Utah MGMA 2026 Fall Leadership Conference –
Medical Practice Vendor Safeguard Kit
Practical tools for asking better vendor security questions. Use these resources when a vendor handles patient information, connects to systems your practice depends on, or could affect patient care and operations if something goes wrong.
Resources
Everything from our booth, plus the editable files. Nothing here requires a signup or sends vendor responses to Intuitive IT.
Vendor Cybersecurity & HIPAA Due-Diligence Questionnaire
Send this 12-question form to a vendor before onboarding, renewal, or a major change in the service. The fillable PDF is the simplest option for most vendors. Use the Word version when your practice needs to customize the form first.
Word version password: UMGMA2026
You do not need it to fill the form in — the answer fields are
open either way. The rest of the document is locked so the questions
cannot be changed by accident while a vendor is completing it. Use
the password if your practice wants to add its own branding or reword
anything first.
Version 2.3 · August 2026
BAA Essentials Reference
A plain-language reference for the main topics to look for when reviewing a Business Associate Agreement (BAA), plus other contract terms that may matter based on the service and risk.
Version 2.3 · August 2026 · 2 pages
Medical Practice Vendor Safeguard Kit
The full printed guide from our booth. Walks through all 12 questions with what a strong answer looks like, where to dig deeper, and the red flags worth resolving before you move forward.
Version 2.3 · August 2026 · 16 pages
No signup required. These resources are designed for practices to use directly with their vendors. Vendor responses stay between the practice and the vendor unless the practice chooses to share them.
Primary source library
Want to see the underlying guidance? These links go directly to the healthcare and cybersecurity sources used to build and verify the materials.
View primary sources and cybersecurity references
Current HIPAA requirements and HHS guidance
- HHS/OCR — The HIPAA Security Rule
- HHS/OCR — Summary of the HIPAA Security Rule
- HHS/OCR — Business Associates
- HHS/OCR — Sample Business Associate Agreement Provisions
- HHS/OCR — Breach Notification Rule
- HHS/OCR — Guidance on Risk Analysis
- HHS/OCR — Guidance on HIPAA & Cloud Computing
Healthcare cybersecurity guidance
- HHS — Healthcare and Public Health Cybersecurity Performance Goals
- HHS — Health Industry Cybersecurity Practices (HICP)
Additional cybersecurity references
- Center for Internet Security — CIS Controls v8.1
- NIST — Cybersecurity Framework 2.0
- NIST — Digital Identity Guidelines: Authentication and Authenticator Management
- NIST — Cybersecurity Supply Chain Risk Management Quick-Start Guide
- NIST — Cybersecurity Supply Chain Risk Management: Due Diligence Assessment Quick-Start Guide
Proposed HIPAA Security Rule changes
Current-rule note: HHS states that the existing HIPAA Security Rule remains in effect while the proposed rulemaking is underway.
Questions?
If something here needs explaining, our team is happy to help — no obligation and nothing to sign up for.
- Phone (385) 312-1900
- Web IntuitiveITS.com