Healthcare vendor security questionnaire: what hospitals and clinics ask (HIPAA, BAA, PHI)

A hospital, clinic or health plan wants to buy from you, and its security team sends a spreadsheet. If your product touches patient information, the questions go further than a standard SaaS review: they ask about HIPAA, a Business Associate Agreement (BAA), and how you protect PHI, short for protected health information.

This guide explains what those questions mean, what the buyer is checking, and how to word honest answers. The example answers are for a fictional vendor and are labelled as such. Replace them with facts from your own documents. This is practical guidance, not legal advice: ask a healthcare privacy lawyer before you sign a BAA.

Why healthcare buyers ask more

Hospitals and clinics are usually 'covered entities' under HIPAA. A vendor that creates, receives, maintains or transmits PHI for them is a 'business associate'. The U.S. Department of Health and Human Services (HHS) explains the term on its [business associates page](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html). Business associates are directly responsible for parts of the rules, and the covered entity must have a written agreement with them.

That is why the questionnaire exists. The buyer has to show it chose a vendor that can protect PHI, and the BAA and your answers are part of that record.

The questions you will see

Most healthcare questionnaires, whether a custom spreadsheet or a framework such as HECVAT for higher education, group their questions like this:

• Scope: does your service store, process or transmit PHI? Which data elements? Which of your systems and sub-vendors touch it?
• HIPAA status: do you act as a business associate? Will you sign our BAA?
• Safeguards: administrative, physical and technical controls, which is how the HIPAA [Security Rule](https://www.hhs.gov/hipaa/for-professionals/security/index.html) is organized.
• Risk analysis: do you run a documented security risk analysis, and how often?
• Access: unique user IDs, role-based access, minimum necessary access, audit logs of who viewed PHI.
• Encryption: PHI in transit and at rest.
• Subcontractors: who else handles PHI, and do you have BAAs with them?
• Incidents: how do you detect, investigate and report a breach, and how fast?
• Return and deletion: what happens to PHI when the contract ends?
• Workforce: training, background checks, sanctions policy.
• Location: where is PHI stored, and does any of it leave the United States?

HIPAA, BAA and PHI in plain words

• PHI: individually identifiable health information held or sent by a covered entity or business associate. If you only see de-identified or aggregate data, say so precisely and say how you know.
• BAA: the contract that limits how you may use and disclose PHI, requires safeguards, and sets out breach reporting and subcontractor duties. HHS publishes [sample business associate agreement provisions](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html) that show what such contracts usually cover.
• Security Rule: HHS describes it as national standards to protect electronic PHI, requiring administrative, physical and technical safeguards.
• Breach notification: under the [Breach Notification Rule](https://www.hhs.gov/hipaa/for-professionals/breach-notification/index.html), a business associate must tell the covered entity after discovering a breach, without unreasonable delay and no later than 60 days. Many BAAs require much faster notice, so your answer should match the number you can actually meet.

Two traps here. First, there is no official 'HIPAA certified' badge from HHS. If a form asks 'Are you HIPAA certified?', answer what is true: for example, 'We are not certified, because HHS does not certify vendors. We follow the Security Rule safeguards and will sign your BAA.' Second, cloud hosting does not remove your duties. HHS's [cloud computing guidance](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html) says a cloud provider that stores ePHI for a covered entity or business associate is itself a business associate, even if the data is encrypted and the provider holds no key. So your hosting provider, and the BAA you hold with it, matter.

Example answers (fictional vendor)

These examples are for a made-up company, 'Harbor Notes', a scheduling tool for clinics. They are not Rendro's answers. Use them only for the shape of a good answer.

Question: Does your service create, receive, maintain or transmit PHI? Example answer: Yes. Harbor Notes stores patient names, appointment times and visit reasons for our clinic customers. It does not store clinical notes or payment card numbers. We act as a business associate and will sign the customer's BAA or our standard BAA.

Question: Do you perform a documented security risk analysis? How often? Example answer: Yes. We complete a written risk analysis each year and after major changes to the system. The latest is dated [date] and is owned by [role]. Findings are tracked to closure in our risk register. [Attach or offer a summary under NDA.]

Question: Is PHI encrypted in transit and at rest? Example answer: Yes. PHI is encrypted in transit with TLS and at rest using the database and storage encryption of our cloud provider. [Add key management detail only if your documents state it.]

Question: Do you use subcontractors that may access PHI? Do you have BAAs with them? Example answer: Yes. [Hosting provider] stores PHI and [email provider] sends appointment reminders that contain first names. We hold a signed BAA with each. Our subprocessor list is at [link] and we notify customers of changes [30] days in advance.

Question: How quickly will you notify us of a breach involving our PHI? Example answer: We will notify the customer's designated contact without unreasonable delay and within [number] days of discovering the breach, as set out in the BAA. We will share what we know, the data affected and our containment steps, and update as the investigation continues.

Question: What happens to our PHI when the contract ends? Example answer: On termination we return or delete the customer's PHI within [number] days and confirm in writing. Where deletion is not feasible, for example backups that expire on a schedule, we continue to protect it and limit further use, as the BAA requires.

The honest-gap answers

Healthcare reviewers read hedged answers closely. If a control is not in place, say so and say what is. Do not answer 'Yes' to a HIPAA question to move the deal along: a BAA makes the answer a promise.

• No SOC 2 or HITRUST yet: 'We do not hold a SOC 2 report or HITRUST certification. Our controls are documented in [policies], and we complete a HIPAA-aligned risk analysis each year. We can share them under NDA.' See the SOC 2 question.
• No penetration test yet: say so and when one is planned. See the penetration test question.
• You never touch PHI: 'Our service does not receive PHI. Customers are instructed not to enter it, and our terms prohibit it.' Only say this if your product really prevents or blocks it.

Checklist before you send it back

• Decide and write down whether you are a business associate, and tell the buyer the same thing everywhere.
• Have a BAA ready, plus signed BAAs with every sub-vendor that touches PHI.
• Date your latest risk analysis and name its owner.
• Make the breach notice number in your answers match the BAA you will sign.
• List where PHI is stored and which systems and people can reach it.
• Check that your answers agree with your security page, privacy policy and contract.
• Have someone senior approve answers that make a legal promise.

Also keep one answer per topic and reuse it. Healthcare buyers often send a second, longer form after the first, and a reusable answer library keeps both consistent.

Where Rendro helps

Rendro drafts answers to a healthcare questionnaire only from your own documents (policies, past questionnaires, your company profile), shows the source for each answer, and marks anything it cannot support as Needs review. It does not decide whether you are a business associate and it does not write your BAA. The buyer's own Excel or Word file comes back filled in. Rendro does not work inside web portals.

Got a hospital or clinic questionnaire waiting? Send us the blank file and we will fill in the first 25 questions free within 48 hours, so you can judge the quality before you pay. Get the free 25-answer sample. Prefer to talk it through first? [Book a 15-minute video call](https://cal.com/franklin-rendro.net/15min) with Franklin. Send only the blank questionnaire, never PHI or confidential documents. For other forms, see due-diligence questionnaires.