How to manage an IT or EHR vendor's remote access to your practice

An IT company or EHR vendor that maintains your systems from outside your office is a business associate under HIPAA when the work involves patient data. So start with a business associate agreement (BAA). Then manage the access itself: know every way the vendor connects in, give each technician their own login with a second check at sign-in, and review what they did.

When a maintenance vendor is a business associate

HHS’s business associate guidance gives two examples that fit maintenance work. One is an IT contractor or vendor, such as an EHR vendor or a managed services provider. It counts when maintaining or supporting your systems requires it to create, receive, keep or send patient data. The guidance says this applies whether the work is done in person or remotely. The other is a technician who services a device that stores patient data, like a copier or a medical device, when the service exposes that data.

The agreement has to meet 45 CFR 164.314(a). The vendor must comply with the Security Rule, require the same of its subcontractors, and report any security incident it becomes aware of. Someone whose work doesn’t involve patient data, such as an electrician, doesn’t need a BAA. That holds as long as any contact with the data is incidental and you have reasonable safeguards in place.

Why remote access needs extra care

Remote access tools let a vendor’s technician see and control your computers from anywhere. CISA’s Guide to Securing Remote Access Software, written with the NSA, the FBI and others, explains why attackers like the same tools. Remote access software is used for legitimate work, so security software often doesn’t flag it. And an attacker who breaks into a managed services provider may reach many of its customers at once.

HHS’s 405(d) guide for small healthcare organizations makes a related point about medical devices. Many are managed remotely by outside vendors, and the guide says that widens the area an attacker can target.

List every way vendors connect in

You can’t control a connection you don’t know about. So start with a list: which vendor connects to which system, with which tool, from where. CISA recommends auditing the remote access software installed on your devices to find out which tools are in use and which are authorized. The 405(d) guide says to check that remote access software on your computers is still in use. It also says to disable inbound Remote Desktop Protocol (RDP), the Windows remote control feature, which it calls a common attack route. Instead, set up a VPN (a private, encrypted connection) for the specific people and systems that need remote access.

Ask each vendor directly what it has installed, and compare its answer with what you find on your devices. HHS’s voluntary Cybersecurity Performance Goals for the health sector include an asset inventory among the enhanced goals. Your list of vendor connections can be part of it.

Give each technician their own login

The Security Rule requires a unique name or number for each user of a system that holds patient data (45 CFR 164.312(a)(2)(i), “Required”). A vendor login that the whole support team shares breaks that link. Your system’s record shows the login, not which technician used it.

The other guidance points the same way:

• HHS’s Cybersecurity Performance Goals list “Unique Credentials” and separate accounts for admin work among the essential goals. Unique credentials help you spot unusual activity and keep an attacker from moving between systems.
• The 405(d) guide says to create a separate admin account for each person who needs admin rights. It also says to turn on MFA (multi-factor authentication: a second check after the password) for every admin account and every VPN connection.
• CISA tells managed services providers to use MFA on every account that can reach a customer’s systems and to treat those accounts as privileged. It also says not to reuse admin passwords across customers.

The current Security Rule requires procedures to verify that a person signing in is who they claim to be (164.312(d)), but it doesn’t name MFA. In January 2025, HHS proposed requiring MFA, with limited exceptions. That rule has not been finalized. For a vendor login that has to stay shared for now, see What to check when a vendor says its team uses one shared login.

Review what the vendor did

Reviewing activity in your systems is your practice’s job. The Security Rule requires you to have ways to record and examine activity in systems with patient data (164.312(b), audit controls). It also requires you to review those records regularly, such as audit logs and access reports (164.308(a)(1)(ii)(D), “Required”). Log-in monitoring (164.308(a)(5)(ii)(C)) is “Addressable”. You put it in place if it’s reasonable for your practice. If not, you document why and use an equivalent measure where one is reasonable (164.306(d)(3)).

Some of the record may sit with the vendor rather than in your systems. CISA says customers of managed services providers should make the contract require visibility into the provider’s presence, activities and connections in the customer’s systems. It also says to keep the ability to delete or change logs out of reach of remote access tools. Compare each connection against the work you approved, such as the ticket or the maintenance window.

What to put in the contract

The BAA covers the HIPAA minimum. A maintenance contract is where you set the operating details. CISA advises customers to understand exactly which security services the provider delivers and to cover anything outside that scope. It also says the contract should state how and when the provider will tell you about an incident affecting your systems. The HHS goals include vendor cybersecurity requirements as an essential goal and third-party incident reporting as an enhanced one.

The 405(d) guide adds what to check during the contract and at its end. You can ask for the vendor’s security policies, proof of staff training, background checks and risk assessments. The contract should also say how all of the vendor’s access will be removed and documented when it ends, and how patient data will be returned or destroyed. In practice, that means removing the vendor’s logins, uninstalling its remote access tools, and closing any VPN accounts it used. The checklist for taking back access when a vendor contract ends gives the order.