The HIPAA Checklist for Vetting an Outsourced CCM Vendor

Compliance officers evaluating a Chronic Care Management vendor get exactly the same pitch from everyone: “We’re HIPAA compliant.” The phrase is marketing, not a checklist. Here are the twelve concrete questions that separate real posture from boilerplate, plus the red flags that mean walk away.

Before you share any patient information

1. BAA, before or after?

Ask: “When do you sign the Business Associate Agreement?” Correct answer: before any PHI changes hands, as a prerequisite to onboarding. Red flag: “We’ll sign one once we’re under contract.” HIPAA requires a signed BAA before the vendor touches PHI, not after.

2. BAA sourced from where?

Ask: “What’s your BAA based on?” Correct answer: HHS sample provisions or similar industry-standard template, redlineable by your legal team. Red flag: a vendor-authored BAA with unusual carve-outs, indemnity language skewed heavily in their favor, or no willingness to negotiate terms.

3. Minimum Necessary

Ask: “How do you apply the Minimum Necessary rule?” Correct answer: specific role-based access, no bulk exports, no patient data moved to vendor-owned platforms. Red flag: “We pull the whole patient list into our platform monthly.” That’s not Minimum Necessary, that’s a PHI export.

How they handle data in motion

4. Where does the work happen?

Ask: “What system do your staff work in?” Correct answer: inside your EHR or your CCM platform under delegated access. Red flag: “We export patient data to our internal CRM.” Every data movement is a surface area; a vendor working inside your system has none.

5. Communication channels

Ask: “How do your staff communicate with patients and with us?” Correct answer: HIPAA-eligible channels only (patient portal, encrypted email under BAA, documented phone calls inside the EHR). Red flag: regular SMS to patients, personal Gmail accounts, chat tools without HIPAA coverage.

6. Email tooling

Ask: “What email platform do your staff use, and do you have a signed BAA with that provider?” Correct answer: Google Workspace or Microsoft 365, each on a healthcare-eligible plan with the vendor’s own BAA signed with the email provider. Red flag: free Gmail, non-business email, or inability to produce the sub-processor BAA on request.

Training and oversight

7. Workforce HIPAA training

Ask: “How is your workforce trained on HIPAA?” Correct answer: named training program, documented completion, annual refresh, sanctions for violations. Red flag: “It’s part of onboarding” without specifics.

8. Named contacts

Ask: “Who is my privacy contact and who is my security contact at your organization?” Correct answer: two named humans with email addresses, same for every client. Red flag: “Just email support.” A compliance structure without named owners is a structure that falls apart under audit.

Breach handling

9. Breach notification SLA

Ask: “If there’s a breach, how fast do you tell us?” Correct answer: without unreasonable delay and in no case later than the HIPAA-required timeframe (60 days from discovery to the covered entity under 45 CFR 164). Red flag: vague answer, or a longer SLA than the regulation allows.

10. Audit log access

Ask: “Can we see your access logs on our patients’ records?” Correct answer: yes, on request, or via the EHR’s native audit log (since the vendor works inside your system). Red flag: “Our platform generates its own logs, we can send excerpts.” Excerpts aren’t audit evidence.

Business continuity

11. End-of-engagement

Ask: “What happens to our patient data at the end of the engagement?” Correct answer: no vendor-held PHI to return or destroy, the data stayed in your EHR the whole time. Access is revoked. Red flag: a long “return of PHI” process. That means they had an export of your PHI.

12. Sub-processors

Ask: “Who are your sub-processors, any vendors with potential access to PHI?” Correct answer: a short named list (email provider, EHR vendor if applicable), each with a BAA on file. Red flag: “We don’t have sub-processors” (very unlikely for any modern vendor) or inability to produce the list.

The one meta-check that matters most

If the vendor can’t answer any of these twelve questions quickly and specifically, that’s your answer. HIPAA posture isn’t a marketing position; it’s an operational discipline with written artifacts behind it. A vendor that has done the work can produce the BAA, the sub-processor list, the training completion records, and the privacy contact within one business day. A vendor that hasn’t will stall, hedge, or send you back to a sales rep.

Zenith’s posture is laid out in detail on our HIPAA Compliance page, with the formal written version at /hipaa-statement. If you want to run through this checklist against our answers specifically, book a 15-min call and we’ll walk through each question on the call.