Subcontractor Management Procedures

Free HIPAA procedures template · v1.0 · Applies to business associates · Companion: Policy →

Free, no signup needed. Also as PDF · Markdown.

What these procedures commit you to

Adopting this document means committing to these HIPAA controls, the 45 CFR §164 requirements it helps satisfy, by area:

Vendor & BAA Management: 164.502(e)(1)(ii) · 164.308(b)(2)-(3) · 164.504(e)(2)(ii)

Related threat scenarios

Common threats (NIST SP 800-30 classes) that the controls behind this document defend against:

AdversarialThird-party / subcontractor compromise
Exploits: Missing BAA; weak vendor controls · 164.308(b) / 164.502(e) BA Contracts

HowToHIPAAhowtohipaa.com

Subcontractor Management Procedures

Template. These procedures operationalize the Subcontractor Management Policy. Replace [bracketed] items with your specifics and adjust steps to match your tools and team size.

Purpose

Repeatable, auditable steps for engaging, binding, overseeing, and off-boarding subcontractors that handle PHI on [Organization]'s behalf, so protections flow down unbroken. Implements the Subcontractor Management Policy.

1. Identify the need and run due diligence (164.308(b)(2))

Before routing any PHI to a new subcontractor, the [requesting owner] documents what PHI it will handle and why.
Run risk-appropriate diligence: security questionnaire, [SOC 2]/pen-test summary, and a check that the subcontractor can meet the flow-down terms in §2.

2. Execute the subcontractor BAA before access (164.502(e)(1)(ii), 164.504(e)(2)(ii))

Execute a BAA whose terms are at least as protective as [Organization]'s own: permitted uses, Security Rule safeguards, its own subcontractor flow-down, incident/breach reporting to , individual-rights assistance, and return/destruction at termination.

See where your organization stands on the controls this template cites.

Join Us

Related Vendor & BAA Management templates

Breach Reporting to Covered Entity Policypolicy
Business Associate Agreement (BAA)reference
Business Associate HIPAA Obligations Policypolicy
Business Associate HIPAA Obligations Proceduresprocedures

More Vendor & BAA Management templates →Read the Vendor & BAA Management guide →

Subcontractor Management Procedures

What these procedures commit you to

Related threat scenarios

Subcontractor Management Procedures

Purpose

1. Identify the need and run due diligence (164.308(b)(2))

2. Execute the subcontractor BAA before access (164.502(e)(1)(ii), 164.504(e)(2)(ii))

Related Vendor & BAA Management templates

3. Record in the subcontractor register (164.308(b)(2))

4. Oversee on a schedule (164.308(b)(2))

5. Off-board and confirm return/destruction (164.504(e)(2)(ii))