How do you choose a healthcare QA vendor?

What are you actually comparing?

The answers you get back. Every supplier that intends to take this work signs materially the same agreement, because the promises inside it were written by the regulator: ten of them at 45 CFR 164.504(e)(2)(ii) on the privacy side, three more at 164.314(a)(2)(i) for electronic records. That document is taken apart clause by clause under outsourced healthcare QA, and reading four copies of it side by side is an afternoon that produces almost no signal.

What the rule leaves open is where the difference lives, and there is more of it than a first-time buyer expects. 45 CFR 164.504(e) obliges no business associate to be audited, certified, insured or security tested. The only inspection obligation among the ten runs to the Secretary of Health and Human Services at (e)(2)(ii)(I), which is not an audit right for you. And the section states no notification deadline of its own. A shortlist of suppliers who all sign the agreement is therefore a shortlist on which every candidate has promised the same sentences.

Put the same questions to us and the answers are at how we work with protected health information. Read them the way this page asks you to read anybody's: an answer either names something you could check later, or it does not. Whether the rule reaches your own product at all is the prior question, and it is taken apart at does your app need HIPAA testing.

Why do the quotes differ by so much?

Because the suppliers priced different jobs. Three variables move the number more than any hourly rate does, and all three are yours to fix before you ask anyone for a price.

The first is what is in scope: which systems, which builds, which interfaces, and which standards the results have to answer to. The second is the data the work runs on. Records that meet 45 CFR 164.514(a) and (b) sit outside the Privacy Rule altogether under section 164.502(d)(2), so an engagement that can run on them avoids an approval chain that work over real records has to walk through, and the difference shows up in the schedule as well as in the price. The third is what you need at the end. Test evidence, a requirements trace and an auditor-facing report are separate pieces of work, and a supplier who assumed you wanted the first one only has quoted a smaller job than the supplier who assumed all three.

Write those three down once and send the same page to every supplier. The validation scope estimator produces a version of that list you can attach to a request. Until every proposal answers the same page, the cheapest one is cheap for a reason nobody has written down.

How do you weigh an answer once you have it?

By asking whether anybody could check it in a year. A supplier's answer is worth what it would be worth in a dispute, and most of the reassuring ones are worth nothing at all. The table below is the form of that test, and it is worth running against this website as well as against anyone else's.

Six reassurances a healthcare QA supplier may give, why each is not yet checkable, and the evidence or contract term that makes it an answer.

What a supplier says	Why it is not yet an answer	What turns it into one
"We are HIPAA compliant"	HHS OCR certifies no person and no product as HIPAA compliant, and recognises no private certification about the Security Rule	Which safeguards were put under test, against which build, and what came back from each one
"We use anonymised data"	Two different methods produce two different documents, and a limited data set produces neither	Whether it is safe harbor at 164.514(b)(2) or expert determination at 164.514(b)(1), and which document you get
"We sign a BAA"	Its contents are set by 164.504(e)(2)(ii) and 164.314(a)(2)(i), identically for every supplier	The redlines: the reporting window, the subcontractor list, the permitted uses clause
"Our engineers are all in-house"	No term of the rule produces that statement or tests it	The same sentence inside the contract, naming the employer and the working location
"We are ISO certified"	ISO is a family of standards, so the claim names nothing	The standard number, the certification body, the certificate number, and a page on the issuer's domain where it resolves
"We report any breach promptly"	164.410(b) allows 60 calendar days from the supplier's own discovery	A shorter number, a named recipient, and the incident wording from 164.314(a)(2)(i)(C) as well as the breach wording

Three of those rows share a mechanism. An assurance that lives only in a conversation grants you nothing, because 45 CFR 164.502(a)(3) confines a business associate to the uses and disclosures its contract or the law permits. The rule hands it no independent permission, and it hands you no independent guarantee. The practical test is cheap: take the answers you liked most, ask for each one as contract language, and see which of them come back.

The subcontractor row deserves its own sentence, because it is the one where your paperwork stops. Under section 164.502(e)(1)(i) your duty to obtain satisfactory assurance ends at your own supplier, because the same paragraph says a covered entity is not required to obtain assurances from a business associate that is a subcontractor, and 164.308(b)(2) puts the equivalent duty on that supplier for anyone it passes the data to. You will therefore never hold a contract with the party that may end up holding your records. The current list of those parties, and the supplier's willingness to keep it current, is one of the few things on the shortlist that genuinely separates two proposals.

What do you do about a question nobody will answer?

Three things, and choosing among them deliberately is the whole of the exercise.

Drop the criterion and write down that you dropped it. That is a defensible position when the risk it covered is small, and it is only defensible if the reasoning exists somewhere a reader can find it later.

Convert it into a term with a consequence attached. A supplier who will not describe its access procedure may still accept a clause obliging it to notify you when a named person joins or leaves the project, and a clause is enforceable in a way a description is not.

Or shrink the question until it stops mattering. An engagement seeded entirely from de-identified records asks less of the answers about access and residency, because the material inside the environment is outside the Privacy Rule under 164.502(d)(2). That route costs something to build and it removes a whole column of the comparison.

When do you ask, and in what order?

Before an environment exists, and before the price conversation, because two of these questions change the price and the rest change the contract.

Step 6 is the one a chief executive should not delegate. A testing engagement produces evidence, and evidence that does not fit the file you are building has cost you the money and left the gap where it was.

What changes if your product is a regulated device?

Your choice of supplier stops being a private commercial decision and becomes a record somebody else reads. FDA's computer software assurance guidance shows what such a record looks like. Section V.A(5) counts established purchasing controls for selecting and monitoring software vendors as a control a manufacturer can lean on instead of repeating the work, and states that where an item carries lower risk, the assurance a vendor's own practices already provide can be the whole of what is needed. Four routes to that assurance are named. One is an onsite audit, which the guidance itself concedes may be neither feasible nor appropriate. The other three are documentary: the accreditations and certificates the vendor holds, including Service Organization Controls reports; what it can show about its development, quality assurance and cybersecurity work; and how it handles data integrity, from record retention through encryption to access control.

Appendix A, Example 1 of the same guidance shows the finished evaluation being weighed against whatever procedure the manufacturer already keeps for evaluating its suppliers, then filed under purchasing control procedures. Two consequences follow for a buyer. The first is that your own procedure decides what a sufficient evaluation looks like, so the supplier comparison has a format before it has candidates. The second is that the evaluation is a document with a date, which means the version of it written after signature is worth less than the version written before. How the guidance changes the effort you owe elsewhere is worked through on FDA's computer software assurance guidance.

That list was written about software vendors, and it reaches a testing supplier at the point where the supplier brings its own tooling into your validated environment. Ask which tools those are while the proposals are still open, because each one lands in the same purchasing record.

The supplier you pick this quarter is usually still on the project when a second regulator reads the same file. If Europe is on the roadmap, ask now which of the European documents each supplier has worked to, instead of discovering the answer while the technical documentation is being assembled: what that market entry demands of a test programme is set out at testing a product for EU market entry.

How do we answer the questions on this page?

We sign a Business Associate Agreement before any engagement that touches PHI. We do not need production PHI to test. Environments run on synthetic and de-identified data. What belongs to your project stays inside your own systems, and the work runs against environments you control. The location of the team is part of the engagement terms and is agreed before the contract.

We test against the requirements in these standards and prepare the artefacts an auditor asks for. Compliance itself is held by the organisation that ships the product. Nothing a supplier signs moves that, and a proposal that claims otherwise has answered a question you did not ask. This site lists no certificate, so the ISO row in the table above has nothing on it for you to verify here.

Two of the questions on our own security page carry no published answer: who builds a test environment and who can reach it, and what an engineer passes before joining a project. If either is on your list, ask us for it in writing, and weigh the reply on the same test as everyone else's.