HIPAA (Health Insurance Portability and Accountability Act)

The Health Insurance Portability and Accountability Act is a U.S. federal law establishing national standards for the protection of sensitive patient health information. Organizations that share protected health information (PHI) with third-party vendors are required to execute Business Associate Agreements (BAAs) and verify that those vendors maintain appropriate safeguards. HIPAA compliance is a critical dimension of third-party risk management for healthcare organizations and their supply chains. Black Kite's Compliance Rating maps vendor security controls to HIPAA requirements.

Who Counts as a Business Associate Under HIPAA?

HIPAA has three main components:

The Privacy Rule: governs use and disclosure of health information.
The Security Rule: sets technical safeguards for electronic records.
The Breach Notification Rule: requires disclosure within 60 days of discovering a breach.

The Security Rule hasn't been substantially updated since 2003, and its current encryption standard is addressable rather than required, meaning an organization must implement it or document why an equivalent alternative is reasonable and appropriate. HHS proposed removing that flexibility in a 2025 update, though the rule had not been finalized as of October 2026, with HHS’s regulatory agenda now targeting July 2027 for final action.

A Business Associate Is Anyone Handling PHI on a Covered Entity's Behalf

A business associate is any vendor, contractor, or service provider that creates, receives, maintains, or transmits PHI on behalf of a covered entity, whether that vendor is a billing company, a cloud host, or an AI tool processing clinical notes. A covered entity, meaning a healthcare provider, health plan, or clearinghouse, is only half of HIPAA's third-party picture. The business associate agreement (BAA) that governs the relationship, functioning as a kind of attestation of a vendor's obligations, is where most of HIPAA's actual vendor risk management happens.

The HIPAA Omnibus Rule extended that same obligation downstream. A subcontractor that handles PHI on behalf of a business associate is itself a business associate and needs its own BAA in place, even though it has no direct relationship with the covered entity. A hospital's billing vendor might rely on a cloud storage provider, a payment processor, and an AI transcription tool, and each one inherits the same legal exposure whether or not the hospital ever learns those subcontractors exist.

What Does the Current Security Rule Actually Require From Vendors?

Under the Security Rule as it stands today, a signed BAA is generally treated as the compliance anchor, and nothing in the current rule requires ongoing proof that a business associate is keeping its promises. In practice, vendor oversight often becomes a paperwork exercise. A covered entity gets a signed BAA, files it, and assumes the business associate is handling its own security and its own subcontractors correctly.

That assumption leaves a gap. A covered entity can hold a compliant BAA while its business associate fails to impose equivalent obligations on its own subcontractors, and the BAA alone gives the covered entity no visibility into that failure. A signed agreement protects a business only as far as the vendor actually follows it.

How Would the Proposed Security Rule Update Change Vendor Oversight?

HHS published its proposed Security Rule overhaul on January 6, 2025, and the most significant change for vendor risk is a new annual verification requirement. Business associates would need to certify, through written analysis, that required safeguards are actually in place and operating, beyond what's documented in a contract. The proposal would also require encryption outright, require multi-factor authentication, and add a 24-hour notification window for business associates activating contingency plans after an incident.

That shift moves vendor oversight from paperwork to evidence. A covered entity would no longer be able to treat a signed BAA as the finish line. It would need proof, refreshed regularly, that a business associate's controls match what the contract claims. The rule remained unfinished as of October 2026, so the current addressable standard is still what OCR enforces, and covered entities relying only on a filed BAA today are meeting the letter of the current rule while missing where it's headed.

What Happens When a Business Associate's Breach Goes Undisclosed?

A business associate breach doesn't always become a headline, and the reason comes down to what triggers mandatory disclosure under federal law. Black Kite's Third-Party Breach Report 2026 found that a company is typically named publicly only when a breach exposes information, like PHI, that meets a legal disclosure threshold. If a vendor breach compromises internal records that don't meet that threshold, the affected healthcare organization often never has to come forward. The vendor might disclose aggregate impact without naming which of its healthcare clients were affected at all.

That silence has a real cost for due diligence programs built around vendor-reported incidents. Public silence reflects the disclosure threshold as much as it reflects a business associate's actual security.

How Is HIPAA Different From a General Data Breach Law?

HIPAA is sector-specific to healthcare and layers directly on top of general data breach notification laws. A hospital's vendor breach can trigger HIPAA's Breach Notification Rule, applicable state data breach laws, and in some cases consumer privacy statutes like GDPR if the patients involved are EU residents, all from the same incident. Programs that track only one of those obligations tend to miss the others, which is why a broader regulatory risk view of a vendor is what actually protects a healthcare organization, wider than any single-framework checklist.

How Does Black Kite Support HIPAA Business Associate Oversight?

Continuous visibility into a business associate's actual security posture, tracked through Black Kite Monitor, is what closes the gap a signed BAA leaves open on its own. Compliance Rating maps those technical findings, plus any documentation parsed by UniQuE™ Parser, to HIPAA control items.

Vendor risk monitoring surfaces changes to a business associate’s external exposure on a continuous scan cycle, well ahead of the next scheduled reassessment or a breach notification that would otherwise surface the same information months late. When OCR or an internal audit asks for proof of oversight, vendor compliance management pulls the relevant documentation together into one organized record.

Neither capability replaces the BAA itself. Both are built for the gap the current Security Rule leaves open, the space between a signed contract and a vendor's actual, day-to-day controls.