Healthcare Outsourcing Vendors: A HIPAA and SOC 2 Due Diligence Checklist

When a vendor handles patient data for you, HIPAA requires a signed business associate agreement and real Security Rule safeguards. A SOC 2 report is something else: a voluntary, independent audit of the vendor’s controls. It is good evidence, but HIPAA does not require it and it does not prove compliance on its own. When you vet healthcare outsourcing vendors, check both the contract and the controls, and make sure they cover the people doing your work.

This guide is written for practices, telehealth companies, long-term care operators and health systems choosing a healthcare BPO for billing, scheduling, patient support or prior authorization work. It is general information, not legal advice; your compliance officer or counsel should confirm what applies to you.

What HIPAA requires when you outsource

A company that creates, receives, maintains or transmits protected health information (PHI) on your behalf is a business associate. Before it gets access, HIPAA requires:

• A written business associate agreement (BAA). You must obtain “satisfactory assurance” that the vendor will safeguard the information, documented in a contract (45 CFR 164.502(e)). Our glossary explains what a BAA covers.
• Security Rule safeguards at the vendor. Business associates must meet the Security Rule themselves, including a documented risk analysis and administrative, physical and technical safeguards.
• The same promises down the chain. If your vendor uses a subcontractor, such as an offshore staffing partner, it must obtain the same assurances from that subcontractor. You do not sign with the subcontractor directly, but you should know it exists.
• Minimum necessary access. The vendor should see only the PHI the task needs.
• Breach notice. A business associate must tell you about a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovering it (45 CFR 164.410). Many covered entities negotiate a shorter window in the BAA.

What HIPAA does not give you

• No official certification. HHS has stated that it does not endorse or recognise private “HIPAA certifications”, and that such certifications do not relieve organisations of their obligations (HHS FAQ).
• No guarantee from paperwork. A signed BAA is a promise. It does not show that the controls exist.
• No ban on offshore work. HIPAA applies the same way wherever the work happens, but your payer contracts, government programme agreements or state rules may restrict offshore access to certain data. Check them before you choose a vendor location.

Our longer guide to HIPAA for remote and outsourced teams covers the day-to-day safeguards in more detail.

What a SOC 2 report is, and is not

A SOC 2 report is an attestation issued by an independent CPA firm under AICPA standards. It assesses a service organisation’s controls against the Trust Services Criteria: security, which is always included, plus any of availability, processing integrity, confidentiality and privacy that the vendor chooses to include.

• Type 1 describes the controls and whether they were suitably designed at a single point in time.
• Type 2 also tests whether the controls operated effectively over a period, often six to twelve months. For vendor selection, a Type 2 report tells you much more.

Three things to keep in mind:

1. “SOC 2 compliant” is not a formal status. A vendor either has a current report from an auditor or it does not. Ask for the report itself, usually under a non-disclosure agreement.
2. It is not a HIPAA requirement. Many capable vendors, especially smaller ones, do not have one. Others hold an ISO/IEC 27001 certification or a HITRUST assessment instead.
3. Scope is everything. A report that covers a vendor’s software platform may say nothing about the office and people who would handle your claims or calls.

How to read a vendor’s SOC 2 report

Check	Why it matters
Report type and period	Type 2 shows controls working over time; a period that ended long ago may need a bridge letter covering the gap
Scope: services, locations, systems	Confirm it covers the team, site and systems that will do your work
Criteria included	Security only, or also confidentiality and privacy
Exceptions	The auditor lists controls that failed testing; ask what was fixed
Complementary user entity controls	Controls you are expected to run, such as reviewing the access you grant
Subservice organisations	Providers carved out of the report, whose controls you must check separately

A due diligence checklist for healthcare outsourcing vendors

Use the same list for every vendor you shortlist, and ask for evidence for each answer.

Contract and governance

• Will you sign our BAA, or show us yours, before any access is granted?
• What breach notice period will you commit to, and who will contact us?
• Which subcontractors will touch our data, and do they have flow-down agreements?
• Can we request evidence of controls, or audit, during the contract?
• How will our data be returned or destroyed when the contract ends?

People

• What background checks are carried out, within local law?
• How often is HIPAA and security training given, and can we see records?
• Does everyone sign a confidentiality agreement?
• Who supervises the team, and how are mistakes caught?

Access and devices

• Will the team work inside our systems with individual, named logins and multi-factor authentication?
• How is access limited to the minimum necessary, and how fast is it removed when someone leaves?
• Are devices company-managed and encrypted, with local downloads, USB storage and personal email blocked?
• When did you last complete a documented security risk analysis?

Evidence and incidents

• Do you have a SOC 2 report, ISO/IEC 27001 certificate or HITRUST assessment, and what is its scope?
• If not, will you complete our security questionnaire and show the evidence behind each answer?
• Can you walk us through your incident response plan and your last test of it?

Fit for your setting

Different buyers have different extra demands. Health systems often require a full security questionnaire and evidence of cyber insurance. Telehealth companies may need the vendor to work inside a specific platform. Long-term care and senior living operators often need cover outside office hours. Ask how the vendor has handled your setting before, and talk to a reference client in it.

Red flags

• A “HIPAA certified” badge offered as the main evidence.
• Reluctance to sign a BAA, or a BAA with no breach notice timeframe.
• Vague answers about where the work is done or who the subcontractors are.
• Shared or generic logins.
• A SOC 2 report whose scope does not include the people or location doing your work.
• Requests to send PHI by spreadsheet or email before secure access is set up.

For the commercial side of the same decision, see our seven questions for medical billing partners and the general BPO selection checklist.

Where Teamliva stands

Teamliva is a healthcare BPO and offshore staffing provider based in Bangladesh. Before work starts we sign BAAs and confidentiality agreements. Team members work under HIPAA-aligned procedures on encrypted, access-controlled workstations, with role-based access limited to what the task needs, inside your own systems.

Teamliva does not currently hold a SOC 2 report. If your procurement process requires one, tell us at the start. We will complete your security questionnaire and show the evidence behind each answer, so you can decide whether it meets your requirements. To see how our teams handle billing, scheduling and patient support, visit healthcare outsourcing services or medical billing and RCM.