A client sent you a HIPAA security questionnaire

• 1. Read what they are actually asking for

  Questionnaires vary wildly, but they are asking one question in several ways: can we defend having chosen you if something goes wrong? Skim the whole form before answering anything. Separate the questions you can answer from records you already hold, the ones needing a decision, and the ones where the honest answer is no.

• 2. Send the agreement first

  If a signed business associate agreement is not already in place, that is the blocking item and everything else is secondary. Get it countersigned and attach a copy. If they sent their own template, read the indemnity and breach-notification timelines before signing — those are the clauses that differ most between health systems.

• 3. Attach evidence, not assertions

  “Yes, we train our staff” invites a follow-up question. A dated certificate list showing who completed training and when closes it. The same applies to your risk analysis, your policies with acknowledgement dates, and your subprocessor list. Attachments end threads; adjectives extend them.

• 4. Answer the negatives properly

  Where you do not have something, write: what is missing, what you do instead in the meantime, who owns fixing it, and the date. That converts a gap into a plan, which is what a reviewer needs in order to sign off internally.

• 5. Make the second one cheap

  The reason this hurts is that the evidence lives in six places and none of it is dated. Once a programme is running, answering is a matter of exporting what already exists. The organizations that find questionnaires painless are not more compliant — they are better filed.

The six things almost every questionnaire wants

1. 1A signed business associate agreement
2. 2Evidence you have conducted a risk analysis, with a date on it
3. 3Written security policies your staff have acknowledged
4. 4Proof of workforce training, per person
5. 5A list of subprocessors who also touch the data
6. 6An incident response process, and any incidents you have logged

All six are sections of the evidence pack our platform exports. That is not a coincidence — the pack was designed around this request, because it is the single most common reason organizations buy compliance software at all.

Common questions

What is a security questionnaire?

A form a buyer sends a vendor before signing, asking how you safeguard their data. In healthcare it comes from a covered entity — a hospital, health system or payer — and typically covers access control, encryption, workforce training, subcontractors, incident response and whether you have conducted a risk analysis. The usual attachments requested: a signed business associate agreement, your risk analysis evidence, written policies, training records and a subprocessor list.

What is a HIPAA security assessment?

Usually it means the security risk analysis the Security Rule requires at 45 CFR 164.308(a)(1)(ii)(A): identifying where electronic patient information lives, the threats and vulnerabilities to it, and the likelihood and impact of each risk — documented. Questionnaires ask whether you have done one because it is the foundation the rest of the programme sits on, and 'no' to that question is the answer reviewers find hardest to overlook.