What US rules expect of you when a vendor's breach exposes your data
Rules like HIPAA and the FTC Safeguards Rule make covered businesses oversee vendors. Two enforcement actions faulted skipped vetting, contracts or monitoring.
When a vendor’s breach exposes data you’re responsible for, the rules that require vendor oversight look at what you did before the breach. Those are sector rules, and they make oversight a duty of the businesses they cover: choose a capable vendor, bind it by contract, and keep checking on it. In the two public actions described below, regulators faulted the hiring company for steps it skipped, even though the data was exposed at the vendor. This article describes the rules and those actions. It doesn’t say whether you are liable in a given case; that is for your lawyer.
The rules that can reach you
Sector rules, state breach notice laws and your contract each decide part of what’s expected of you after a vendor’s breach. Which ones apply depends on your sector, your data and where the affected people live.
| Framework | What it says about a vendor’s failure |
|---|---|
| FTC Safeguards Rule, 16 CFR 314.4(f) | Covered financial institutions must select capable providers, require safeguards by contract and assess providers periodically. The FTC enforces the rule under the FTC Act (15 U.S.C. 6805(a)(7)) |
| SEC Regulation S-P, 17 CFR 248.30(a)(5) | Covered firms need policies for overseeing providers through due diligence and monitoring. Even when a provider sends breach notices for you, the duty to make sure people are notified “rests with the covered institution” |
| HIPAA, 45 CFR 160.402(c)(1) and 164.504(e)(1)(ii) | You can face a civil money penalty for a violation based on the act of your agent acting within the scope of the agency. An agent can include a business associate; whether one is your agent is judged under the federal common law of agency. If you knew of a pattern of activity by the vendor that materially breached its agreement, you must take reasonable steps to fix it or, if those fail, end the contract where feasible |
| State breach notice laws, such as New York General Business Law 899-aa | A vendor that keeps data it doesn’t own must tell the owner of a breach (899-aa(3)). The owner then notifies the affected residents (899-aa(2)) |
The FTC Act reaches businesses outside the sectors above too. It declares “unfair or deceptive acts or practices in or affecting commerce” unlawful (15 U.S.C. 45(a)). Banks, common carriers and a few other kinds of business are outside the FTC’s reach under that section. The Act itself says nothing about vendors. The FTC’s business guide Start with Security, drawn from its enforcement actions, tells businesses to choose service providers able to keep appropriate security. It also says to put security standards in the contract and to verify compliance.
The vendor answers for its own conduct too. HIPAA’s Security Rule applies to business associates directly (45 CFR 164.302), and HHS can penalize a business associate as well as a covered entity (160.402(a)). The California Consumer Privacy Act (CCPA) draws a line between the two. Say a business gives data to a service provider in compliance with the CCPA, and the provider then breaks the law’s restrictions. The business isn’t liable under the CCPA for that (Civil Code 1798.145(i)(1)). The condition is that, when it gave the data, it had no actual knowledge or reason to believe the provider intended it. The provider stays liable for its own violations. But the CCPA regulation adds that whether you did due diligence factors into whether you had reason to believe. A business that never enforces its contract or uses its audit rights may not be able to rely on that defense (11 CCR 7051(c)).
Your contract is the last piece. Bank guidance lists indemnification and limits on liability among contract topics. It says indemnification terms may reduce the bank’s exposure to claims arising from the vendor’s misconduct. It suggests checking whether the limits are in proportion to the loss the bank could suffer. It also suggests a term stating the vendor’s liability for its subcontractors.
What two public enforcement actions faulted
In a December 2020 settlement, the FTC alleged that a data analytics company serving the mortgage industry violated the Safeguards Rule. According to the complaint, the company hired a vendor to scan mortgage documents. Its own policy required vetting the vendor’s security, but it took none of those steps. Its vendor contracts did not specify the safeguards vendors had to keep. The vendor then misconfigured its cloud storage. For about a year, the personal data of tens of thousands of people sat open to anyone online. The settlement order requires a data security program, independent assessments every two years and a yearly certification by a senior executive.
In September 2022, the SEC settled charges that a financial firm violated Regulation S-P’s Safeguards and Disposal Rules. The firm had hired a moving and storage company with no experience in data destruction to retire thousands of hard drives and servers holding customer data. According to the SEC’s order, the firm did not properly monitor the vendor’s work over several years. Some of the devices were later resold online with the data still on them. The SEC said about 15 million customers were affected. The firm agreed to pay $35 million without admitting or denying the findings.
| What the agency alleged or found | Mortgage data analytics company (FTC) | Financial firm (SEC) |
|---|---|---|
| Checking the vendor before hiring | Did not vet the vendor’s security, despite its own policy | Hired a vendor with no data destruction experience |
| Contract terms | Contracts did not specify the safeguards vendors had to keep | Not described in the press release |
| Monitoring after hiring | Its risk assessments did not cover this vendor | Did not properly monitor the vendor’s work for several years |
In both cases, as the agencies described them, the data was exposed at the vendor. The allegations and findings were about what the hiring company did or didn’t do to check on the vendor.
Where account access fits
For covered financial institutions, the FTC rule’s access controls and activity logging cover “authorized users” (16 CFR 314.4(c)). The rule defines them to include contractors and agents as well as employees (314.2). So what the vendor’s staff do in your systems is part of what you must monitor and log. If they all sign in with one shared login, your logs can’t tell one of them from another. Why oversight runs through the logins you hand over is covered in What is vendor oversight? The ways to hand them over are compared in Letting a vendor use your company’s accounts.
Questions to ask your lawyer
- Which of these rules covers us, and for which data and which vendors?
- Does our contract say who pays for breach notices, investigations and claims after a vendor’s breach?
- Are the contract’s limits on liability in proportion to the loss we could suffer?
- Does the contract make the vendor answer for its subcontractors?
- Can we show the vetting, contract terms and periodic checks the rules expect, for each vendor that touches covered data?
- After a breach, who notifies affected people, and by when, under the laws of the states where they live?
This article is not legal advice.
Frequently asked questions
Can we be penalized for a breach our vendor caused?
The rules covered here make vendor oversight a duty of the businesses they cover. In two public cases, regulators faulted the hiring company for skipped vetting, weak contract terms or no monitoring. Ask your lawyer about your own case.
Does a HIPAA business associate answer for itself?
Yes. The Security Rule applies to business associates directly (45 CFR 164.302), and HHS can impose civil money penalties on a business associate that violates the rules (160.402(a)).
Does an indemnity clause protect us?
Bank guidance says indemnity terms may reduce your exposure to claims from a vendor's misconduct. Under Regulation S-P, making sure people are notified still rests with the covered firm even if the vendor sends the notices.
Does this article cover lawsuits for damages?
No. It covers rules and public agency actions only. Private lawsuits and what a court might award are outside its scope. Ask your lawyer.
How Junify handles this
- Doing this by hand
- You keep a list of which vendor staff use which of your accounts, shut off access every time a contract ends or a person changes, and keep checking how the vendor uses them.
- With Junify
- When a vendor's staff use your company's web accounts through Junify, they never receive the password, and Junify records who used which account and when, person by person, on your side. That gives you your own record of the vendor's use to show what you checked, instead of relying only on the vendor's reports. When the work ends, you remove their access in Junify.
Sources
- 15 U.S.C. 45, Unfair methods of competition unlawful; prevention by Commission (FTC Act), govinfo
- FTC, Start with Security, A Guide for Business (August 2023)
- 16 CFR Part 314, Standards for Safeguarding Customer Information (FTC Safeguards Rule), eCFR
- 15 U.S.C. 6805, Enforcement (Gramm-Leach-Bliley Act), govinfo
- 17 CFR 248.30, Regulation S-P, procedures to safeguard customer information, eCFR
- 45 CFR 160.402, Basis for a civil money penalty (HIPAA), eCFR
- 45 CFR 164.302, Applicability (HIPAA Security Rule), eCFR
- 45 CFR 164.504, Uses and disclosures, organizational requirements (HIPAA Privacy Rule), eCFR
- California Consumer Privacy Act of 2018, Civil Code 1798.100 ff. (effective January 1, 2026), California Privacy Protection Agency
- California Consumer Privacy Act Regulations, 11 CCR 7050 and 7051 (effective January 1, 2026), California Privacy Protection Agency
- New York General Business Law 899-aa, Notification; person without valid authorization has acquired private information, New York State Senate
- Interagency Guidance on Third-Party Relationships, Risk Management, 88 FR 37920 (June 9, 2023), Board, FDIC and OCC
-
Checklist for taking back access when a vendor contract ends
Work in this order. List the vendor's accounts, disable its users, change shared passwords, check the login records, and get written confirmation of deletion.
-
How to write the account questions in a vendor security questionnaire
Name the accounts you gave the vendor and ask who checks each answer, how often and against what record. Tie each question to a rule and check the answers.
-
What your vendor contract should say about accounts
Write four account clauses: who may use your accounts, no sharing beyond named staff, records and incident notice, and shutdown and deletion at the end.