Answering the telehealth security questionnaire
The first security questionnaire usually arrives attached to the deal you most want: a retail partner, a pharmacy, an employer, an acquirer. It is long, it is due soon, and half of it is about vendors you do not control. This is how to answer it well, once.
Lithos StaffA telehealth security questionnaire can run to hundreds of rows, but about twenty questions decide it: audit status, policies, risk assessment, penetration testing, the BAA chain, subprocessors, data handling, access control and logging, training, breach notification, backups, vulnerability management and insurance. Answer them specifically, truthfully and with evidence, and say “in progress” when something is. Keep an answer library with an owner, evidence and review date for each answer, and a 30-hour questionnaire drops to about 6.
About twenty questions decide every security questionnaire
A telehealth security questionnaire comes down to about twenty questions. Answer them specifically, truthfully and with evidence, and keep the answers in a library so you research each one once. At eight questionnaires a quarter, that takes the load from 240 hours to 48: 30 hours each from scratch, 6 with a library.
Whether it arrives as a SIG, a CAIQ or a partner’s spreadsheet, the same questions sit underneath. Many of the hardest are about your clinical layer, and who owns those answers depends on how you built it.
| Clinical-layer rows | Built from separate vendors | On Lithos |
|---|---|---|
| BAA chain | One BAA per clinical vendor, each to confirm | One BAA, signed at onboarding |
| Subprocessors | Every vendor’s list, merged by you | Fewer vendors to list |
| Provider licensure and prescribing records | Yours to evidence across networks | Inherited from Lithos |
| Clinician insurance | Collect from each network | Malpractice, general liability and cyber insurance covering clinicians working through Lithos |
| Data export | Per vendor | Clinical and operational data exportable any time |
| Audit status | Each vendor’s report or letter | SOC 2 Type II in progress, stated as such |
The twenty questions, and what a good answer includes
Governance
| # | Question | A good answer includes |
|---|---|---|
| 1 | Audit status: SOC 2, HITRUST or equivalent? | Report type, scope, period, how it’s shared. If in progress, say which stage; never round it up to “compliant.” |
| 2 | Who owns security; what policies exist? | A named owner; written policies with last review dates |
| 3 | Last risk assessment? | HIPAA requires one. Date, method, findings tracked to closure. |
| 4 | Penetration tests? | Frequency, independent tester, remediation; share a summary letter |
Contracts and the BAA chain
| # | Question | A good answer includes |
|---|---|---|
| 5 | Will you sign our BAA? | How fast, and which clauses you can’t accept. Keep a standard business associate agreement ready. |
| 6 | Show the BAA chain. | A one-page diagram of every vendor touching PHI downstream of you, each agreement confirmed |
| 7 | List your subprocessors. | Purpose, data received, location, how you notify changes |
Question 6 is where programs get caught. The gap is rarely the clinical vendor; it’s a support, messaging or analytics tool that started receiving patient data quietly. Fewer vendors make the answer shorter, one more argument for the consolidation in what your vendor stack costs.
Data
| # | Question | A good answer includes |
|---|---|---|
| 8 | What data do you collect; where does it flow? | A data inventory, including what does and doesn’t reach marketing tools |
| 9 | How is data encrypted? | In transit and at rest, standards, key management |
| 10 | Where is data hosted? | Provider, regions, whether data leaves the country |
| 11 | How long do you retain data? | Periods by type; medical-record retention follows state law |
| 12 | Can we export our data? | How, what format, how often |
| 13 | What happens at termination? | Timeline, what’s retained by law, certified destruction |
If question 8 worries you, read HIPAA and your marketing analytics stack.
Access and operations
| # | Question | A good answer includes |
|---|---|---|
| 14 | How do users authenticate? | SSO for staff, MFA, how patient accounts are protected |
| 15 | How is access controlled? | Role-based, least privilege, joiner and leaver process, review cadence |
| 16 | Is access logged? | Views as well as changes, retention, who reviews, per-patient export |
| 17 | How is your workforce trained? | HIPAA training at hire and yearly, background checks, confidentiality terms |
| 18 | Incident response and breach notice? | A written, tested plan and the notice window you commit to |
| 19 | Backups and recovery? | Frequency, encryption, recovery objectives, last restore test |
| 20 | Vulnerabilities and code changes? | Scanning, patch windows by severity, code review, who can deploy |
On question 18: under HIPAA, a business associate must report a breach of unsecured PHI without unreasonable delay and no later than 60 days after discovery. Many contracts ask for less, so commit to the strictest window you’ve signed. Most questionnaires also ask about insurance: cyber for you, malpractice for the providers.
Each sender weighs different rows
| Sender | Weighs most | Have ready |
|---|---|---|
| Enterprise partner | BAA terms, subprocessors, access logging, notice windows | Your BAA, chain diagram, subprocessor list |
| Pharmacy | Prescription integrity, prescriber identity | How prescriptions are signed, EPCS posture |
| Acquirer or investor | Audit status, past incidents, data ownership and export | Audit report or status letter, incident log, data inventory |
Diligence asks what happened, so a clean incident log and dated policy reviews outweigh any narrative. See what investors check in diligence and the enterprise launch guide.
Be specific, current and evidenced
- Specific: “Access is role-based, reviewed quarterly and logged; the log is exportable” beats “industry best practices.”
- True today: if a control is planned, say planned. Reviewers compare answers across questionnaires and against the audit.
- Evidenced: link a policy, report, diagram or log export. “Available under NDA” is fine when the evidence exists.
Mark which answers you inherit from your clinical infrastructure, and attach its documentation.
Send us the questionnaire on your desk and we’ll go through the clinical-layer rows with you on a call, marking which answers you inherit and which stay yours. Book a call.
Build the answer library once
A spreadsheet is enough.
| Field | Why it matters |
|---|---|
| Canonical question | Matches the many phrasings |
| Approved answer | Short and long versions |
| Evidence | Link to the policy, report or diagram |
| Owner | Keeps it true |
| Last reviewed | Stale answers get noticed |
| Scope notes | Including inherited controls |
| Framework mapping | Which SIG or CAIQ items it answers |
Triage each questionnaire against the library. Send new questions to their owner, route commitments through legal, and add the approved answer back. Review answers quarterly and whenever a subprocessor, audit milestone or architecture changes.
Then publish a short security page so partners see the top answers before the spreadsheet arrives.
Lithos is the licensed clinical layer under your program, so many clinical answers are inherited: a BAA at onboarding, HIPAA compliance, data exportable any time, and insurance covering clinicians working through Lithos. Our SOC 2 Type II audit is in progress, and we say so. Send us your questionnaire and we’ll answer it in writing, or scope a pilot with security review built in. Start with the security page, then book a call.
Frequently asked questions
What is in a telehealth security questionnaire?
It asks about your security program and audit status, your BAAs and subprocessors, how protected health information is stored, encrypted, retained, exported and deleted, who can access it, how incidents are handled, backups, vulnerability management and insurance. Some arrive as a SIG or CAIQ; others are a partner’s own spreadsheet.
How should a telehealth company answer if its SOC 2 isn’t complete?
Say so plainly: which report you are pursuing, its scope, where the audit stands and how you will share it. Then show the controls that operate today, such as policies, access reviews, logging and incident response. An honest in-progress answer with evidence beats a vague claim of compliance.
What is a BAA chain?
A BAA chain is the series of business associate agreements that follows protected health information from the covered entity through every vendor that handles it. Each link needs an agreement with equivalent protections, and partners ask you to show the whole chain.
How long does a business associate have to report a HIPAA breach?
Under HIPAA, a business associate must notify the covered entity of a breach of unsecured protected health information without unreasonable delay and no later than 60 days after discovery. Many partner contracts set a shorter window. Your incident response plan should meet the strictest window you have signed.
What is a security answer library?
A security answer library is a maintained set of approved answers to the questions you are asked repeatedly, each with an owner, evidence link, last-review date and scope notes. It turns a new questionnaire into matching and review instead of research.
Get the Journal by email
Our best guides on building compliant telehealth programs — a couple a week, unsubscribe any time.
Put a medical practice behind your product
Book a call and we'll scope your program together, or get free sandbox access and start building.