HIPAA Vendor Management and BAA Checklist for Dental Practices

A signed Business Associate Agreement is important, but it is not the whole vendor-management program. A dental practice also needs to know what the vendor does, which patient information and systems it can reach, how access is controlled, what the contracts require, how incidents are reported, and what happens when the relationship ends.

Vendor risk is operational. Practice-management software, imaging, claims, payment, cloud storage, phones, websites, analytics, remote IT support, backup, shredding, transcription, and patient communication may cross technical and organizational boundaries every day.

The goal is a current, evidence-backed register—not a folder of agreements no one can connect to the actual environment.

1. Build one complete vendor register

Start with accounting records, contracts, software inventories, browser applications, network scans, administrator portals, and interviews with department owners. Include free services and tools purchased directly by employees.

For each vendor, record:

Legal name, product, service, and business owner.
Primary operational and security contacts.
Contract start, renewal, and termination dates.
Data created, received, maintained, or transmitted.
Systems, locations, devices, or accounts accessible.
Integration, remote-support, and authentication methods.
Business associate determination and rationale.
BAA and main-service-agreement status.
Subcontractor or hosting dependencies when relevant.
Last review, open risks, and next action.

Group related vendors carefully. A reseller, product company, cloud host, integration partner, and support provider may have different responsibilities even when staff think of them as one system.

2. Determine whether the vendor is a business associate

HHS defines a business associate as a person or entity that performs certain functions or services for a covered entity involving protected health information. Subcontractors that create, receive, maintain, or transmit PHI on behalf of a business associate can also be business associates.

Focus on the service actually performed and the information involved. Ask:

Does the vendor create, receive, maintain, or transmit PHI on the practice's behalf?
Can it access patient records through support, hosting, monitoring, backup, or integration?
Does it store encrypted ePHI even if it cannot decrypt it?
Is access persistent, or is the vendor only providing a limited transmission service?
Is the vendor acting on the practice's behalf or in another legally distinct role?

Not every software seller is automatically a business associate. HHS explains that merely selling software does not create a business associate relationship if the vendor has no access to PHI. Document the facts and rationale instead of using the vendor category alone.

When the answer is uncertain, route it to the practice's qualified privacy or legal adviser.

3. Match the BAA to the actual service

HHS sample provisions state that a business associate contract must establish permitted and required uses and disclosures, require safeguards, address reporting of impermissible uses and breaches, flow restrictions to applicable subcontractors, support required access and records obligations, address return or destruction at termination when feasible, and permit termination for material violation.

Check that the parties and services are correctly named. A BAA with a parent company, reseller, or different product may not clearly cover the service the practice uses.

Review the BAA together with the main service agreement, privacy terms, security addendum, service-level commitments, order form, and data-processing terms. Conflicts can hide in separate documents. For example, a BAA may promise incident reporting while another agreement defines the timing, contact, exclusions, or remedy.

A vendor's willingness to sign a BAA does not certify the product, configuration, or customer as compliant. The practice still must perform its own risk analysis and apply the service appropriately.

4. Verify data flow and minimum necessary access

Draw the path from the source system to the vendor and onward to integrations or subprocessors. Identify:

Data fields and file types transferred.
Transfer method and frequency.
Storage locations and retention.
Users and roles that can view or export information.
Administrative and support access.
Logs available to the practice.
Connected applications and downstream disclosures.

Reduce access that is broader than the service requires. A vendor helping with one operational function may not need full database exports, unrestricted remote access, or shared administrator credentials.

When a vendor claims that data is de-identified, confirm the method and responsibility. Removing names alone may not eliminate identifying information.

5. Evaluate safeguards with evidence

Use a review proportionate to the information and access involved. Topics may include:

Identity, multifactor authentication, privileged access, and workforce offboarding.
Encryption in transit and at rest, with appropriate key management.
Secure development, vulnerability management, and patching.
Logging, monitoring, incident detection, and notification.
Backup, availability, recovery objectives, and restore testing.
Tenant separation, data export, retention, and deletion.
Independent assessments or certifications and their exact scope.
Subcontractor oversight and service dependencies.

Do not collect reports that no one evaluates. Record what evidence was reviewed, its coverage period and scope, gaps identified, who accepted or remediated them, and when the review must recur.

HHS says HIPAA does not expressly require a cloud provider to give customers audit documentation, but customers may require additional assurances through contracts or other documentation based on their risk analysis. Build evidence expectations into procurement instead of asking after the contract is signed.

6. Control vendor identities and remote access

Require named accounts where feasible. Avoid permanent shared credentials. Apply least privilege, multifactor authentication, approved remote-support tools, time-limited access where practical, and logging.

Maintain an owner for every vendor account. Review access after staff changes, service changes, support events, and contract renewals. Disable dormant accounts and remove old remote-control agents, firewall rules, API keys, and integrations.

Ask the vendor how emergency access works and how the practice will be notified. Make sure internal administrators can distinguish legitimate vendor activity from suspicious access.

7. Define incident coordination before an event

The contracts and operating plan should answer:

Which events must the vendor report?
To whom and through which 24-hour channel?
What initial information and updates will be provided?
How quickly must the vendor preserve evidence and cooperate?
Who leads containment across connected systems?
How will affected records, individuals, and time periods be identified?
How will subcontractor incidents flow back to the practice?
Who makes legal, privacy, insurance, and notification decisions?

Test the contact path. A security mailbox that no one monitors or a former employee listed as the notice contact can turn a manageable incident into a delayed response.

8. Plan renewal, change, and termination

Review high-impact vendors before automatic renewal. Reassess when the product adds AI features, new integrations, different hosting, analytics, recording, tracking, or a material acquisition.

Before termination, decide how the practice will:

Export records and verify completeness.
Preserve required formats, metadata, and audit information.
Transfer operational ownership.
Revoke users, API keys, integrations, remote access, and network rules.
Return or destroy PHI as required and document the result.
Address retained copies, legal holds, backups, and subcontractors.
Monitor final invoices and unexpected access.

Do not let cancellation occur before validated data export and continuity planning.

Quarterly vendor review checklist

New vendors and shadow IT have been added to the register.
Business associate determinations still match actual services and data flows.
Required BAAs are executed and match the contracting parties.
Contracts and BAAs are reviewed together.
Vendor accounts, remote access, and integrations have current owners.
Security evidence is current and open risks are tracked.
Incident contacts and reporting paths work.
Renewals and service changes trigger review.
Terminated vendors have completed data return, deletion, and access removal.
Vendor findings feed the HIPAA risk-management plan.

Authoritative references

This guide is educational and does not provide legal or compliance advice. Business associate status and contract requirements depend on the parties, services, data, and applicable law. Use qualified advisers for specific determinations and agreements.