HIM 530 Module 6 Third-Party Risk Short Paper Example

Their Breach, Our Patients: Managing Business Associate and Vendor Risk at Osprey Point Health

[Student Name]

Southern New Hampshire University

HIM 530: Information Protection & Security in HIM

Module Six Short Paper

[Instructor Name]

[Date]

The organization, setting and figures below are a composite written as a model document. No real employer, client, colleague or patient is described.

Their Breach, Our Patients: Managing Business Associate and Vendor Risk at Osprey Point Health

In February 2024, a ransomware attack on Change Healthcare, a claims clearinghouse owned by UnitedHealth Group, disrupted claims and pharmacy transactions for hospitals and practices across the country for weeks, and the company later reported that information on roughly 190 million people may have been affected. Osprey Point Health used that clearinghouse for part of its claims and felt the disruption in delayed payments. The event made a simple point: a vendor's security failure becomes the hospital's operational and privacy problem. This paper examines how Osprey Point should manage the risk held by its 38 business associates.

Why Vendor Risk Is the Hospital's Risk

Under HIPAA, a business associate is anyone outside the workforce who handles protected health information while performing a service for a covered entity. Business associates are directly liable for complying with the Security Rule, but the covered entity must obtain satisfactory assurances through a written agreement and may not ignore known problems. Patients do not distinguish between a breach at the hospital and a breach at its vendor. Research shows the scale of the issue. Liu et al. (2015) found that breaches reported to federal regulators involved many kinds of entities and media, including business associates, and McCoy and Perlis (2018) found that a small number of very large hacking incidents accounted for most breached records, the kind of concentration that occurs when a single vendor holds data for many organizations.

Tiering the 38 Vendors

Not every vendor deserves the same scrutiny. Osprey Point will sort its business associates into three tiers based on the volume and sensitivity of data they hold and the access they have to hospital systems, as Table 1 shows.

Table 1. Vendor Tiers and Oversight

Note. Tiering by the information protection manager and procurement; composite data.

Due Diligence Before Signing

For new Tier 1 and Tier 2 vendors, due diligence will occur before the contract is signed, when the hospital has the most bargaining power. It will include a security questionnaire, a copy of an independent assessment such as a SOC 2 Type II report or a recognized health sector certification for Tier 1 vendors, evidence of multifactor authentication and encryption, a description of how the vendor uses subcontractors and the vendor's breach history. Procurement will not issue a purchase order for a Tier 1 or 2 vendor until the information protection manager signs off.

Contract Terms That Matter

Every business associate agreement must meet HIPAA's minimum requirements, but Osprey Point will add terms that make oversight practical. Vendors must report suspected security incidents within 72 hours, well inside HIPAA's outer limit for breach notification, so the hospital can meet its own obligations. Subcontractors that handle Osprey Point data must be disclosed and bound by equivalent terms. The hospital may request evidence of controls annually and after any incident. Data must be returned or destroyed at contract end with certification. And Tier 1 vendors must maintain and test a business continuity plan and carry cyber insurance at a stated level.

Monitoring After Signing

Oversight continues through the life of the contract. Tier 1 vendors will be reassessed yearly and whenever they announce an incident, acquisition or major system change. The nine vendors who did not answer the last survey will be contacted by their business owners inside the hospital, and repeated nonresponse will be escalated to procurement as a contract compliance issue. Argaw et al. (2020) note that hospitals often lack the staff and resources to manage cybersecurity comprehensively, which argues for focusing scarce oversight time on the vendors whose failure would matter most.

Dependence on a Single Vendor

The clearinghouse attack showed a risk that no contract can remove: concentration. When one vendor serves thousands of organizations, its failure affects all of them at once. Osprey Point will identify every Tier 1 vendor without a practical alternative and create a contingency plan for each. For claims, the hospital will maintain an active connection with a second clearinghouse, used for a small share of claims so it can scale up quickly. For transcription, clinicians will have a documented fallback to direct typing. Revenue cycle and clinical leaders will rehearse the claims contingency once a year.

Roles Inside the Hospital

Vendor oversight tends to collapse when each department believes another one owns it. Each vendor will have a business owner, the department leader who uses the service, responsible for the relationship and for prompting reassessments. Procurement will hold contracts and enforce the rule that security review comes before purchase. The information protection manager will run assessments and keep the vendor register, and the compliance officer will receive quarterly reports on overdue reviews and vendor incidents. Writing these roles into the vendor management procedure turns a set of good intentions into work someone is accountable for.

Offboarding

Vendor risk does not end when a contract does. When a relationship ends, the hospital will disable all vendor accounts the same day, collect certification that data were returned or destroyed and remove the vendor's network connections. The information protection manager will keep a register of ended relationships for six years, since questions about data held by former vendors can arise long after the contract.

Conclusion

Osprey Point cannot outsource responsibility for its patients' information. By tiering vendors, doing due diligence before signing, writing agreements that make oversight practical, monitoring according to risk, planning for the failure of critical vendors and closing access at the end of a relationship, the hospital can treat third-party risk as part of its own information protection program rather than as someone else's problem.

References

Argaw, S. T., Troncoso-Pastoriza, J. R., Lacey, D., Florin, M.-V., Calcavecchia, F., Anderson, D., Burleson, W., Vogel, J.-M., O'Leary, C., Eshaya-Chauvin, B., & Flahault, A. (2020). Cybersecurity of hospitals: Discussing the challenges and working towards mitigating the risks. BMC Medical Informatics and Decision Making, 20, Article 146. https://doi.org/10.1186/s12911-020-01161-7

Liu, V., Musen, M. A., & Chou, T. (2015). Data breaches of protected health information in the United States. JAMA, 313(14), 1471-1473. https://doi.org/10.1001/jama.2015.2252

McCoy, T. H., Jr., & Perlis, R. H. (2018). Temporal trends and characteristics of reportable health data breaches, 2010-2017. JAMA, 320(12), 1282-1284. https://doi.org/10.1001/jama.2018.9222