HIPAA considerations when selecting PACS and image-storage vendors

The evaluation

Eight questions worth answering before you sign

1. What protected health information will the vendor create, receive, maintain, or transmit?

   Map the actual data flow, including diagnostic images, reports, demographics, credentials, support access, backups, and integrations.

2. Will the vendor sign an appropriate business associate agreement?

   HHS explains that covered entities and business associates must obtain required assurances through written contracts. The agreement should fit the services and data involved—not simply be treated as paperwork.

3. How is access granted, reviewed, and removed?

   Ask about unique identities, privileged access, multifactor authentication, support accounts, emergency access, session controls, and periodic access review.

4. What activity can your team audit?

   NIST’s HIPAA Security Rule guide discusses mechanisms that record and examine activity in systems containing electronic protected health information. Ask which logs exist, how long they are retained, and whether you can obtain them when needed.

5. How are availability and recovery tested?

   Understand redundancy, backup separation, recovery objectives, restoration testing, downtime workflows, and who leads communication during an outage.

6. Which subcontractors and cloud services are involved?

   The system shown in the sales presentation may rely on other organizations. Identify where data is stored, who else handles it, and how obligations flow to subcontractors.

7. What happens during a security incident?

   Define notification paths, investigation responsibilities, evidence preservation, customer support, contractual timelines, and how the vendor coordinates with your response team.

8. Can you leave cleanly?

   Confirm data ownership, export formats, assistance, cost, timing, deletion procedures, backup disposition, and written confirmation when data is returned or destroyed.

Shared work

A vendor does not absorb your organization’s responsibility

Cloud and hosted services can provide capable controls, but HHS states that using a cloud service does not relieve a covered entity or business associate of its HIPAA obligations. Responsibility is distributed across your organization, the primary vendor, and sometimes several subcontractors.

For a structured way to manage the compliance side of this work, ExpRad refers healthcare organizations to Live Compliance’s HIPAA compliance platform. Its team can help with the risk, policy, training, vendor, and evidence work that surrounds the technology decision.

Pause and clarify

Warning signs in a vendor review

• The answer to every security question is a certification name, with no explanation of your actual service.
• Administrative access, support access, logging, recovery, or deletion responsibilities are unclear.
• The business associate agreement conflicts with the service agreement or leaves material services outside its scope.
• Your organization cannot obtain usable data or images without proprietary barriers or unexpected cost.
• Sales assurances are stronger than the commitments in the final contract.

A strong evaluation combines radiology workflow knowledge, technical and security review, compliance analysis, and contract review. Bring the appropriate internal leaders and specialists to the same table before the decision is final.