Who accessed/changed what and when | | Session security | Short-lived sessions, secure cookies/tokens | | Backups | Encrypted, tested, geographically resilient | | Disaster recovery | Documented recovery objectives and testing | | Monitoring | Security logging and alerting | | Vulnerability management | Regular scanning and patching | | Penetration testing | Independent testing, preferably recurring | | Development | Secure SDLC/code review/dependency management | | Data deletion | Documented retention and destruction procedures | | Incident response | Written process and notification procedures | HIPAA's Security Rule is based on administrative, physical, and technical safeguards protecting the confidentiality, integrity, and availability of ePHI—not simply encryption or a particular technology. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ## 4. Ask for evidence Don't accept answers like: > “We take security very seriously.” Ask for evidence you can reasonably review. Useful evidence includes: - SOC 2 Type II report - HITRUST certification, if applicable - Recent penetration-test executive summary - Security policies - Incident-response policy - Disaster-recovery/business-continuity documentation - Data-flow diagram - Subprocessor list - BAA - Encryption details - Access-control documentation - Uptime/SLA commitments - Security questionnaire responses SOC 2 or HITRUST can be useful evidence, but **neither automatically makes a product HIPAA compliant**. Your own risk analysis still matters. HHS explicitly notes that customers can require additional assurances—such as documentation of safeguards or audits—through the BAA, SLA, or other agreements based on their risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) ## 5. Be particularly careful with email, SMS, analytics, and AI These are easy places for a seemingly secure portal to accidentally leak information. Ask: **Email** - Does email contain PHI or merely say “You have a new secure message”? - What happens if a patient replies by ordinary email? **SMS** - Are texts generic notifications or do they contain PHI? - What happens with an incorrect phone number? **Analytics** - Are Google Analytics, Meta Pixel, advertising trackers, session-recording tools, etc. present? - Does any third party receive patient-identifiable information? **AI** - Is patient information sent to an AI provider? - Is it retained? - Is it used for model training? - Which AI/subprocessor receives it? - Is the arrangement covered by the BAA? A vendor can have an excellent secure database while introducing risk through a third-party analytics or messaging integration. ## 6. Don't automatically build it from scratch For a small practice, I'd strongly consider three approaches: ### A. Existing healthcare portal — usually my first choice Best if your requirements are reasonably standard. **Advantages:** mature security infrastructure, established compliance processes, existing integrations, lower development risk. **Disadvantages:** less customization and potentially recurring per-provider/per-patient fees. ### B. Custom portal on a healthcare-oriented platform Good if you need significant customization but don't want to build every security component yourself. I'd look for a vendor with substantial healthcare experience and an established HIPAA-capable infrastructure. ### C. Completely custom software Only choose this when there is a compelling reason. Custom development means **you are effectively taking on a long-term security program**, not merely paying someone to build a website. You'll need ongoing patching, dependency management, vulnerability management, penetration testing, monitoring, incident response, backups, access reviews, and compliance work. For a small practice, that's often considerably more expensive and risky than anticipated. ## 7. Score vendors objectively I'd use a weighted scorecard rather than choosing based on the nicest demo. For example: | Category | Weight | |---|---:| | Security architecture & evidence | **25%** | | HIPAA/BAA & compliance maturity | **20%** | | Healthcare/EHR experience | **15%** | | Functional requirements | **15%** | | Reliability & disaster recovery | **10%** | | Total cost over 3 years | **10%** | | UX/support/vendor stability | **5%** | Then give each vendor a 1–5 score for each category. I'd make **BAA + security requirements + ability to export your data** pass/fail requirements rather than allowing a cheap price to compensate for them. ## 8. Get specific about the contract Your contract should cover more than the software subscription. Pay particular attention to: - BAA - Data ownership - Data export format - Data retention - Data destruction at termination - Subprocessors - Security incident notification - Liability/indemnification - Cyber insurance - Uptime/SLA - Backup and recovery - Support response times - Security testing - Changes to security architecture - Price increases - Termination rights - Assistance migrating away HHS notes that cloud arrangements can use an SLA to address availability, reliability, backup, and recovery expectations in addition to the BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ## 9. Run a security review before production Don't put real patient data into a new portal simply because the vendor signed a BAA. Before launch: 1. Complete your practice's HIPAA security risk analysis. 2. Map all PHI flows. 3. Review the vendor's security documentation. 4. Review the BAA and contract. 5. Configure MFA/access controls. 6. Configure audit logging. 7. Test account recovery and patient identity verification. 8. Test backup/recovery procedures. 9. Conduct vulnerability/penetration testing as appropriate. 10. Test your incident-response process. 11. Train staff. 12. Start with a controlled rollout. HHS describes risk analysis as the foundational step for determining the safeguards appropriate to your particular environment; HIPAA does not prescribe a single technology stack or one-size-fits-all methodology. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ## 10. My vendor-interview questions I'd send prospective vendors these questions **before** spending much time on demos: > 1. Will you sign a BAA with our practice? > > 2. What systems and subprocessors will create, receive, maintain, or transmit our ePHI? > > 3. Can you provide a data-flow architecture diagram? > > 4. Where is our ePHI stored and processed? > > 5. How is ePHI encrypted in transit and at rest? > > 6. How do you enforce least-privilege access? > > 7. Do all staff with administrative access use MFA? > > 8. What audit logs are maintained, and can our practice access them? > > 9. When was your last independent penetration test? > > 10. Can you provide a SOC 2 Type II, HITRUST report/certification, or equivalent security evidence? > > 11. How frequently are backups performed and recovery tested? > > 12. What happens if you suffer a security incident? > > 13. How quickly will you notify us? > > 14. Which subcontractors can access our PHI? > > 15. Do you use customer data for analytics, advertising, AI training, or product development? > > 16. How do we export all patient data if we leave? > > 17. What happens to our data after termination? > > 18. What security responsibilities remain with our practice? > > 19. What does your SLA guarantee? > > 20. What is the **three-year total cost**, including implementation, integrations, support, storage, users, and future upgrades? That last question is important. A $15,000 portal can become a $50,000+ project once integrations, customization, support, security testing, and ongoing maintenance are included. ### One important distinction I'd also decide whether you actually need a **custom client portal**. If your requirements are essentially *secure messaging + forms + documents + appointments + payments*, buying an established healthcare product may be much safer and cheaper than commissioning custom software. If you need a highly specialized workflow—say, a novel clinical workflow, unusual patient data collection, or deep integration with an existing system—custom development becomes more compelling. For the official requirements, [HHS's HIPAA Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/index.html) and [HHS's risk-analysis guidance](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html) are good starting points. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) **If you tell me your practice type, approximate number of providers/patients, and the portal features you need, I can turn this into a concrete vendor-selection scorecard/RFP you could send to 5–10 vendors.** [HHS's HIPAA Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/index.html) [HHS's risk-analysis guidance](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html) | Area | What I'd want to see | |---|---| | Encryption | TLS in transit; strong encryption at rest | | Authentication | MFA for staff; strong patient authentication | | Authorization | Role-based/least-privilege access | | Audit logs | Who accessed/changed what and when | | Session security | Short-lived sessions, secure cookies/tokens | | Backups | Encrypted, tested, geographically resilient | | Disaster recovery | Documented recovery objectives and testing | | Monitoring | Security logging and alerting | | Vulnerability management | Regular scanning and patching | | Penetration testing | Independent testing, preferably recurring | | Development | Secure SDLC/code review/dependency management | | Data deletion | Documented retention and destruction procedures | | Incident response | Written process and notification procedures | HIPAA's Security Rule is based on administrative, physical, and technical safeguards protecting the confidentiality, integrity, and availability of ePHI—not simply encryption or a particular technology. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ## 4. Ask for evidence Don't accept answers like: > “We take security very seriously.” Ask for evidence you can reasonably review. Useful evidence includes: - SOC 2 Type II report - HITRUST certification, if applicable - Recent penetration-test executive summary - Security policies - Incident-response policy - Disaster-recovery/business-continuity documentation - Data-flow diagram - Subprocessor list - BAA - Encryption details - Access-control documentation - Uptime/SLA commitments - Security questionnaire responses SOC 2 or HITRUST can be useful evidence, but **neither automatically makes a product HIPAA compliant**. Your own risk analysis still matters. HHS explicitly notes that customers can require additional assurances—such as documentation of safeguards or audits—through the BAA, SLA, or other agreements based on their risk analysis. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/faq/2084/do-the-hipaa-rules-require-csps-that-are-business-associates-to-provide-documentation-or-allow-auditing-of-their-security-practices-by-their-customers-who-are-covered-entities-or-business-associates/index.html?utm_source=chatgpt.com) ## 5. Be particularly careful with email, SMS, analytics, and AI These are easy places for a seemingly secure portal to accidentally leak information. Ask: **Email** - Does email contain PHI or merely say “You have a new secure message”? - What happens if a patient replies by ordinary email? **SMS** - Are texts generic notifications or do they contain PHI? - What happens with an incorrect phone number? **Analytics** - Are Google Analytics, Meta Pixel, advertising trackers, session-recording tools, etc. present? - Does any third party receive patient-identifiable information? **AI** - Is patient information sent to an AI provider? - Is it retained? - Is it used for model training? - Which AI/subprocessor receives it? - Is the arrangement covered by the BAA? A vendor can have an excellent secure database while introducing risk through a third-party analytics or messaging integration. ## 6. Don't automatically build it from scratch For a small practice, I'd strongly consider three approaches: ### A. Existing healthcare portal — usually my first choice Best if your requirements are reasonably standard. **Advantages:** mature security infrastructure, established compliance processes, existing integrations, lower development risk. **Disadvantages:** less customization and potentially recurring per-provider/per-patient fees. ### B. Custom portal on a healthcare-oriented platform Good if you need significant customization but don't want to build every security component yourself. I'd look for a vendor with substantial healthcare experience and an established HIPAA-capable infrastructure. ### C. Completely custom software Only choose this when there is a compelling reason. Custom development means **you are effectively taking on a long-term security program**, not merely paying someone to build a website. You'll need ongoing patching, dependency management, vulnerability management, penetration testing, monitoring, incident response, backups, access reviews, and compliance work. For a small practice, that's often considerably more expensive and risky than anticipated. ## 7. Score vendors objectively I'd use a weighted scorecard rather than choosing based on the nicest demo. For example: | Category | Weight | |---|---:| | Security architecture & evidence | **25%** | | HIPAA/BAA & compliance maturity | **20%** | | Healthcare/EHR experience | **15%** | | Functional requirements | **15%** | | Reliability & disaster recovery | **10%** | | Total cost over 3 years | **10%** | | UX/support/vendor stability | **5%** | Then give each vendor a 1–5 score for each category. I'd make **BAA + security requirements + ability to export your data** pass/fail requirements rather than allowing a cheap price to compensate for them. ## 8. Get specific about the contract Your contract should cover more than the software subscription. Pay particular attention to: - BAA - Data ownership - Data export format - Data retention - Data destruction at termination - Subprocessors - Security incident notification - Liability/indemnification - Cyber insurance - Uptime/SLA - Backup and recovery - Support response times - Security testing - Changes to security architecture - Price increases - Termination rights - Assistance migrating away HHS notes that cloud arrangements can use an SLA to address availability, reliability, backup, and recovery expectations in addition to the BAA. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html?utm_source=chatgpt.com) ## 9. Run a security review before production Don't put real patient data into a new portal simply because the vendor signed a BAA. Before launch: 1. Complete your practice's HIPAA security risk analysis. 2. Map all PHI flows. 3. Review the vendor's security documentation. 4. Review the BAA and contract. 5. Configure MFA/access controls. 6. Configure audit logging. 7. Test account recovery and patient identity verification. 8. Test backup/recovery procedures. 9. Conduct vulnerability/penetration testing as appropriate. 10. Test your incident-response process. 11. Train staff. 12. Start with a controlled rollout. HHS describes risk analysis as the foundational step for determining the safeguards appropriate to your particular environment; HIPAA does not prescribe a single technology stack or one-size-fits-all methodology. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) ## 10. My vendor-interview questions I'd send prospective vendors these questions **before** spending much time on demos: > 1. Will you sign a BAA with our practice? > > 2. What systems and subprocessors will create, receive, maintain, or transmit our ePHI? > > 3. Can you provide a data-flow architecture diagram? > > 4. Where is our ePHI stored and processed? > > 5. How is ePHI encrypted in transit and at rest? > > 6. How do you enforce least-privilege access? > > 7. Do all staff with administrative access use MFA? > > 8. What audit logs are maintained, and can our practice access them? > > 9. When was your last independent penetration test? > > 10. Can you provide a SOC 2 Type II, HITRUST report/certification, or equivalent security evidence? > > 11. How frequently are backups performed and recovery tested? > > 12. What happens if you suffer a security incident? > > 13. How quickly will you notify us? > > 14. Which subcontractors can access our PHI? > > 15. Do you use customer data for analytics, advertising, AI training, or product development? > > 16. How do we export all patient data if we leave? > > 17. What happens to our data after termination? > > 18. What security responsibilities remain with our practice? > > 19. What does your SLA guarantee? > > 20. What is the **three-year total cost**, including implementation, integrations, support, storage, users, and future upgrades? That last question is important. A $15,000 portal can become a $50,000+ project once integrations, customization, support, security testing, and ongoing maintenance are included. ### One important distinction I'd also decide whether you actually need a **custom client portal**. If your requirements are essentially *secure messaging + forms + documents + appointments + payments*, buying an established healthcare product may be much safer and cheaper than commissioning custom software. If you need a highly specialized workflow—say, a novel clinical workflow, unusual patient data collection, or deep integration with an existing system—custom development becomes more compelling. For the official requirements, [HHS's HIPAA Security Rule guidance](https://www.hhs.gov/hipaa/for-professionals/security/index.html) and [HHS's risk-analysis guidance](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html) are good starting points. [www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/index.html?utm_source=chatgpt.com)[www.hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/guidance/guidance-risk-analysis/index.html?utm_source=chatgpt.com) **If you tell me your practice type, approximate number of providers/patients, and the portal features you need, I can turn this into a concrete vendor-selection scorecard/RFP you could send to 5–10 vendors.**