Scrutineer · By framework

HIPAA business associate risk management software

HIPAA does not tell you to audit your vendors. It tells you to get satisfactory assurances in a written contract before a business associate touches ePHI, and to act when you learn of a material breach. Scrutineer keeps the BAA, the vendor tier and the evidence for each business associate in one record, so the file is complete on the day OCR or a customer asks.

or try it below ↓

Control-mapped findings · linked evidence · you decide what to remediate

The Scrutiny Desk

Interactive walkthrough on a sample company, not a scan of your systems.

Worked example with sample findings, not a scrutiny of your environment. Not an audit attestation.

SOC 2 ISO 27001 HIPAA GDPR PCI DSS

Controls in evidence-linked report out

AI scrutinizes you decide

Why it works

What you get with BA risk management

The regulation asks for a contract, not a questionnaire

The Security Rule requires satisfactory assurances, documented in a written contract, before a business associate handles ePHI. The text of 164.308 and 164.314 never uses the words questionnaire or due diligence. What you build above that line is your own risk decision, and it should be written down as one.

Your risk analysis has to reach the vendors

The Required risk analysis covers ePHI wherever it sits, and a lot of it sits at vendors. A vendor inventory with the ePHI each one holds, a tier and a review date is how the analysis stops at the EHR and the file shows it did not.

The 60 day clocks start at different moments

A business associate has up to 60 days to tell you about a breach, and you are treated as knowing about it when your agent knows. The contract notice window is where you buy back time, so it belongs in the record next to the BAA.

What it handles

Controls in, an evidence-linked report out

Point Scrutineer at a framework or a vendor and it maps every control, pulls the evidence it can find, flags the gaps and scores the risk, returning a report with linked evidence and a prioritized remediation list. Scrutineer is decision support for readiness, an accredited auditor still issues the attestation.

Keeps one record per business associate with the signed BAA, its renewal date and the ePHI the vendor creates, receives, maintains or transmits
Flags an expired or missing BAA before ePHI moves, not after an OCR request, the single gap that is easiest to prove and hardest to explain
Tiers vendors by ePHI volume and exposure, so a billing clearinghouse gets a deeper review than a scheduling add-on, and the reason is on file
Sends security questionnaires and collects the SOC 2, HITRUST or ISO 27001 report a business associate already holds, with the review date and who reviewed it
Records the breach notice window in each contract, since the regulation sets only an outer limit of 60 calendar days
Logs the steps taken when a business associate shows a pattern of material breach, the evidence 164.504(e)(1)(ii) turns on
Maps every control to the HIPAA Security Rule, and reuses the same evidence for SOC 2 and HITRUST when a hospital customer asks for those instead
Keeps the vendor list current for your annual risk analysis, so new tools that touch patient data are caught at onboarding

BA risk management readiness_report

Readiness 82%

ACCESS CONTROL 91

evidence · MFA enforced and access reviews evidenced.

CHANGE MGMT 78

evidence · Mostly covered; one approval log left untested.

VENDOR RISK 64

evidence · Two subprocessors missing a current review.

ENCRYPTION 86

evidence · Data encrypted in transit and at rest, evidenced.

Every finding links to the evidence behind it

Why Scrutineer

One platform that maps controls and scores risk

Not a static questionnaire, not a pass-fail black box, and not a spreadsheet you maintain by hand. Live control mapping across SOC 2, ISO 27001, HIPAA, GDPR and PCI, automatic evidence and a prioritized gap list, returned as a report you can act on. The AI scrutinizes, you decide.

Mapped to real controls

Every framework is broken down into the controls it actually requires, each scored on a red to amber to green scale, so readiness stays transparent and consistent.

Evidence behind every finding

Each control links to the exact evidence that satisfies it, the policy, the config, the log line, so the finding is auditable and your readiness is defensible.

A prioritized gap list

Open gaps roll up into a ranked remediation list, so the highest-risk findings sit at the top and your team fixes what matters before the audit begins.

Business associate requirement reference

What HIPAA requires about a business associate, and what it leaves to you

Most vendor risk guides borrow a general third party framework and call it HIPAA. The regulation is narrower and more specific, and the gaps between what it requires and what the market sells are where programs either overspend or get caught.

Situation	What the regulation says	What you owe	Source
Before a vendor touches ePHI	Obtain satisfactory assurances that the business associate will appropriately safeguard the information	A written contract or other arrangement, kept as documentation. Required, with no addressable option	45 CFR 164.308(b)(1) and (b)(3)
What the contract must contain	The business associate will comply with the Security Rule, bind its subcontractors, and report any security incident including breaches of unsecured PHI	A BAA with those three terms, plus the Privacy Rule terms that 164.504(e) lists	164.314(a)(2)(i), 164.504(e)(2)
Whether you must audit, test or send a questionnaire	Not stated. Neither 164.308 nor 164.314 contains the words questionnaire or due diligence	Nothing by name. Your risk analysis and your risk management plan decide how deep to go, and you document the reason	164.308(a)(1)(ii)(A) and (B)
You learn of a pattern of material breach by a business associate	You are out of compliance unless you took reasonable steps to cure the breach, and terminated the contract if that failed and termination is feasible	A dated record of what you knew, what you asked the vendor to fix and what happened next	164.504(e)(1)(ii)
The business associate uses its own subcontractors	You are not required to obtain assurances from a subcontractor. The business associate must, by contract	A BAA that carries the flow-down. A copy of the subcontractor agreements is your choice, not your duty	164.308(b)(1), (b)(2)
A business associate has a breach	It must notify you without unreasonable delay and no later than 60 calendar days after discovery	A shorter contract window if you can get one, because your own 60 day clock can start earlier	164.410(b), 164.404(a)(2)
A business associate or its workforce violates the rule	You are liable for a civil money penalty for an agent's act within the scope of the agency, judged under the federal common law of agency	Control over the business associate's work is what makes it your agent, so the way you write the contract matters	45 CFR 160.402(c)(1)
Annual written verification of vendor safeguards	Proposed in the January 6, 2025 notice, not final. It is not in the rule text OCR enforces	Nothing today. Plan against current text and keep the evidence you would need if it is finalized	90 FR 898 (proposed)

Reflects 45 CFR 164.308, 164.314, 164.404, 164.410, 164.504 and 160.402 as published at ecfr.gov, and the HIPAA Security Rule proposal published January 6, 2025 as of this writing, with no final rule. Regulatory status changes, so confirm the current text before you plan a program around it. Scrutineer prepares your evidence and is readiness software, not legal advice and not an attestation that you comply.

Good questions

Questions about BA risk management

A business associate is a person or company, other than your own workforce, that creates, receives, maintains or transmits protected health information for you, or provides a listed service such as legal, accounting, billing or data aggregation that involves it. Cloud hosts, billing companies, EHR vendors, transcription services and managed IT providers usually qualify. A vendor that never touches PHI does not.

Only with vendors that are business associates. The Security Rule requires satisfactory assurances, documented in a written contract, before a business associate handles ePHI. Signing a BAA with a vendor that never sees PHI is harmless but adds tracking work, so the first job is knowing which vendors actually touch patient data.

Not by that name. The Security Rule requires a risk analysis of ePHI wherever it sits, which reaches the vendors that hold it, and a contract with each business associate. The words questionnaire and due diligence do not appear in 164.308 or 164.314. How deep you assess each vendor is your decision, and the defensible version is one you can show was tiered by risk.

Keep an inventory of vendors that touch ePHI, a signed BAA for each, a tier based on volume and exposure, and a review proportionate to the tier. Collect a current SOC 2, HITRUST or ISO 27001 report from the high tier, track renewals, and record what you did when a vendor shows a problem. The record is the deliverable.

No. The current Security Rule sets no review frequency for business associates. An annual written verification from each business associate was proposed in the January 2025 notice, which is not final. Many hospital customers expect an annual review anyway, so an annual cycle is common practice, not a legal requirement.

It can be. Under 45 CFR 160.402(c)(1) a covered entity is liable for a civil money penalty for violations by an agent acting within the scope of the agency, including a business associate, under the federal common law of agency. Whether a vendor is your agent depends on how much you control its work. The business associate also answers for its own violations.

Without unreasonable delay and no later than 60 calendar days after discovery, under 164.410(b). That is an outer limit. Your own 60 day notification clock under 164.404 can begin when your agent knew, so a contract that requires notice in days, not weeks, protects your deadline. Check state breach laws too, since some are shorter.

No. The regulation says a covered entity is not required to obtain satisfactory assurances from a business associate that is a subcontractor. The business associate must obtain them itself, under 164.308(b)(2). Most programs still ask for a list of subcontractors that touch ePHI and a flow-down confirmation.

No. A SOC 2 report describes a vendor's controls and a BAA is the contract the Security Rule requires. The report is useful evidence for your review of a business associate, and the BAA is still needed before ePHI moves. A SOC 2 report also does not test HIPAA as a framework unless the scope includes the relevant criteria.

Look for a vendor record that holds the BAA and its renewal date, a way to tier vendors by ePHI exposure, questionnaire and report collection, and an exportable history of what you reviewed and when. General third party risk platforms handle the last three well and often do not model the BAA. Scrutineer keeps all four next to your HIPAA control mapping.

No. HIPAA has no certification, and no software can make an organization compliant. Scrutineer maps your controls to the Security Rule, tracks business associate agreements and vendor evidence, and keeps the documentation current. Compliance depends on the safeguards you actually operate, and on the risk analysis and risk management you document.

Read every compliance and risk question

Keep reading

Read before you tier your business associates

Best HIPAA risk assessment software

The risk analysis your vendor inventory feeds, and the tools that cover it.

Read the guide

Best third party risk management software

When a general TPRM platform is the better fit for a large vendor list.

Read the guide

HIPAA compliance checklist

Where business associate contracts sit among the Security Rule safeguards.

Read the guide

Explore more

More ways to scrutinize compliance and risk with Scrutineer

SOC 2 compliance

Map controls to the Trust Services Criteria, collect evidence, and close gaps before audit.

Learn more

SOC 2 compliance software

A platform that maps SOC 2 controls, automates evidence, and tracks readiness continuously.

Learn more

ISO 27001 compliance

Map your ISMS to Annex A, automate evidence, and stay certification-ready.

Learn more

See every use case See pricing Back to Scrutineer

Stop guessing about readiness. Scrutinize on real evidence.

Point Scrutineer at a framework or a vendor and it maps every control, gathers evidence and scores the risk, returning an evidence-linked report and a prioritized gap list. The AI scrutinizes, you decide.

See pricing

SOC 2, ISO 27001, HIPAA, GDPR & PCI · evidence-linked controls · readiness, not certification