A list of vendors is not vendor risk management. Vendor Risk is the tiered, dated review every third party touching ePHI needs — questionnaire out, evidence back, risk tier assigned, review date set.
What it does
- Tiers vendors by data access, scale, and criticality using an editable model.
- Issues HIPAA-relevant questionnaires and collects responses with evidence attached.
- Flags gaps (expired SOC 2, missing BAA, subcontractor change) with a visible owner.
- Produces a dated review record per vendor, feeding the Risk Register when material.
How it maps to HIPAA
The feature supports §164.308(a)(1)(ii)(A) (risk analysis — vendors are in scope), §164.308(b)(1) (BA written contract), §164.502(e) (uses and disclosures to BAs), and §164.308(a)(1)(ii)(B) (risk management of findings).
Where it fits
Vendor Risk is a Vendors module capability, pairs with BAA Management, and for independent third-party reviews see the Vendor Assessment service.