A business associate agreement is a contract. It allocates responsibility, defines permitted uses and sets breach notification obligations. It is necessary, it is not optional, and it tells you nothing about whether the vendor’s engineering practice is sound.
What to ask beyond the signature
- Where is the data stored and processed, by region and by sub-processor?
- Who at the vendor has production access, and how is that reviewed?
- What is the actual detection-to-notification time, demonstrated not asserted?
- How is data returned or destroyed at termination, and can they evidence it?
- Do they subcontract, and have you seen those downstream agreements?
Certifications as a filter, not a conclusion
A SOC 2 Type II or HITRUST certification is useful evidence of process maturity. It is scoped, though, and the scope is the interesting part. Read which systems were in scope and which controls were tested rather than noting that the badge exists.
The question is never whether they have the certificate. It is what the certificate covers.
Ongoing rather than annual
Re-review on change
Vendors get acquired, change hosting providers and add sub-processors. A review performed once at procurement describes a company that may no longer exist in the same form.
