EHR Vendor Management:
Master Shared HITECH Compliance

The Health Information Technology for Economic and Clinical Health (HITECH) Act significantly changed the compliance landscape for small healthcare practices. Under HITECH, Electronic Health Record (EHR) vendors are not just technology providers, they’re business associates with legal obligations under HIPAA (45 CFR § 164.502(e); § 164.504(e)). However, this does not reduce the covered entity’s responsibilities. Instead, compliance is a shared duty, where both parties must ensure that systems and processes protect Protected Health Information (PHI). This guide explains what shared compliance means, the boundaries between vendor and practice duties, and practical strategies to protect your practice from regulatory and operational risks.

If your EHR vendor mishandles PHI, will they be the only one responsible for a HIPAA violation? The short answer is no.

The HITECH Act made EHR vendors directly accountable for HIPAA compliance as business associates. Yet, your practice, as the covered entity, still shares the compliance burden. OCR enforcement history shows that even when the breach originates from the vendor’s actions, the covered entity can still face fines for inadequate oversight.

This article breaks down your mutual responsibilities and offers actionable steps to ensure your vendor relationship is a compliance asset, not a liability.

Understanding the HITECH Act’s Impact on EHR Vendor Accountability

Before HITECH

• Vendors often acted as subcontractors without direct HIPAA liability.

• Covered entities bore the full compliance responsibility.

After HITECH

• EHR vendors are recognized as business associates.

• Vendors must comply with applicable HIPAA Security, Privacy, and Breach Notification Rules.

• Both the covered entity and vendor can face independent OCR enforcement.

Covered Entity Responsibilities

• Selecting HIPAA-compliant vendors through due diligence

• Executing a comprehensive Business Associate Agreement (BAA) (§ 164.504(e)(2))

• Configuring and using the EHR system according to HIPAA standards

• Training staff on secure use of the EHR

Vendor Responsibilities

• Implementing technical safeguards such as encryption and audit logs

• Ensuring secure hosting environments and data centers

• Notifying the covered entity of breaches without unreasonable delay (§ 164.410(a))

• Supporting compliance documentation and reporting needs

A small primary care clinic decided to outsource its electronic health record (EHR) hosting to a reputable and well-known vendor, trusting that the vendor would manage all aspects of data security. However, when the vendor’s server was compromised by hackers, thousands of sensitive patient records were exposed. The clinic initially assumed that the vendor would take full responsibility for handling the regulatory breach notification and compliance process. Unfortunately, the Office for Civil Rights (OCR) investigation revealed several significant shortcomings on the clinic’s part.

 The clinic had not performed a thorough risk analysis of the vendor’s security environment before outsourcing (§ 164.308(a)(1)(ii)(A)). Additionally, the clinic failed to actively monitor or verify the vendor’s ongoing security measures to protect patient data. The clinic also lacked clear and documented breach response protocols. As a result, both the vendor and the clinic faced penalties. 

The clinic alone was fined $150,000 for failing to ensure that proper compliance safeguards were established and documented. This case highlights the crucial lesson that outsourcing does not absolve healthcare providers from their own HIPAA responsibilities. Clinics must remain actively involved in vendor oversight and maintain rigorous compliance standards.

If my vendor is HIPAA certified, do I still need a BAA?

Yes, absolutely. Even if your vendor holds a HIPAA certification, this certification alone does not replace the legal requirement for a signed Business Associate Agreement (BAA) (§ 164.502(e); § 164.504(e)). The Office for Civil Rights (OCR), which enforces HIPAA regulations, requires that covered entities have a formal, written agreement with their vendors who handle Protected Health Information (PHI). This agreement clearly outlines each party’s responsibilities related to safeguarding patient data and responding to potential breaches. The BAA serves as a crucial legal safeguard and helps ensure accountability on both sides.

Who notifies patients in case of a vendor breach?

Generally, the covered entity, the healthcare provider or organization, is responsible for notifying patients if their PHI has been compromised due to a vendor breach. However, the vendor must promptly share all relevant breach details, including the nature and scope of the incident, so the covered entity can meet HIPAA’s strict notification timelines. Timely and transparent communication between the vendor and covered entity is essential to comply with regulatory requirements and maintain patient trust (§ 164.404(a); § 164.410)

What should I do if my vendor refuses to sign a BAA?

If a vendor refuses to sign a Business Associate Agreement, you should not move forward with contracting or sharing PHI with them. HIPAA explicitly prohibits covered entities from working with vendors who will not agree to the terms of a BAA when they handle protected health information. Proceeding without this agreement could expose your organization to significant legal and financial risks.

How often should we review our vendor’s compliance posture?

Vendor compliance should be reviewed regularly, at a minimum once every year. Additionally, reviews should take place whenever there are major system upgrades, significant security incidents, or changes in relevant laws and regulations. Frequent and thorough assessments help ensure your vendors continue to meet HIPAA standards and adequately protect sensitive patient information over time.

The HITECH Act makes EHR vendors directly liable for HIPAA compliance, but shared responsibility means your practice must still:

• Vet vendors thoroughly and document the process

• Maintain an updated and enforceable BAA

• Monitor vendor security practices

• Train your staff on secure EHR use

• Act quickly in breach scenarios

By treating your EHR vendor as a compliance partner, not just a service provider, you can reduce risk, improve patient trust, and strengthen your overall HIPAA posture.

A practical step to reinforce compliance is integrating a compliance system into your operations. These tools monitor requirements, perform ongoing risk reviews, and keep your practice prepared for audits, helping you avoid costly mistakes while presenting a proactive stance to oversight bodies.