HIPAA Shared Responsibility: What Your Vendor Runs After Launch
By the Netsam team · · 5 min read
Quick answer
Under HIPAA, a clinic and its technology vendors share responsibility. The practice keeps its HIPAA program: policies, risk analysis, training, and decisions about who gets access. A vendor such as Netsam, under a business associate agreement, builds and runs the technical safeguards it controls, such as access control, audit logging, encryption, patching, monitoring and tested restores, and reports on that work regularly.
What does shared responsibility mean for a clinic's website and portal?
Once a patient portal or online intake system goes live, the question shifts from what was built to who keeps it safe. The honest answer is that both of you do, for different things.
Your practice is the covered entity. It decides who should see what, trains its staff, runs its risk analysis and owns its breach procedures. A vendor that builds and hosts the system is a business associate, responsible for the safeguards in the systems it operates. Neither side can do the other's part, and a vendor who tells you it will make you compliant is overselling.
Most of the problems we see in healthcare systems are not exotic attacks. They are ordinary gaps: an account that stayed open after someone left, a backup nobody had restored, a test copy of patient data sitting in an unprotected environment. Clear ownership is what closes them.
What does the business associate agreement actually divide?
The business associate agreement (BAA) is where the division is written down. It sets out how the vendor may use and protect protected health information, how it reports incidents, how it handles subcontractors and what happens to the data when the relationship ends.
A BAA is only as good as its match to reality. If the vendor hosts your portal, uses a cloud provider and sends text reminders through a messaging service, each of those touches should be accounted for. Netsam reviews those relationships with clients during discovery, before anything containing patient data is built.
Who does what after launch?
A clear split avoids the most common failure: each side assuming the other is handling something. Here is how the work typically divides when Netsam builds and hosts a healthcare system:
- Your practice: HIPAA policies and risk analysis, staff training, approving who gets which role, removing access when someone leaves, patient communication and breach decisions.
- Your vendor: role-based access enforcement, separate credentials per environment, audit logging, encryption in transit and at rest, scheduled patching, monitoring and alerting, backups with tested restores.
- Together: periodic access reviews, reviewing audit log reports, incident response drills and deciding when a change needs approval before it goes live.
What should a monthly operations report show?
You should not have to take maintenance on faith. Our hosting and managed infrastructure service includes a monthly operations report written for a practice administrator, not an engineer.
A useful report shows which patches were applied and when, any alerts and how they were resolved, the date and result of the most recent restore test, and a summary of who holds access to the system so your office manager can confirm it is still right. When a staff member leaves, that list is how you catch an account that should have been closed.
How are changes and AI steps controlled once the system is live?
Changes to a live patient system go through separate development, staging and production environments, with a named person approving promotion to production. If something goes wrong, a rollback follows the same path, so recovery is a practiced procedure rather than an improvisation.
The same discipline applies to automation and AI. Protected health information stays out of AI steps unless the vendor agreement covers that use, and a named person approves anything that leaves the system. Every proposal, approval and action is logged. That is the human-in-the-loop model described on our How We Work page.
For example, if an intake automation reads an uploaded referral, the extracted fields are shown to a staff member next to the original document before anything is written to the chart. Nothing is sent to a patient, payer or partner without a person approving it.
How does Netsam support healthcare clients over time?
Because Netsam builds, hosts and runs the systems it delivers, there is one firm to call when something is slow or a form stops working. We treat the period after launch as the longest part of the relationship: measuring results, tuning workflows and adding capabilities only when they are ready. See what we build for clinics on our healthcare page.
If your practice in Texas, the Southwest or elsewhere wants a clearer picture of who owns what in its current setup, we can help. Contact us or call 866-294-3489.
Frequently asked questions
Is a hosting provider automatically a business associate?
Generally, a vendor that creates, receives, maintains or transmits protected health information for a covered entity is a business associate and needs a BAA, and that includes hosting the data even if the vendor rarely looks at it. If you are unsure about a specific arrangement, confirm it with your compliance lead or counsel before patient data is stored.
How often should we review who has access to our patient portal?
Set a regular schedule that fits your practice, such as quarterly, and also review whenever someone changes roles or leaves. The vendor can produce the current list of accounts and roles; your practice confirms whether each still makes sense. Removing a departed employee's access promptly is one of the simplest and most effective safeguards you have.
What happens to our patient data if we change vendors?
This should be settled in the contract and BAA before you start. You should get your data back in a usable, documented format, and the outgoing vendor should return or destroy remaining copies as the agreement requires. We document integrations and environments as we go, so a handover is a procedure rather than a reconstruction.
Does Netsam sign business associate agreements?
Where we create, receive, maintain or transmit protected health information on your behalf, such as hosting a patient portal or intake system, a business associate agreement is part of the engagement. We review the scope together during discovery, so the agreement reflects what we actually build, host and run, along with any subcontractors involved in hosting or messaging.
Related: Healthcare