HIPAA is the starting point. Proving it is the real work.
Business Associate Agreements. Vendor security questionnaires. Customer risk reviews. Evidence requests. Audit inquiries. Contractual security terms. They arrive constantly, and each one wants the same thing. Greypike handles HIPAA compliance for business associates and the vendors healthcare relies on.
The challenge isn't knowing HIPAA exists. It's consistently completing the work that demonstrates it.
What actually lands in your inbox
This quarter- Business Associate Agreement to signHospital group
- Vendor security questionnaire — 74 questionsNew customer
- Evidence request: risk assessment and training recordsInsurer
- Annual customer risk reviewExisting client
The information exists. The problem is finding it — and proving it's current.
HIPAA compliance for business associates and healthcare vendors
Greypike supports the organizations responsible for protecting healthcare information — usually the ones being asked to prove it, rather than the ones doing the asking. Pick yours.
Business Associates
Since the HITECH Act, Business Associates are directly liable for HIPAA Security Rule compliance. The obligation is yours, not inherited from the covered entity.
What lands on you
- Every BAA you sign carries security terms you have to evidence
- Covered entities audit their Business Associates, and increasingly do
- Your own subcontractors need agreements and oversight too
Healthcare technology vendors
Your product touches protected health information, so your security program is part of your customer’s risk assessment.
What lands on you
- Security review before a hospital or payer will buy
- Questionnaires arriving faster than you can answer them
- Enterprise deals stalling on evidence you have but cannot find
Medical service providers
Delivering care or clinical services while carrying the same obligations as far larger organizations.
What lands on you
- HIPAA obligations without a compliance department
- Workforce training across clinical and admin staff
- Devices and systems that reach patient information
Revenue cycle management
You handle high volumes of protected health information on behalf of providers who are accountable for you.
What lands on you
- Client audits of how you handle their data
- Access control across large, changing teams
- Evidence requests from multiple providers at once
Billing providers
Claims and payment data is protected health information, and your clients are being asked about you.
What lands on you
- BAAs with every practice you serve
- Proving access is limited to who needs it
- Incident response your clients will ask to see
MSPs serving healthcare
If you can access systems that hold a client’s PHI, you are almost certainly a Business Associate, whether or not the paperwork says so.
What lands on you
- A BAA per client, each with its own terms
- Your own program scrutinized, not just theirs
- Questionnaires arriving from several clients at once
Healthcare consultants
You are trusted with sensitive information and rarely have the infrastructure a hospital assumes you do.
What lands on you
- Security expectations written into engagement letters
- Evidence requests before a project starts
- Data handling across multiple client environments
Healthcare software companies
Your security program is a feature your buyers evaluate before they evaluate the product.
What lands on you
- Security review gating enterprise contracts
- Proving how protected health information is stored and accessed
- Keeping evidence current as the product changes
If you sign Business Associate Agreements, handle protected health information, or regularly receive security questionnaires from customers, this is built for you — whether or not anyone in the building has "compliance" in their title.
What we support for this segment
- HIPAA Security Rule
- HIPAA Privacy Rule
- Business Associate obligations
- Customer security reviews
Many organizations treat HIPAA as a project. Their customers don't.
Eight activities have to be maintained, not completed once. Pick any of them to see what maintaining it actually involves — and what a customer will ask you to produce.
Risk assessments
Reviewed periodically, and whenever things change
A risk analysis is not a document you file once. It has to reflect the systems you run today, and a customer will check the date before they read a word of it.
Workforce training
Annually, plus every new hire
Training has to reach everyone who touches protected health information, including people who joined last month and contractors nobody added to the list.
Access reviews
Quarterly for most organizations
Who still has access, and should they. Leavers, role changes and shared accounts are where this quietly breaks between reviews.
Policies and procedures
Reviewed as the organization changes
Policies written three years ago describing systems you no longer run are worse than none — they prove the program is not maintained.
Vendor oversight
At onboarding and at every renewal
You are accountable for the subcontractors who touch protected health information. A Business Associate Agreement on file is the start, not the end.
Incident response
Maintained and tested, not just written
A plan nobody has tested is a document. Customers increasingly ask when you last exercised it and what you changed afterwards.
Device and system security
Continuous, with periodic verification
Encryption, patching, MFA and device controls across everything that reaches protected health information — including the laptop in somebody’s car.
Documentation and evidence
Retained six years and kept current
HIPAA requires Security Rule documentation to be retained for six years. The problem is rarely the retention. It is finding it when someone asks.
The work never stops.Greypike turns each of these into recurring tasks with owners, due dates, required evidence and completion tracking — so the program stays current instead of being rebuilt every time somebody asks.
Cadences shown are Greypike's recommended practice and what customers typically expect. The Security Rule itself requires periodic review and updates as your environment changes, and six-year retention of required documentation.
Customer evidence requests are becoming the new audit
No regulator sent these. A prospective customer did, and the answer decides whether the contract moves forward.
What they ask
- Do you have a risk assessment?
- How do you manage access?
- Do you use MFA?
- Can you share your security policies?
- How do you respond to incidents?
- What training do employees complete?
Where the answers live now
Three weeks of assembly, and gaps found on the way
- Risk assessment in someone's email thread
- Training records in two systems and a spreadsheet
- Policies on a file share, version unclear
- Access reviews done, but not written down
- Nobody sure which BAA is the current one
Where they live with Greypike
One place, current, and already reviewed
- Compliance tasks, with owners and status
- Supporting evidence, dated and versioned
- Policies and procedures, current version marked
- Review history, showing the program is maintained
- Documentation an analyst has already checked
The information already exists. The problem is finding it. When the request arrives, you're answering from a system rather than searching email folders and file shares hoping the latest version is the one you send.
Compliance software, with people behind it
Most healthcare organizations don't employ a compliance team. The responsibility lands on whoever is nearest — and they already have a job.
Who this usually falls to
- Operations leaders
- Practice managers
- IT managers
- Security leads
- Founders
- Administrators
Greypike was designed for organizations where compliance is important but not someone's full-time job. When work is submitted, a compliance analyst reviews it and confirms the requirement is genuinely addressed.
What the platform provides
- Task-based compliance management
- Evidence collection and organization
- Compliance workflows
- Progress tracking
- Compliance analyst review
Every task includes clear instructions, a responsible owner, required evidence, a due date, acceptance criteria, and analyst review before it counts.
The problem most compliance software doesn't solve
Platforms focus on controls. Consultants focus on assessments. Neither one consistently gets the work done. Run a single requirement down both paths and watch where they diverge.
The traditional approach
- Requirement
- Control
- Evidence
- Hope it passes
Evidence exists. Whether the work was done is anyone’s guess.
The Greypike approach
- Requirement
- Task
- Completion
- Evidence
- Ongoing compliance
Work completed, reviewed, evidenced — and it stays current.
Compliance succeeds or fails on completed work — not on completed dashboards. Only one of these chains has a step where somebody actually does something.
Why healthcare organizations choose Greypike
Every task carries clear instructions, a responsible owner, required evidence, a due date, acceptance criteria and analyst review — so your team knows what needs doing, who owns it, and whether it's actually finished.
| Traditional compliance tools | Greypike |
|---|---|
| Focus on controls | Focus on actionable work |
| Self-service | Expert-reviewed |
| One-time project mindset | Continuous compliance |
| Scattered evidence | Centralized evidence |
| Compliance jargon | Plain-language tasks |
| Reactive preparation | Ongoing readiness |
Be ready for whatever arrives next
The same organized program answers all of these, which is the point — you prepare once and respond many times.
- A Business Associate Agreement
- A customer security questionnaire
- A HIPAA assessment
- A vendor review
- An insurance renewal
HIPAA compliance for business associates: FAQ
Something not covered here? Ask us directly, or read the HIPAA guide. Official guidance is on the HHS Security Rule page.
Are business associates directly liable under HIPAA?
Yes. Since the HITECH Act and the 2013 Omnibus Rule, business associates are directly liable for complying with the HIPAA Security Rule and for certain Privacy Rule and breach notification obligations. HHS's Office for Civil Rights can investigate and fine a business associate directly, not only through the covered entity.
Who counts as a HIPAA business associate?
Any person or organization that creates, receives, maintains or transmits protected health information on behalf of a covered entity or another business associate. That typically includes billing and revenue cycle companies, IT and managed service providers, cloud and software vendors, and consultants. Business associate status depends on what you do with PHI, not on whether you have signed a BAA.
What does the HIPAA Security Rule require?
Administrative, physical and technical safeguards for electronic protected health information. That includes a risk analysis and risk management, workforce security awareness training, access controls, audit controls, integrity and transmission security, contingency planning, business associate agreements, and written policies and documentation retained for six years.
How often do we need a HIPAA risk assessment?
The Security Rule does not set a fixed frequency. It requires an accurate and thorough risk analysis that you review and update periodically and whenever your environment or operations change. Annual review is the common practice, and it is what most customers and insurers expect to see.
Is the HIPAA Security Rule changing?
A major update was proposed in January 2025, which would make requirements such as multi-factor authentication, encryption and asset inventories mandatory. As of October 2026 it has not been finalized; the federal regulatory agenda lists final action no earlier than July 2027. The current Security Rule remains fully in force and enforced.
What should a business associate agreement include?
How the business associate may use and disclose PHI, a commitment to implement Security Rule safeguards, reporting of security incidents and breaches to the covered entity, matching agreements with any subcontractors that handle PHI, and the return or destruction of PHI when the contract ends.
How much does Greypike cost for HIPAA compliance?
Founding customer pricing is $399 a month on a 12-month term, or $4,000 a year paid up front, for one framework, with compliance analyst review included. See pricing.
General information, not legal advice.
The next evidence request is already coming
A customer, an insurer or a hospital group is going to ask you to show your security program. You can spend three weeks assembling the answer, or have it ready.
