Guide · Healthcare · Vendor Security

What Belongs in a Healthcare Vendor Security Exhibit?

The business associate agreement says the vendor will safeguard your data. The security exhibit says how. When those two documents disagree, or when the exhibit is missing, you have a contract that promises protection and specifies none.

By Lincoln Square Law · 9-minute read

Healthcare organizations sign a business associate agreement with nearly every vendor that touches protected health information, and they treat it as the document that handles data security. It does not, quite. A BAA obligates a vendor to comply with the applicable safeguards and to protect the information, but it usually speaks in the general language of the regulation. The place where security becomes concrete, where “reasonable and appropriate safeguards” turns into specific controls you can hold a vendor to, is the security exhibit, sometimes called a security schedule or an information-security addendum. Many contracts either omit it or attach the vendor’s boilerplate. Knowing what belongs in it is how you close the gap between a promise and a practice.

Why the BAA is not enough on its own

A business associate agreement establishes the legal relationship and the vendor’s baseline duties, but it is deliberately framework-level. It says the vendor must implement appropriate safeguards. It does not say the vendor must encrypt data at rest and in transit, enforce multi-factor authentication, patch on a defined schedule, or notify you within a specific number of hours of a suspected incident. Those specifics live in the security exhibit. Without one, “appropriate safeguards” means whatever the vendor decides is appropriate, and you discover their interpretation only after something goes wrong. The exhibit is where you convert a standard into a set of commitments you can audit.

Administrative safeguards: who is accountable and how they run the program

A strong exhibit starts with the human and organizational controls. Expect the vendor to designate a security officer accountable for its program, to run a documented risk-management process, to train its workforce on data handling, and to enforce access management so that employees can reach protected health information only when their role requires it. Workforce controls matter more than they appear to: a large share of incidents trace not to exotic attacks but to over-broad access and unmanaged accounts. The exhibit should also address what happens when the vendor’s own people leave. Prompt de-provisioning of access is a control that is easy to promise and often quietly neglected.

Technical safeguards: the controls that do the work

This is the heart of the exhibit, and it should be specific enough to test. Encryption is the anchor. Protected health information encrypted to a recognized standard, both at rest and in transit, is dramatically better protected and can even change the analysis of whether an incident is a reportable breach. Beyond encryption, look for multi-factor authentication on access to systems holding your data, defined patch and vulnerability-management timelines rather than vague assurances, audit logging that records who accessed what and when, and secure development and configuration practices for any software the vendor builds or hosts. Where the vendor uses cloud infrastructure, the exhibit should make clear how your data is segregated and protected in that environment, not leave it to assumption.

The clauses that connect security to consequences

Controls are only half the exhibit. The other half is what happens when they fail or when you need to verify them. Three provisions carry the weight. Incident and breach notification is the first. The exhibit should require the vendor to notify you promptly of a suspected security incident, on a timeline tight enough to protect your own notification obligations, and to give you the information you need to assess and respond rather than a bare heads-up. Audit and assessment rights are the second: the right to review the vendor’s security posture, whether through your own assessment or by requiring the vendor to furnish an independent report such as a SOC 2 examination, so that “we take security seriously” is backed by evidence. The third is subcontractor flow-down: your vendor’s subcontractors will handle your data too, and the exhibit should require them to meet the same standards, with the vendor remaining responsible for their performance.

Data lifecycle: return, destruction, and location

Security is not only about protecting data in use. It is about controlling it across its whole life. The exhibit should address where your data may be stored and processed, how it is backed up and how those backups are protected, and, critically, what happens at the end of the relationship. A clear obligation to return or securely destroy your protected health information at termination, and to certify that it was done, keeps your data from living indefinitely on a former vendor’s systems. Data you can no longer see is data you can no longer protect, and the exhibit is where you keep that from happening.

How the exhibit and the BAA work together

Think of the two documents as a division of labor: the business associate agreement establishes the legal relationship and the regulatory floor, and the security exhibit specifies the operational controls that meet and exceed that floor. They have to be consistent. An exhibit that promises less than the BAA requires, or a BAA that references an exhibit that was never attached, creates ambiguity that favors the vendor in a dispute. Review them together, make sure the exhibit’s notification timeline is at least as protective as what your own obligations demand, and confirm that the definitions line up. The goal is a single, coherent package where the promise in the BAA is delivered by the specifics in the exhibit.

The exhibit is cheaper than the incident

Negotiating a security exhibit takes time and a little goodwill, and it is tempting to skip it to close a vendor faster. Weigh that against the alternative: a breach traced to a vendor whose controls you never specified, whose notification you never timed to your own deadlines, and whose subcontractors you never bound. The cost of a well-drafted exhibit is measured in hours, and the cost of its absence is measured in patient notifications, regulatory scrutiny, and the money and trust a breach consumes. For the vendors that matter, the exhibit is one of the highest-return documents in the entire relationship.

How we approach a vendor security exhibit

We review the exhibit the way a security incident later will, by asking whether each control is specific enough to hold the vendor to, whether the notification clause protects your downstream deadlines, and whether you have any real way to verify the vendor is doing what it promised. Where a vendor supplies only boilerplate, we mark the gaps that matter most for a healthcare organization and negotiate the terms the vendor can reasonably meet. Not every low-risk vendor warrants a heavily negotiated exhibit, and we will say so. But for the vendors sitting closest to your patient data, a strong, specific security exhibit is the difference between a contract that describes security and one that delivers it.

How to actually read a SOC 2 report

When a vendor offers a SOC 2 report in place of an open-ended audit right, that can be a fair trade, but only if you read the report rather than file it. Two things matter most. First, the type: a Type II report tests whether the controls operated effectively over a period of time, while a Type I report only describes controls at a single point, so a Type II is the more meaningful assurance. Second, the exceptions: the value of the report is in the auditor’s noted deviations and the “complementary user entity controls” it assumes you will handle on your end. A clean-looking report with several exceptions in areas that matter to you, or one that quietly makes you responsible for controls you assumed the vendor owned, tells you more than the cover page. The security exhibit should require the vendor to furnish the report on a recurring basis and to remediate material findings, so the assurance stays current rather than expiring the day after you signed.

Where state law adds to the federal floor

HIPAA sets the baseline, but it is not the only law your vendors implicate, and the exhibit is a good place to account for that. If a vendor’s system touches biometric identifiers, a fingerprint time clock, facial-recognition check-in, voiceprint authentication, Illinois’s biometric privacy law imposes its own consent and handling requirements backed by significant liability, and the exhibit should reflect those obligations and push responsibility to the party creating the exposure. State data-breach notification laws can layer additional timing and content requirements on top of the federal rule, and a vendor serving patients across state lines may trigger several at once. You do not need to litigate every statute in an addendum, but the exhibit should be written with awareness that “HIPAA-compliant” is a floor, not the whole obligation, especially for an Illinois organization.

Match the exhibit to the vendor’s risk

Not every vendor needs the same exhibit, and pretending otherwise wastes negotiating capital. A vendor hosting your entire records system warrants a fully specified, heavily negotiated schedule with audit rights and tight notification. A vendor with incidental, limited exposure may reasonably be held to a lighter standard. Tier your vendors by how much protected health information they touch and how central they are to your operations, and spend your effort where a failure would be largest. The point of the exhibit is proportional protection, rigorous where the risk is real, sensible where it is modest, so that the vendors closest to your patients’ data are the ones held to the most exacting and testable commitments.