In healthcare the defining feature is that vendor risk and patient data risk are the same risk. Clinical systems, billing, imaging, transcription, scheduling, cloud hosting and analytics all touch identifiable health data, and the obligation to protect it follows the data to whoever holds it.
In the US, HIPAA makes this explicit through business associate agreements: any vendor handling protected health information on a covered entity's behalf is contractually and directly liable under the Security Rule, and the Breach Notification Rule requires notification without unreasonable delay and no later than 60 calendar days. In the UK and EU, UK GDPR and the EU GDPR impose equivalent duties on processors and require a documented processor chain; NHS suppliers are additionally assessed through the Data Security and Protection Toolkit. In the UAE, ADHICS sets the healthcare information security standard. Connected medical devices bring their own regime, with the FDA requiring cybersecurity information including a software bill of materials for premarket submissions.
The operational consequence is that the sub-processor map is a compliance artefact rather than an inventory. Knowing which vendors — and which of their vendors — can reach patient data determines who must be under a BAA, who must be notified in a breach, and how quickly the clock runs.
The assessment itself is largely the same questions in different clothes. Rather than maintaining a library of healthcare templates to choose between, RiskXchange maps every vendor to 157 universal controls and pre-populates the questionnaire from evidence the vendor already holds — a SOC 2 report, an ISO 27001 certificate, a HITRUST CSF certification, a completed SIG or CAIQ, a trust centre. The vendor reviews rather than writes; your team checks rather than chases. Where a vendor's answer and their externally observable posture disagree, that gap is surfaced as a finding — and it is the finding a template library cannot produce on its own.
In healthcare, vendor risk is patient risk. Your sub-processor map decides who sees PHI; your breach window is statutory; your audit cycle never stops.
Three of The Agency's leads cover what matters for healthcare: where PHI goes, what vendors are doing with it, and whether the framework coverage holds up when an auditor walks in.
Vendor breach signal, before the news cycle. REX correlates dark-web dumps and external attack-surface changes against every vendor in your stack — when a third party gets hit, you find out from us, not from the patient who Googled their name.
BAAs, sub-processor lists, data-residency clauses — extracted, structured, current. ARIA reads every vendor BAA, DPA and trust page — surfaces sub-processor chains, data residency commitments and breach-notification SLAs automatically.
HIPAA, ADHICS, GDPR — coverage, not gaps. TARA continuously checks vendor posture against healthcare-relevant frameworks and surfaces drift before the regulator does.
Specific moments where The Agency changes the work — not abstract outcomes, just less of the wrong work and more of the right.
ARIA extracts the sub-processor list from every vendor contract and trust page. The chain you sketched on a whiteboard becomes a live picture.
REX surfaces vendor-side breaches from dark-web and attack-surface signal — you have time to respond before the 60-day clock starts.
When auditors ask about a specific vendor's BAA, the evidence trail is composed and linked. No archaeology before the OCR review.
Continuous gap analysis means you find out about posture drift the week it happens, not at the next risk committee.
We finally have a continuous view of where personal data goes after it leaves us. The Agency built our sub-processor map in a day — and it has stayed live since.
Business associates, breach clocks and the vendors that reach patient data.
Book a 30-minute call and we'll have NOVA, ARIA and REX produce a complete posture report on one of your live vendors inside 24 hours.