Over the past year, several vendors I've contracted with have claimed hipaa compliance. I have asked them for documentation of their compliance and I've never seen any. I would expect an audit signed off on by a third party, or a checklist showing the status of security controls. I know there isn't a merit badge to sew into your lapel or anything, but I have to document that the vendors are what they say they are. Is there anything specific I can ask them for?
1
-
1Are you buying goods or services? If the former, it's up to you to use the stuff you buy in a compliant manner. If the latter, you bind the vendor to compliance in your business partner agreement.– Bob BrownDec 16, 2014 at 0:47
Add a comment
|
1 Answer
I would ask for exactly what you've suggested you expect to see. An audit report would be ideal, a compliance policy listing the controls that are in place would be minimally sufficient.
If it's something that you consider to be significantly important to your business, then make it a requirement for them to provide this documentation before you can sign a contract with them.
Additionally, regardless of what the documentation is, I'd want to actually talk to somebody responsible for overseeing and maintaining compliance. Get them to walk through the documentation they've provided, and answer any questions that you have, and you'll end up with a much better understanding of exactly how much they care about compliance, how much effort they put into it, and how well equipped they are to define, implement and maintain strong controls. A document can say anything. The words of the people responsible, however, are where the real story will be told.
