Vendor and Third-Party Risk Management

What this entry covers

Vendor and third-party risk management is a topic, not a single framework. In US healthcare, the HIPAA Privacy and Security Rules require covered entities to obtain satisfactory assurances, through a business associate contract or other arrangement, from business associates that handle protected health information, and NIST SP 800-161 Rev. 1 gives guidance on cybersecurity supply chain risk management for systems and organizations.

MyRHC indexes this framework so practitioners, auditors, and automated agents can find the authoritative primary sources in one place. This page is a navigation aid. It is not legal advice and is not a substitute for the official text.

Official documentation

• Primary official source: https://www.hhs.gov/hipaa/for-professionals/security/guidance/index.html
• HIPAA Security Rule, business associate contracts (45 CFR 164.308(b)): eCFR
• NIST SP 800-161 Rev. 1, Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations: csrc.nist.gov

Recent changes

• 2024-11-01: NIST updated SP 800-161 Rev. 1 (originally May 2022). NIST CSRC

How to use this index entry

1. Open the official link above (or the agency home if the deep link drifts).
2. Confirm edition / revision date against your program scope.
3. Map applicability by sector and jurisdiction listed in the metadata.
4. Follow related frameworks only after checking their own official sources.

Disclaimers

• MyRHC does not host proprietary standards text (ISO, some industry bodies).
• Where standards are paywalled, we link to the publisher’s catalog page.
• Always verify current requirements with counsel and the issuing authority.