Healthcare organizations often repeat the same third-party risk management mistakes, even as regulators demand more robust vendor oversight. These aren't mere oversights; they're structural issues rooted in how healthcare operations evolved, compliance programs were built, and vendor relationships are managed across organizational silos.
Understanding why these mistakes persist is more important than just identifying them. The pattern reveals a gap between how organizations think vendor risk works and how it actually unfolds when a business associate faces a ransomware attack or a billing vendor suffers a breach affecting millions of patient records.
Why These Mistakes Persist
Healthcare vendor oversight traditionally focused on annual assessments and contractual checkboxes, as early HIPAA guidance emphasized. Organizations built programs to satisfy business associate agreement requirements without addressing the operational reality: vendors change, risks shift, and incidents don't wait for renewal cycles.
The regulatory environment now demands continuous oversight backed by documented evidence. The HIPAA Security Rule NPRM requires written verification that business associates have implemented required security safeguards. The Health Care Cybersecurity and Resiliency Act proposes expanded Safe Harbor protections for organizations demonstrating recognized cybersecurity practices for at least 12 months. CMS is linking cybersecurity expectations to Conditions of Participation.
These changes share a common thread: regulators expect continuous oversight. Yet many healthcare organizations still operate vendor risk programs designed for a different era.
Mistake 1: Treating Vendor Assessment as an Annual Event
Healthcare teams often schedule vendor security assessments once a year, collect questionnaire responses, file the results, and move on. This assumes vendor risk remains static between reviews.
It doesn't. Vendors can experience breaches, change ownership, modify infrastructure, add subprocessors, or face financial distress throughout the year. A revenue cycle management vendor that passed assessment in January could be compromised in March, leaving the healthcare organization unaware until the next scheduled review.
The recent attack on Unlimited Technology Systems affected approximately 3.8 million patients across thousands of healthcare providers. Most of those providers likely had no advance warning of their vendor's deteriorating security posture or an ongoing incident.
The fix: Implement ongoing vendor monitoring to identify risk signals between formal assessments. Monitor for security incidents, financial changes, compliance lapses, and fourth-party dependencies. When you identify a material change in vendor risk, trigger an out-of-cycle review instead of waiting for the annual schedule.
Mistake 2: Separating Vendor Risk from Patient Safety
Compliance teams manage vendor assessments, IT handles security reviews, procurement negotiates contracts, and clinical operations use vendor services. Each group operates independently, treating vendor oversight as an administrative function rather than a patient safety concern.
This separation breaks down during incidents. Research shows that among healthcare organizations whose patient care was disrupted by a cyberattack, nearly one-third reported increases in patient mortality rates. Attacks affecting Change Healthcare, Conduent, Ascension, and PIH Health demonstrated how vendor incidents disrupt claims processing, pharmacy operations, clinical workflows, and care delivery.
The fix: Establish cross-functional governance that connects compliance, enterprise risk, business continuity, resilience, and clinical teams in vendor oversight decisions. Create a shared vendor risk profile that captures cybersecurity findings alongside financial health, operational dependencies, patient safety implications, and care delivery impact. Include clinical representatives when assessing critical vendors to understand how a disruption would affect patient care.
Mistake 3: Relying on Contracts Without Verification
Business associate agreements establish security obligations, but they don't prove those obligations are met. Many healthcare organizations treat a signed BAA as sufficient evidence of vendor safeguards.
The HIPAA Security Rule NPRM now requires covered entities to verify in writing that business associates have implemented required security safeguards. This shifts vendor oversight from contractual commitment to demonstrated compliance.
Organizations that can't produce verification evidence face a problem: you've documented what the vendor promised but not what they actually implemented. During an OCR investigation following a breach, that gap becomes material.
The fix: Create a verification process that documents how you confirmed vendor safeguards. Request evidence of multifactor authentication implementation, encryption deployment, access controls, incident response capabilities, and backup procedures. Maintain records showing when verification occurred, what evidence you reviewed, and how you addressed any gaps. Update verification annually at minimum, and more frequently for critical vendors.
Mistake 4: Treating All Vendors Equally
Healthcare organizations often apply the same assessment process to every vendor regardless of risk level. A vendor hosting protected health information for 500,000 patients receives the same questionnaire as a vendor providing office supplies.
This approach wastes resources on low-risk relationships while under-investing in critical vendors. It also creates a false sense of coverage: you've assessed every vendor, but you haven't necessarily understood the risks that matter most.
The fix: Tier vendors based on their impact on patient care, operational continuity, data sensitivity, regulatory obligations, and concentration risk. Apply deeper scrutiny to critical vendors. For a Tier 1 vendor supporting clinical operations, conduct on-site assessments, review security architectures, test incident response coordination, and evaluate business continuity plans. For lower-tier vendors, a streamlined questionnaire may suffice. Document your tiering methodology and review vendor classifications when relationships or risks change.
Mistake 5: Storing Evidence in Disconnected Systems
Vendor documentation scatters across email, shared drives, procurement systems, and compliance platforms. When you need to demonstrate 12 months of documented cybersecurity practices for Safe Harbor protections, respond to an OCR investigation, or brief executives on vendor incidents, you're searching multiple repositories for incomplete records.
This fragmentation also prevents you from connecting risk signals. Financial distress indicators sit in procurement. Security findings live in IT. Incident reports exist in separate systems. No one can see the complete vendor risk profile.
The fix: Maintain a centralized vendor risk register that consolidates assessment results, verification records, incident history, remediation tracking, contract details, and risk ratings. Structure the register so you can produce evidence showing how vendor risks were identified, evaluated, and managed over time. When regulators ask how you verified a business associate's safeguards or how you responded to a vendor incident, you should be able to pull a complete record without searching across disconnected systems.
Prevention Checklist
Use this checklist to evaluate whether your vendor oversight program addresses the structural issues behind these common mistakes:
- You monitor critical vendors continuously, not just during annual assessments
- Clinical teams participate in vendor risk decisions for relationships that could affect patient care
- You maintain documented evidence showing how you verified vendor safeguards
- You've tiered vendors based on risk and apply scrutiny proportional to potential impact
- Vendor risk documentation lives in a centralized system accessible during investigations or audits
- You can produce 12 months of cybersecurity practice records for critical vendors
- Your vendor risk program connects to business continuity and operational resilience planning
- You track fourth-party dependencies and subprocessor relationships
- You've defined triggers for out-of-cycle vendor reviews when risk signals change
- Executive leadership receives regular updates on critical vendor risks and incidents
These practices won't eliminate vendor risk. They will, however, create the visibility, documentation, and governance structure that regulators increasingly expect and that patient safety increasingly demands.
