Before granting a vendor access to patient systems, a medical practice should understand exactly what the provider can reach, how its work is monitored, and who is responsible if a security incident occurs. The questions to ask an IT provider before granting access to patient systems should cover the full relationship, from initial approval through access removal.
A general assurance that a provider takes security seriously is not a substitute for clear answers. Ask for details about access methods, protected health information (PHI), incident response, subcontractors, and offboarding. Record the answers and make sure the service agreement reflects the responsibilities that matter to your practice.
Before access: define the work and responsibilities
Will your work involve PHI, and do we need a business associate agreement?
Ask whether the provider’s work could involve creating, receiving, maintaining, or transmitting PHI. If so, clarify whether a business associate agreement (BAA) is needed and what the agreement covers. The HIPAA Security Rule’s implementation guidance discusses business associates and security responsibilities; use it as a reference when reviewing the provider’s proposed arrangement with your privacy or compliance advisor (NIST’s HIPAA Security Rule implementation guidance).
A BAA is important when applicable, but it does not explain every practical detail of access. Ask how the provider will protect information while working, what it will do if it identifies a problem, and how it will handle information when the work ends. Treat broad statements such as “HIPAA compliant” as a starting point for discussion, not as a complete description of safeguards or responsibilities.
Which systems and data does the provider need?
Ask the provider to identify the specific systems, accounts, and data it expects to access, and why each is necessary. Discuss whether it can do the work without viewing patient records or using a high-privilege account. Access should be limited to what the work requires, with a clear approval process for any expansion.
Have the provider describe its proposed access method before work begins. If it needs administrative access, ask which tasks require it, how it will be controlled, and whether access can be temporary or limited to a particular system. A request for broad access should come with a clear explanation and safeguards, not just convenience.
Will every technician use an individual account?
Ask whether each technician will use a unique account rather than a shared administrator login. Individual accounts help the practice connect activity to a specific user and make it easier to change or remove access when a technician’s role changes. Ask whether accounts have only the permissions needed for the work and how exceptions are approved.
Also ask whether multifactor authentication is required for remote and administrative access. Clarify what happens if a required security step is unavailable, and how the provider prevents workarounds such as sharing passwords. Agree on a secure process for providing credentials; avoid sending administrative passwords through ordinary email or chat.
While work is underway: control and review access
How do you approve, log, and monitor technician activity?
Ask who at the practice can authorize access, how the provider verifies that authorization, and how urgent requests are handled. Find out what activity is logged, who can review those records, and how the provider will help the practice obtain relevant logs if a question arises.
Ask how often access is reviewed and what prompts a review, such as a change in the work being performed or a change in assigned personnel. Clarify how the provider will notify the practice before making material changes to its access method. These details turn access control into an ongoing process rather than a one-time setup.
Who else may access our systems or data?
Ask whether subcontractors or other third parties could access the practice’s systems or patient information. If the answer is yes, request their roles, the reason they need access, and an explanation of how they are covered by appropriate agreements and safeguards. Ask who is accountable for overseeing their access and how the practice will be informed if those arrangements change.
It can help to put these questions alongside broader vendor oversight practices. Zevonix has guidance on managing IT vendors and their responsibilities that may help a practice think through ongoing oversight.
If there is an incident: agree on the response beforehand
How quickly will you notify us about suspected unauthorized access?
Ask what the provider considers a reportable security concern, who it will contact at the practice, and how quickly it will make that contact after discovering a suspected incident. Make sure the notification process works outside routine business hours and identifies a backup contact if the primary contact is unavailable.
Discuss what the provider will do to contain an incident and preserve relevant logs or other evidence. Ask whether it will help determine which systems and information may have been affected, and what information it will provide to support the practice’s assessment. The provider should explain its role without implying that it alone decides the practice’s legal or notification obligations.
For a broader view of healthcare-sector preparedness, review CISA’s healthcare mitigation guide. It can support a discussion about how a provider’s incident-response work fits into the practice’s own security planning.
What will you provide to demonstrate your safeguards?
Ask what security documentation or independent assessment the provider can share, and whether the documentation applies to the services and systems it will use for your practice. Find out how often it is reviewed and how the provider communicates material findings or changes. If the practice needs additional assurances, discuss whether they can be included in the contract.
Keep your review focused on evidence that is relevant to the access being requested. A polished policy document may be useful, but it should not replace concrete answers about individual accounts, authentication, logging, incident notification, and third-party access.
When the work ends: remove access and account for data
How will you revoke access and handle patient information?
Ask how the provider will confirm that its staff accounts, remote access methods, credentials, and any temporary permissions have been removed when work ends or no longer requires access. Clarify who at the practice receives confirmation and what process applies if the engagement ends unexpectedly.
Also ask whether the provider holds copies of patient information, where that information is kept, and how it will be returned or securely disposed of when it is no longer needed. Confirm what records the provider must retain, if any, and how those records will be protected. Document the agreed process rather than relying on an informal promise to “clean up access.”
A practical evidence checklist
Before approving access, ask the provider to supply or confirm:
- A description of the proposed access method and the systems it will reach.
- The process for approving, limiting, reviewing, logging, and revoking individual accounts.
- How multifactor authentication is used for remote and administrative access.
- Whether PHI may be involved, whether a BAA is appropriate, and how subcontractors are covered.
- Incident-notification terms, evidence-preservation steps, and the provider’s response role.
- How access will be removed and patient information returned or securely disposed of at the end of work.
For Florida practices, ask your privacy or legal advisor which breach-notification requirements apply to your organization and situation. Florida law describes notification obligations and includes conditions and exceptions, so the practice should not assume that a vendor’s incident process settles its own responsibilities (Florida Statutes Section 501.171).
Make the decision with clear terms
Patient-system access should be specific, limited, reviewable, and removable. Get clear answers before sharing credentials, and put important expectations into the relevant agreements and operating procedures. Zevonix provides managed IT support and lists HIPAA compliance support among its services. Daytona practices can call (386) 260-0777 to discuss their IT needs and access questions.