The Problem
You cannot control what happens inside a vendor you do not manage
Health systems, payers, and specialty providers share PHI with hundreds of vendors annually. Business Associate Agreements create legal accountability, but they do not prevent breaches. Once you hand over plaintext data, the risk is entirely theirs to manage and entirely yours to bear.
The majority of large healthcare breaches originate at business associates, not covered entities themselves.
BAAs establish liability but do not reduce the probability or impact of a third-party breach.
Vendor security assessments are point-in-time snapshots; they cannot account for changes in a vendor posture after you share data.
When a vendor is breached, you face the OCR notification obligation, the class action exposure, and the reputational damage, regardless of which party was at fault.