Two SQL injection attacks in one country. Nearly 24 million patient records exposed. The same threat actor claiming credit for both breaches. If your organization runs on third-party medical software, these incidents in Poland aren't distant warnings, they're a preview of what happens when vendor security controls fail.
This checklist helps you assess whether your healthcare software vendors meet the security standards required under the HIPAA Security Rule and your Business Associate Agreement. Use it before signing a new contract and annually for existing vendors.
What This Checklist Covers
You're evaluating technical, administrative, and physical safeguards that Business Associates must implement under 45 CFR §164.308-316. The focus: application security, data encryption, incident response capability, and regulatory compliance posture. This isn't a penetration test; it's a compliance officer's due diligence framework to identify red flags before a breach notice lands in your inbox.
Prerequisites
Before you start:
- You have a current Business Associate Agreement that specifies security obligations and audit rights (45 CFR §164.504(e)).
- You've identified all systems that store, process, or transmit ePHI through this vendor's software.
- You have executive support to terminate the relationship if the vendor fails critical controls and won't remediate.
Without these three elements, this audit becomes a paperwork exercise with no enforcement mechanism.
Security Audit Checklist
1. Application Security Testing
Action: Request documentation of the vendor's most recent application security assessment, including the date, scope, and findings.
What good looks like: The vendor conducts annual penetration testing and quarterly vulnerability scans by a qualified third party. You receive a summary report showing vulnerability categories, severity ratings, and remediation timelines. SQL injection vulnerabilities, the attack vector in the Medyc breach, should appear on the "tested and mitigated" list, not the "open findings" column.
2. Secure Development Lifecycle
Action: Ask how the vendor integrates security into software development. Request their secure coding standards and code review process.
What good looks like: The vendor follows OWASP Top 10 guidelines. Developers receive annual secure coding training. All code changes undergo peer review with a security checklist. Static and dynamic analysis tools run automatically in the build pipeline. The vendor can show you the policy document and training completion records.
3. Data Encryption Standards
Action: Verify encryption methods for data at rest and in transit. Request the specific algorithms and key management procedures.
What good looks like: ePHI is encrypted at rest using AES-256. Data in transit uses TLS 1.2 or higher. The vendor maintains encryption keys in a hardware security module or certified key management service, separate from application servers. You receive a technical specification document, not marketing language about "bank-level encryption." The Medyc incident exposed encrypted data that investigators determined was "easy to decrypt", a failure of key management, not just encryption selection.
4. Access Controls and Authentication
Action: Review how the vendor controls access to ePHI within their systems and how your users authenticate to the application.
What good looks like: The vendor enforces multi-factor authentication for administrative access. Role-based access controls limit ePHI visibility to authorized functions. Session timeouts and automatic logoffs are configurable. The vendor logs all access to ePHI with user ID, timestamp, and action taken. These logs are tamper-evident and retained for six years per 45 CFR §164.312(b).
5. Incident Response Plan
Action: Request the vendor's incident response policy and ask about their detection capabilities.
What good looks like: The vendor has a written incident response plan that includes notification timelines matching your BAA (typically 24-72 hours). They maintain security information and event management (SIEM) tools that alert on suspicious activity. The plan specifies who investigates, how they preserve forensic evidence, and when they engage law enforcement. Qbusoft detected its breach on Sept. 8-9 but the SQL injection occurred Aug. 22-23, a 17-day gap. Your vendor should explain their detection window and why it's acceptable.
6. Third-Party Risk Management
Action: Identify all subcontractors the vendor uses who might access ePHI. Confirm Business Associate Agreements are in place.
What good looks like: The vendor maintains a current inventory of subcontractors with access to ePHI. Each subcontractor has signed a BAA with security obligations that flow down from your agreement. The vendor audits subcontractor compliance annually. You receive the subcontractor list and can request evidence of their BAA and audit results.
7. Patch Management Process
Action: Ask how quickly the vendor applies security patches to infrastructure and application components.
What good looks like: Critical patches deploy within 30 days of release. The vendor subscribes to security advisories for all technology components. They maintain a documented patching schedule and can show you recent patch deployment records. Emergency patches for actively exploited vulnerabilities deploy within 72 hours.
8. Backup and Recovery Procedures
Action: Review the vendor's data backup frequency, retention, and tested recovery time objectives.
What good looks like: ePHI backups occur daily. Backup media is encrypted and stored in a geographically separate location. The vendor tests restoration quarterly and documents recovery time. You receive annual test results showing successful restoration within the agreed RTO in your service level agreement.
9. Security Awareness Training
Action: Confirm that vendor employees with ePHI access receive HIPAA security training.
What good looks like: All employees complete HIPAA Security Rule training within 30 days of hire and annually thereafter. Training covers phishing recognition, password security, social engineering, and incident reporting. The vendor tracks completion rates and can provide aggregate statistics.
10. Regulatory Compliance Documentation
Action: Request evidence of the vendor's own HIPAA compliance program.
What good looks like: The vendor has completed a HIPAA Security Rule risk analysis within the past 12 months. They maintain written policies and procedures addressing all Required and Addressable Specifications under 45 CFR §164.308-316. Ideally, they hold HITRUST CSF certification, which provides independent validation of control implementation. At minimum, they can produce their risk analysis executive summary and policy index.
Common Mistakes
Accepting vendor self-attestation without evidence. A signed questionnaire that says "Yes, we encrypt data" doesn't tell you whether they're using strong algorithms or managing keys properly. Request technical specifications.
Ignoring subcontractor chains. Your vendor's cloud hosting provider, payment processor, and analytics platform all need BAAs if they touch ePHI. The Medyc breach affected a treatment center's patients, but the vulnerability sat in Qbusoft's code, a supply chain failure.
Skipping the incident response drill. Ask your vendor: "If you detect a breach at 2 a.m. Saturday, who gets the call and how quickly do I hear about it?" If they can't answer, their incident response plan is theoretical.
Assuming certification equals security. HITRUST CSF certification is valuable, but it's point-in-time. Ask when they were assessed, what scope was included, and whether your implementation matches the certified configuration.
Next Steps
Score each checklist item as Pass, Fail, or Needs Remediation. Any Fail on items 1, 3, 4, or 6 is disqualifying, these are Required Specifications under the Security Rule, and your vendor's failure creates direct liability for your organization.
For Needs Remediation findings, document the gap, request a remediation plan with specific milestones, and set a re-audit date. If the vendor won't commit to a timeline or provide evidence of progress, start evaluating alternatives.
Your Business Associate Agreement gives you audit rights. Use them. The Office for Civil Rights expects covered entities to obtain satisfactory assurances that Business Associates will safeguard ePHI. A checklist completed once and filed away isn't satisfactory assurance, it's evidence you asked questions but didn't verify answers.
Poland's cybersecurity incident response team issued security recommendations to healthcare software providers on Sept. 16. Two weeks later, investigators were still analyzing the scope of compromised medical records. Your audit today prevents your breach notice tomorrow.
