Before PHI Leaves Your Building: The SOC 2, BAA and Audit-Log Questions to Ask Any DME Intake Vendor

The vendor questionnaire nobody reads

Picture a mid-sized DME supplier that switched fax providers two years ago. The sales call was friendly, the price was lower, and the website had a "HIPAA compliant" badge. Nobody asked for anything in writing. Last month an auditor asked for the Business Associate Agreement, and it took three days to find out whether one had ever been signed.

That story is not unusual. Intake is where the most PHI in a DME business passes through the most hands, and it is often outsourced piece by piece: a fax service here, an e-signature tool there, an OCR add-on, a shared inbox. Each one is a business associate under HIPAA, and each one is your responsibility to vet.

"'HIPAA compliant' is a claim. A signed BAA, a current SOC 2 Type II report and a readable audit log are evidence."

The distinction matters because the badge costs the vendor nothing. The evidence takes them months to produce, and that is exactly why it tells you something.

Type I, Type II, and why the difference is not pedantic

A SOC 2 Type I report says a vendor's controls were designed properly on one specific date. A Type II report says an independent auditor watched those controls operate over a period of months and tested whether they held. If your vendor says "we're SOC 2 certified," ask which one. Strictly speaking, SOC 2 is an attestation report, not a certification, so the wording itself is a small clue about how carefully the sales team has been briefed.

Then read the report, or at least the parts that matter: the audit period, the trust services categories in scope (security is the baseline; availability and confidentiality matter for intake), the list of exceptions, and the complementary user entity controls. That last one is the section most buyers skip. It lists what youare responsible for, such as removing departed employees' access, and it is where a lot of real-world exposure sits.

What it costs when the answer is "we never checked"

The cost rarely shows up as a headline breach. It shows up as friction. A hospital partner asks for your security attestation before sending referrals. A payer audit asks who can access scanned orders. A cyber-insurance renewal adds a vendor-management section and prices you accordingly. Each of those is a week of scrambling for a document that should have been in a folder.

And when something does go wrong, a missing BAA turns an incident into a second problem. Disclosing PHI to a vendor without one is a HIPAA issue in its own right, separate from whatever the vendor did with the data.

Claim versus proof

Here is how common vendor statements translate into what you should actually ask to see.

Notice that none of these requests is hostile. A vendor with a mature security program has answered them all before, usually within a day. If the reply is vague or slow, that is useful information too.

Four stages of a vendor review that fits a small team

You do not need a security department to do this. You need a repeatable order of operations and someone who owns it.

Step three is the one people skip and the one that pays off. Ask the vendor to show you the full history of a single test document: when it arrived, who viewed it, whether it was changed, where it went next. If they can only show you a delivery confirmation, you do not have an audit trail. You have a receipt.

Questions that reveal more than the report does

Reports are written for auditors. A few plain questions, asked on a call, tell you how the vendor behaves when something breaks.

How fast will we hear about an incident?

HIPAA gives covered entities an outer limit, but your contract can and should be tighter. A vendor who commits to notifying you within a few days gives you time to act. One who says "as required by law" may take the full period before telling you anything.

What happens to our documents if we leave?

Ask how data is returned and how deletion is confirmed. Intake records you may need for an audit years from now should not be stranded in a platform you no longer pay for.

Who on your side can see our files?

Support engineers, offshore contractors and AI model training pipelines are all legitimate places to ask about. You are not accusing anyone. You are finding out where your patients' data lives.

Your pre-renewal checklist

Where this connects to denials

It may seem odd to talk about security on a blog about denials. But the same audit trail that satisfies a HIPAA review also settles disputes about when a signed order arrived and whether a document was altered. Suppliers who can produce that history quickly win more of those arguments. Suppliers who cannot end up writing off the claim.

Vetting a vendor properly is a one-afternoon job per tool, repeated once a year. Skipping it is invisible for a long time, and then it is suddenly the only thing anyone is asking about.

"You will never regret having the paperwork. You will absolutely regret not having it on the day someone asks."