What is subcontracting?
- Term
- Subcontracting
- Meaning
- Subcontracting is when your vendor passes part of your work to another firm or person. HIPAA and the CCPA make the vendor bind that party by written contract.
Subcontracting is when a vendor you hired passes all or part of the work it does for you to another company or person. A freelancer the vendor brings in counts too, unless that person works under the vendor’s direct control the way its own staff do. For you, it means your accounts and data can reach someone you never signed a contract with. Your contracts may use another word for the same party, such as subprocessor.
Who counts as a subcontractor?
HIPAA gives the clearest definition. A business associate is a vendor that handles health information for you. HIPAA defines a subcontractor as “a person to whom a business associate delegates a function, activity, or service, other than in the capacity of a member of the workforce of such business associate” (45 CFR 160.103). So the vendor’s employees, and anyone else working under its direct control, are its workforce and not subcontractors. An outside firm the vendor hires is a subcontractor, and so is a freelancer who works independently. The chain continues: a subcontractor that handles health information for the vendor is itself a business associate under the same definition, and so is its own subcontractor.
The California Consumer Privacy Act (CCPA) describes the same relationship without naming it. It covers a service provider or contractor that engages “any other person” to help process personal information for your business purpose. It also covers any person engaged further down the line (Civil Code 1798.140(ag)(2) and (j)(2)). Banking guidance takes the widest view. The 2023 Interagency Guidance on Third-Party Relationships uses “subcontractors” for any suppliers, service providers or other organizations your vendor enlists.
What do the rules ask of the vendor and of you?
| Rule | What it puts on the vendor | What it leaves to you |
|---|---|---|
| HIPAA, 45 CFR 164.502(e)(1)(ii), 164.504(e)(5) and 164.308(b)(2) | Get written assurances from the subcontractor, in a contract with the same terms a business associate agreement needs | Your business associate agreement must require the vendor to make subcontractors agree to the same restrictions (164.504(e)(2)(ii)(D)). You don’t need assurances from the subcontractor yourself (164.502(e)(1)(i)) |
| CCPA, Civil Code 1798.140(ag)(2) and 11 CCR 7051(b) | Notify you of the engagement, and bind the subcontractor by a written contract that meets the CCPA’s contract terms | The CCPA puts the duty to notify on the vendor; when the notice arrives is for your contract to settle |
| Interagency Guidance on Third-Party Relationships (banks) | Nothing directly; the guidance is addressed to banks | Decide in the contract when and how you hear about subcontractors, which ones you prohibit, and whether subcontracting needs your consent |
In each case, the subcontractor’s duties reach you through the vendor. You may never sign anything with the subcontractor, yet it can be working in your systems.
Why does subcontracting matter for account access?
Your login records show the user or shared login someone signed in with, not who that person works for. If a subcontractor’s worker uses a user you created for the vendor’s staff, or a shared login the vendor passed on, your records show the vendor’s name. You learn about the subcontractor only if the vendor tells you.
So the vendor’s notice of a subcontractor is the place to ask which of your accounts its people will use. How to build that notice into your routine, and how to check it against your own records, is in How to see which subcontractor workers use your accounts. The oversight duty behind it is explained in What is vendor oversight?
Frequently asked questions
Is a freelancer our vendor brings in a subcontractor?
Under HIPAA's definition, yes, if the vendor hands that person part of the work and the person is not on the vendor's own workforce. The CCPA's notice rule covers "any other person" the vendor engages to help process your data.
Do we need our own contract with the subcontractor?
Under HIPAA, no. The vendor gets the written assurances from its subcontractor. Your business associate agreement must require the vendor to bind its subcontractors to the same restrictions.
Can we forbid subcontracting?
Yes, by contract. Bank guidance suggests the contract may require your consent before any subcontracting and may name subcontractors you don't allow. HIPAA and the CCPA don't ban it; they make the vendor bind the subcontractor.
Will our login records show the subcontractor?
Usually not. They show the vendor's user or the shared login the subcontractor's people signed in with. You learn about the subcontractor only from the vendor.
How Junify handles this
- Doing this by hand
- You keep a list of which vendor staff use which of your accounts, shut off access every time a contract ends or a person changes, and keep checking how the vendor uses them.
- With Junify
- With Junify, your admin adds each person who works in your accounts, including people at a subcontractor, and assigns only the accounts they need. Nobody gets the password, so the vendor has no password to pass on. Junify records who used each account and when, person by person, on your side. When the subcontractor's work ends, you remove those people's access in Junify.
Sources
- 45 CFR 160.103, Definitions (HIPAA), eCFR
- 45 CFR 164.502, Uses and disclosures of protected health information, general rules (HIPAA Privacy Rule), eCFR
- 45 CFR 164.504, Uses and disclosures, organizational requirements (HIPAA Privacy Rule), eCFR
- 45 CFR 164.308, Administrative safeguards (HIPAA Security Rule), eCFR
- California Consumer Privacy Act of 2018, Civil Code 1798.100 ff. (effective January 1, 2026), California Privacy Protection Agency
- California Consumer Privacy Act Regulations, 11 CCR 7050 and 7051 (effective January 1, 2026), California Privacy Protection Agency
- Interagency Guidance on Third-Party Relationships, Risk Management, 88 FR 37920 (June 9, 2023), Board, FDIC and OCC
-
Checklist for taking back access when a vendor contract ends
Work in this order. List the vendor's accounts, disable its users, change shared passwords, check the login records, and get written confirmation of deletion.
-
How to write the account questions in a vendor security questionnaire
Name the accounts you gave the vendor and ask who checks each answer, how often and against what record. Tie each question to a rule and check the answers.
-
What your vendor contract should say about accounts
Write four account clauses: who may use your accounts, no sharing beyond named staff, records and incident notice, and shutdown and deletion at the end.