# 21. What should healthcare organisations check before buying a HIPAA-oriented GRC platform?

Check whether the platform supports your risk-analysis and remediation process, and determine whether it will handle electronic protected health information. HHS explains that risk analysis informs the selection of safeguards; its cloud guidance also states that a cloud provider maintaining ePHI on behalf of a covered entity or business associate can itself be a business associate, even without the decryption key. [Security Rule summary](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html) · [Cloud guidance](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/laws-regulations/index.html))

Our recommended procurement questions are:

- Can the programme operate with redacted evidence and metadata rather than patient-level information?
- If ePHI is involved, does the contracting arrangement include the required business associate agreement and cover the intended service?
- Which subprocessors and AI functions can receive the information?
- Can evidence be segregated by facility, entity and role?
- Can findings be linked to remediation, ownership and reassessment?
- Can records be retrieved and retained appropriately during termination?

Do not treat a “HIPAA-ready” marketing description as an HHS endorsement: HHS expressly says it does not endorse, certify or recommend specific technology products. [Cloud guidance](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/special-topics/health-information-technology/cloud-computing/index.html))

Also distinguish proposed changes from effective requirements. The HHS Security Rule rulemaking page reviewed describes an NPRM and states that the current Security Rule remains in effect during the rulemaking. Keep proposed capabilities on a separately labelled change backlog until applicability and effective dates are confirmed. [HHS rulemaking page](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html). ([hhs.gov](https://www.hhs.gov/hipaa/for-professionals/security/hipaa-security-rule-nprm/index.html))