Your healthcare practice depends on outside technology. Have you evaluated the risk?

A medical practice may rely on one company to host its electronic health records, another to process laboratory orders, and several others to handle scheduling, billing, communications, and data storage.

Each provider supports a different part of daily operations. When a service experiences a cybersecurity incident or extended outage, the practice may need to respond even though the problem originated outside its own network.

That makes third-party cybersecurity risk an important part of healthcare IT management.

A healthcare technology vendor risk assessment helps an organization understand which providers handle sensitive information, which services are essential to operations, what security safeguards are in place, and how the practice would respond to a disruption.

For practice administrators, the starting point is understanding the relationships that already exist.

A recent laboratory system incident highlights third-party dependencies

On October 22, 2026, Quest Diagnostics disclosed in a filing with the U.S. Securities and Exchange Commission that it had discovered unauthorized access to its Quanum Lab Services Manager system the previous day.

The system allows certain clients to place laboratory orders and access test results.

Quest reported that it believed certain patient records had been accessed. At the time of the filing, the investigation was ongoing, and the company stated that the incident had not materially disrupted its operations or ability to serve patients.

The disclosure illustrates a concern for healthcare practices that depend on outside systems: an incident involving a technology provider can raise questions about information security, service availability, and responsibility for responding.

For practice leadership, the useful exercise is to identify which services are important to patient care and business operations, then determine how the organization would handle an incident involving one of those providers.

Identify the technology vendors your practice depends on

Vendor risk assessments become more useful when a practice understands which services are essential to its operations.

That includes providers managing sensitive information and providers whose systems are necessary for employees to complete important work.

Consider a hypothetical outpatient practice that relies on a cloud-based electronic health record system, an outside laboratory platform, a billing provider, and a managed network service.

Each relationship creates different dependencies.

The electronic health record vendor may support access to clinical documentation. The laboratory platform may support ordering and retrieving results. The billing provider may process patient and payment information, while the network service supports access to several applications.

An inventory should identify the provider, the service delivered, the type of information involved, and the person responsible for the relationship.

These are illustrative examples. The appropriate assessment depends on the practice's technology environment.

An inventory also helps identify relationships that have expanded over time. A vendor originally approved for a limited service may now have additional integrations, access permissions, or responsibilities.

Those changes may require another review.

Evaluate vendor access to patient information and critical systems

A provider's cybersecurity risk depends partly on what information and systems it can access.

A software vendor handling protected health information presents different considerations from a supplier that does not access sensitive data.

Technical access also matters. An IT provider with administrative access to servers or cloud accounts may create a significant security dependency, even if its primary service is unrelated to clinical applications.

Healthcare organizations should understand the following:

• Which categories of sensitive information the vendor handles.
• Whether the vendor accesses systems directly or through an integration.
• Who can authorize, change, and revoke vendor access.
• Whether appropriate security controls protect access.
• How the vendor reports relevant security incidents.

These reviews should be proportionate to the relationship.

A provider supporting a critical clinical function or handling substantial sensitive information may require more detailed evaluation than a vendor with limited access and minimal operational impact.

Consider HIPAA responsibilities

Healthcare organizations should evaluate their vendor relationships under applicable privacy and security requirements.

For example, when a vendor qualifies as a business associate under HIPAA, the covered entity generally needs an appropriate business associate agreement and must address relevant regulatory responsibilities.

The presence of a contract or business associate agreement does not establish that every technical security risk has been evaluated.

Organizations should also review how the vendor's safeguards, access arrangements, and incident procedures affect their own risk-management program.

Understand the operational impact of a vendor outage

A vendor can present significant operational risk even when the immediate concern does not involve unauthorized access to patient information.

An unavailable scheduling platform may interrupt appointment management. A laboratory integration problem may require staff to use alternate ordering procedures. An outage involving a cloud application could affect multiple departments.

The organization should understand how long it can operate without the service and what alternate procedures are available.

For each important provider, consider:

1. Which activities would be affected if the service became unavailable?
2. Can employees continue essential work using another approved method?
3. Are downtime procedures documented and accessible?
4. Who is responsible for contacting the vendor and coordinating the response?
5. How will the practice verify that normal operations can safely resume?

These discussions should include operational leadership and the employees who depend on the service.

For example, an IT team may understand how to restore network access, while clinical personnel are better positioned to explain which workflows require immediate alternatives.

Both perspectives are necessary when planning for a disruption.

Review security and incident-response responsibilities before problems occur

Vendor contracts and service agreements should help clarify responsibilities before an incident requires action.

Healthcare administrators should understand which organization manages the relevant systems, who investigates security concerns, and how the practice will receive information about a problem.

The HHS Healthcare and Public Health Cybersecurity Performance Goals specifically address vendor and supplier cybersecurity requirements.

The voluntary goals also encourage processes for receiving and responding to third-party vulnerability disclosures and incident reports.

These recommendations can help healthcare organizations examine whether their current vendor-management practices are sufficiently developed.

A practical review should cover:

• Security responsibilities assigned to the vendor and the healthcare organization.
• Contractual notification and communication procedures.
• The process for reporting suspected cybersecurity incidents.
• Support and escalation contacts.
• Available contingency and recovery arrangements.
• Procedures for terminating access when a relationship ends.

Notification obligations and timing depend on applicable law, contracts, and the circumstances of the incident.

A practice should not assume that every cybersecurity event involving a vendor creates identical reporting responsibilities.

It should have a process for determining what information is needed, who evaluates the incident, and which obligations may apply.

Include third-party systems in your incident-response planning

An incident-response plan should address problems affecting services the practice relies on, including those operated by outside providers.

Consider a hypothetical incident involving an external laboratory system.

The practice might need to determine whether its own systems remain secure, whether alternative ordering procedures are necessary, and how employees should communicate about temporary changes.

Those questions require coordination across IT, operations, and clinical staff.

An incident-response exercise can help leadership test how that coordination would work.

For example, the organization might simulate a scenario in which an important vendor announces unauthorized access to its system and temporarily restricts customer access.

During the exercise, the team could evaluate whether it can identify the affected service, reach the correct vendor contact, follow appropriate downtime procedures, and document its decisions.

The exercise does not need to assume that a breach of the vendor automatically means the practice's own systems have been compromised.

Its purpose is to prepare staff to assess the circumstances and respond appropriately.

Keep vendor reviews current as technology changes

Healthcare technology relationships rarely remain static.

A provider may introduce new features, change its hosting arrangements, expand integrations, or alter the way information is processed.

The practice may also begin using the same vendor for additional services.

Material changes can affect the original assessment.

Rather than treating vendor risk management as a document completed during procurement, healthcare organizations should establish review practices that reflect each relationship's importance and risk.

A review may be appropriate when:

• The vendor begins processing new categories of sensitive information.
• An integration introduces additional system access.
• The service becomes critical to an important operation.
• A significant security incident or unresolved vulnerability is disclosed.
• The vendor makes a material change to its service or delivery model.

The organization should document significant findings, decisions, and any necessary follow-up work.

That record helps administrators understand why a relationship was approved, which risks were identified, and whether important concerns remain unresolved.

A practical starting point for healthcare vendor risk reviews

A healthcare organization can begin by selecting its most important outside technology providers and documenting a few details for each.

This information provides a starting point for deciding where more detailed evaluation may be appropriate.

A practice with limited internal IT resources may need assistance connecting vendor reviews to broader cybersecurity risk assessments, access management, and recovery planning.

Supporting healthcare cybersecurity and vendor-risk management

AvTek Solutions provides cybersecurity and IT support for healthcare organizations, including assistance with risk identification, security planning, and the systems supporting daily operations.

Through vCISO Services, AvTek helps organizations evaluate cybersecurity risks, review security policies and incident-response plans, discuss third-party risks, and establish remediation priorities.

AvTek's Managed IT Services support infrastructure management, security monitoring, and technology planning. Its Data Backup and Disaster Recovery Services help organizations prepare for data loss and technology disruptions.

For healthcare practices, these services can support a more coordinated approach to managing internal IT risks and understanding dependencies on outside technology providers.

A cybersecurity assessment can help identify gaps and establish priorities. It does not guarantee protection against vendor incidents or replace the organization's own legal, regulatory, and contractual responsibilities.

Review the dependencies before the next incident

Most healthcare practices already understand which vendors they use. Fewer may have reviewed how each relationship affects cybersecurity and the continuity of essential services.

Start with providers supporting patient records, laboratory services, scheduling, billing, and critical IT infrastructure. Identify the information they handle, the operations that depend on them, and the procedures your team would follow if something went wrong.

That review can help prioritize improvements to vendor oversight, incident response, and recovery planning.

Talk with AvTek about healthcare technology risk

If your practice needs help evaluating cybersecurity risks, reviewing third-party technology dependencies, or strengthening incident-response planning, AvTek can help identify gaps and establish practical next steps.

Talk with AvTek about your healthcare cybersecurity risk management.