HIPAA security questionnaires
What healthcare customers ask in vendor security questionnaires, what evidence they expect behind each answer, and how a small business associate can answer quickly and honestly.
HIPAA security questionnaires at a glance
A HIPAA security questionnaire is the vendor assessment a hospital, practice or health plan sends before sharing PHI with you. HIPAA doesn't prescribe one; customers use their own forms or standard ones. They usually ask whether you will sign a BAA, whether you have a current risk analysis and written policies, how you encrypt and control access to data, how you handle incidents and breach notice, which subcontractors touch PHI, and whether you have SOC 2 or HITRUST reports. Honest, documented answers matter more than perfect ones.
| Sent by | Healthcare customers evaluating you as a business associate |
|---|---|
| Required by HIPAA? | No set format; customers use them to manage vendor risk |
| Commonly asked | BAA, risk analysis, encryption, access control, incident response |
| Often asked | SOC 2 or HITRUST report, subcontractor list, pen test results, insurance |
| Speeds it up | A maintained answer library and a short security overview document |
Covered entities must get satisfactory assurances, through a BAA, that a business associate will safeguard PHI (164.308(b), 164.314(a)). Many commonly use security questionnaires to decide whether those assurances are believable — a market practice, not a HIPAA requirement. The questionnaire is not a HIPAA document; your answers rest on documents that are.
What they ask, and what backs each answer
| Topic | Typical question | Evidence to have ready |
|---|---|---|
| BAA | Will you sign our BAA? | Your own BAA template; list of what you can and can’t agree to |
| Risk analysis | When was your last risk analysis? | Dated risk assessment and risk management plan |
| Policies | Do you have written security policies? | Policies and procedures, review dates |
| Access | How is access to PHI controlled? | Role model, MFA settings, offboarding process |
| Encryption | Is data encrypted in transit and at rest? | Algorithms, key management, scope — see encryption |
| Logging | Do you log access to PHI? | Audit controls, retention |
| Incidents | How fast will you notify us of a breach? | Incident plan; HIPAA’s outer limit is 60 days from discovery (164.410), customers often ask for less |
| Subcontractors | Who else handles our data? | Subprocessor list with BAA status |
| Assurance | Do you have SOC 2 / HITRUST / a pen test? | Reports, or a dated plan — see HIPAA vs SOC 2 |
| Training | Is your staff trained on HIPAA? | Training records |
How to answer faster
We recommend keeping one maintained answer library, reviewed after each risk analysis, and a two-page security overview you can send before the questionnaire arrives. Compliance platforms can store answers and evidence. Keep answers factual and current: a questionnaire is often attached to the contract.
Next steps
- HIPAA for SaaS companies that are business associates →Scenario
- HIPAA for health app startups →Scenario
- HIPAA compliance software →Tool
- Business associate →Requirement
- Business associate agreements (BAAs) →Requirement
- Security risk analysis →Requirement
- HIPAA policies and procedures →Requirement
- Encryption of ePHI →Requirement
Frequently asked questions
Do we have to answer a security questionnaire to sell to healthcare?
HIPAA doesn't require it, but most healthcare customers won't share PHI without one. Treat it as part of the sales process.
What if we don't have SOC 2 yet?
Say so and describe what you do have: a current risk analysis, policies, safeguards and BAAs. Many smaller customers accept that, especially with a timeline.
Can we answer 'yes' to things we plan to do?
No. Answers can become part of the contract; describe what is in place today and what is planned separately.