Most outsourcing vendors that serve healthcare and fintech list HIPAA, PCI DSS, or SOC 2 on their websites, and in a sales deck, a mature compliance program and a thin one look much the same. The difference shows up after an incident. Your contract gives you recourse against a vendor that falls short, but the duty to notify patients and regulators, and to show that you vetted the vendor, stays with you.
Incidents in these industries are expensive. Recent research from IBM puts the average healthcare data breach at $6.64 million, the highest of any industry, and IBM reports that financial services breaches average $6.29 million. Outsourcing partners are part of that exposure: the Verizon Data Breach Investigations Report found third party is involved in 48 percent of all breaches, and the number of such breaches is up 60 percent year over year. Once a vendor handles your patient calls or payment questions, a gap in its security becomes a breach you have to report.
HIPAA-compliant customer support outsourcing means the vendor signs a business associate agreement (BAA) with you, applies the Security Rule safeguards to every agent desk and tool that touches protected health information (PHI), and proves both with independent evidence. If your support team handles financial data, the requirements include PCI DSS for card payments, a SOC 2 Type II report, and service provider oversight under the Gramm-Leach-Bliley Act (GLBA) Safeguards Rule. This guide covers which documents to request, what each one actually proves, and which vendor answers are reasons to walk away.
Key Takeaways
- HIPAA has no official certification. HHS doesn’t recognize private “HIPAA certified” labels, so judge vendors by the signed BAA and their audit evidence.
- A BAA is mandatory before a vendor touches PHI, and it must cover subcontractors, breach reporting, and PHI return or destruction.
- Fintech support adds its own requirements: PCI DSS for card data, SOC 2 Type II for security controls, and GLBA oversight for non-bank financial institutions.
- Some evidence is worth more than other. An auditor’s report outweighs a self-assessment, and both outweigh a badge on a website.
- Check controls where agents work, including access, call recordings, AI tools, and remote setups.
What Makes Outsourced Customer Support HIPAA Compliant
Outsourced support is HIPAA compliant when a signed BAA covers the work, the vendor applies the HIPAA Security Rule safeguards to its agents, sites, and systems, and you’ve verified both. The BAA is required because of how HIPAA classifies the vendor. When a contact center or healthcare BPO partner answers patient calls, chats, or emails that include PHI, it becomes your business associate.
That status makes the vendor directly liable. HHS confirms that the Security Rule safeguards apply to business associates the same way they apply to covered entities, and violations carry civil and criminal penalties. Signing a BAA doesn’t hand your own duties to the vendor, though. You still run your risk analysis, decide how much PHI the vendor needs, and oversee the relationship, as in any healthcare outsourcing arrangement.
Because both sides carry obligations, many buyers look for a certificate that settles the question. HIPAA doesn’t offer one. No one issues a HIPAA certificate. HHS states that it doesn’t endorse or recognize private organizations’ HIPAA “certifications,” and holding one doesn’t stop HHS from finding a violation later.
Therefore, a “certificate” doesn’t replace the contract. HHS says a business associate can’t self-certify or rely on a third-party certification instead of a BAA.
That leaves verification to you. Whether you build an in-house team or hire a HIPAA-compliant call center, the documents covered below show whether a compliance program works in practice or exists only in a sales deck.
The Compliance Stack for Healthcare and Fintech Support
If your support team handles financial data as well as health data, a BAA alone won’t cover you. Card payments, account data, and customers in the EU each bring their own rules, from PCI DSS to the frameworks behind fintech regulatory compliance. Many vendors serve both industries, so map the frameworks before your first vendor call. The table below shows when each one applies, what the vendor must prove, and which document to request. Use it to scope your RFP.
| Framework | Applies when | What the vendor must prove | Evidence to request | How often to re-check |
|---|---|---|---|---|
| HIPAA Privacy, Security, and Breach Notification Rules | Agents create, receive, maintain, or transmit PHI for a covered entity | Security Rule safeguards, minimum-necessary access, breach reporting to you | Signed BAA, recent risk analysis summary, policies, training records | At signing, then each year and after major changes |
| PCI DSS v4.0.1 | Agents take, see, or store payment card data, or affect its security | Card data protection, no storage of card verification codes after authorization | Attestation of Compliance (AOC) for the services you buy, responsibility matrix | At least every 12 months |
| SOC 2 Type II | Any vendor holding or accessing your customer data | Controls designed and operating effectively over a review period | Full SOC 2 Type II report, including exceptions and the bridge letter | Each year |
| ISO/IEC 27001 | Vendor claims a certified information security management system | Accredited certification covering the sites and services in your contract | Certificate with scope statement, verified on IAF CertSearch | Each year, with the certificate’s validity dates |
| GLBA Safeguards Rule | You’re a non-bank financial institution under FTC jurisdiction | Safeguards for customer information, written into the contract | Contract security clauses, your periodic vendor assessment | Periodically, based on risk |
| GDPR | Agents process personal data of people in the EU | Processor obligations, lawful transfers, sub-processor control | Data processing agreement, sub-processor list | At signing and on sub-processor changes |
PCI DSS keeps oversight with you. The PCI Security Standards Council requires you to perform due diligence before hiring a provider, define which requirements the provider owns, and check its compliance status at least once a year. If agents take card payments by phone, you need a PCI-compliant call center process that states exactly which controls the vendor runs and which stay with you. A compliant provider doesn’t make your own program compliant.
GLBA puts the requirements in the contract. For any financial services BPO engagement, the FTC Safeguards Rule requires covered financial institutions to choose capable service providers, write security expectations into the contract, and reassess providers periodically. You also have to notify the FTC within 30 days of discovering a breach that affects at least 500 consumers. If your vendor takes two weeks to tell you about an incident, nearly half of that time is already gone.
HIPAA vendor rules are under review. HHS has proposed a Security Rule update that would require business associates to verify their technical safeguards in writing at least once every 12 months. Business associates would also have to notify covered entities within 24 hours of activating a contingency plan. The proposal isn’t final, and the current Security Rule still applies. Even so, asking vendors whether they already meet these requirements shows you which ones won’t need a contract amendment if the rule is finalized.
Certifications vs. Claims: The Evidence Ladder
Once you know which frameworks apply, the next question is how much weight to give the evidence a vendor sends. A logo on a website and an auditor’s signed report both say “SOC 2,” but only the report shows what was tested, over what period, and where controls failed. Rank what you receive from strongest to weakest.
| Rung | Evidence type | Example | What it proves | What it doesn’t prove |
|---|---|---|---|---|
| 1 | Independent audit report | SOC 2 Type II report, PCI DSS Report on Compliance with AOC signed by a Qualified Security Assessor (QSA) | Controls operated effectively over a defined period, tested by a licensed third party | Anything outside the report’s scope, sites, or dates |
| 2 | Accredited certification | ISO/IEC 27001 certificate from an accredited body | The management system was audited for a stated scope | That specific controls worked on your account |
| 3 | Point-in-time assessment | SOC 2 Type I report, third-party HIPAA risk assessment | Controls were designed properly on one date | That they kept working afterward |
| 4 | Self-assessment | PCI DSS self-assessment questionnaire, completed security questionnaire | What the vendor says about itself, under signature | Independent confirmation |
| 5 | Marketing claim | “HIPAA certified,” “PCI ready,” “SOC 2 aligned” badges | Nothing reliable | Everything that matters |
Even strong evidence covers less than it first appears to. Before you rely on a report or certificate, check these points:
- Match the scope to your contract. Read the system description in the SOC 2 report and the services named in the PCI AOC. A report that covers one site or one product tells you little about the team that will handle your customers.
- Ask for Type II, not Type I. The AICPA explains that a type 1 report evaluates controls as of a specific date, while a type 2 report also covers operating effectiveness. For an ongoing support contract, you need to know the controls kept working after the audit date, which is what Type II tests.
- Verify certificates at the source. ISO directs buyers to IAF CertSearch to confirm that an ISO certificate exists, which body issued it, and what it covers.
PCI evidence has one more limit: an AOC isn’t a contract. PCI DSS guidance notes that proof of a provider meeting PCI DSS, such as an AOC or a statement on its website, is different from the written agreement that assigns security responsibility. You need both.
BAA Terms to Check Before You Sign
In healthcare, that written agreement is the BAA. It’s the contract that makes the vendor’s HIPAA obligations enforceable, and some vendors start with a short template. Compare the vendor’s draft against the elements HHS lists as required, then add the operational terms your risk analysis calls for, such as audit rights.
| BAA element | Required by HHS? | What to look for in the draft |
|---|---|---|
| Permitted uses and disclosures of PHI | Yes | Uses limited to the support services you’re buying, with no secondary uses such as marketing or model training |
| Safeguards, including Security Rule compliance | Yes | Named controls (encryption, access logging, MFA), not “appropriate measures” alone |
| Reporting of unauthorized uses and breaches | Yes | A notice window shorter than the legal outer limit, plus security incident reporting |
| Subcontractor flow-down | Yes | Same restrictions on every subcontractor, and a list of subcontractors that touch PHI |
| Support for access, amendment, and accounting requests | Yes | Turnaround times that fit your own deadlines |
| Books and records available to HHS | Yes | Plain language, no conditions |
| Return or destruction of PHI at termination | Yes | Covers backups and call recordings, with written confirmation |
| Termination for material breach | Yes | Your right to end the contract without penalty |
| Audit rights and evidence delivery | No, but recommended | Annual delivery of the SOC 2 report and the right to audit or assess |
The breach reporting term deserves the hardest negotiation. HHS breach notification rules give a business associate up to 60 days from discovery to notify you, as long as it acts without unreasonable delay. You face a deadline of your own to notify patients, and if the vendor acts as your agent under HIPAA, its discovery date counts as yours. Every day the vendor waits then comes out of your notification window, so negotiate a much shorter one. If GLBA also applies to you, the FTC’s 30-day deadline makes a short window essential.
Controls to Verify at the Agent, Desk, and Tool Level
Contracts and audit reports describe the vendor as a company, but your data is handled by individual agents, sometimes at 2:00 a.m. A company-level certificate says little about whether that agent sees only the records they need, or whether a call recording just captured a card number. The checks below follow the data through every omnichannel CX channel and mirror what call center HIPAA compliance requires on every call. Ask the vendor to show you each control working.
Access and Identity Verification
Agents get access only to the PHI and account data their role requires, through named logins protected by multi-factor authentication. That access also has to end when an agent leaves your account or the company, so ask how offboarding works and how long it takes. Before discussing PHI or account details with a caller, agents follow a scripted identity check, and QA monitoring scores that check on every reviewed interaction. The same check is your first line of fraud detection against callers attempting account takeover.
Call Recordings, Transcripts, and Card Data
Identity checks protect the live conversation, but the data stays behind in recordings and chat transcripts, which hold PHI and sometimes card numbers. For card data, the rule is strict: PCI DSS bars storing card verification codes after authorization, and the PCI Council telephone payments guidance applies that rule to audio recordings. Ask how the vendor keeps card data out of recordings, who has playback access, and how long recordings are kept. Customers sometimes type card numbers into financial services live chat as well, so ask whether the chat tool masks them.
Encryption and Data Handling
Stored recordings and records need encryption, and many organizations fall short here. IBM found that only 37 percent of breached organizations encrypt sensitive data both at rest and in transit. Ask the vendor to confirm encryption at rest and in transit across its ticketing, telephony, and storage systems. Then confirm agents can’t copy, print, or screenshot records, because encrypted storage won’t stop data from leaving through an agent’s screen.
Tools, AI, and Sub-processors
Your data also flows into systems the vendor doesn’t own. Every platform that stores or processes PHI on the vendor’s behalf needs its own BAA in the chain, including the CRM, telephony, transcription, and any AI assistant used for healthcare call center automation. HHS guidance is clear that a cloud provider maintaining ePHI is a business associate even when it holds only encrypted data, so encryption doesn’t remove the need for a BAA.
Ask for a tool inventory that marks which systems touch PHI or card data. For every system that runs AI customer service features, such as call summaries or suggested replies, confirm what data the feature keeps.
Workforce Training and Monitoring
Every control above depends on agents following it, which is why training and monitoring records matter. Agents complete HIPAA and PCI training before go-live and then on a fixed schedule. Ask for completion records for the team assigned to you, the vendor’s sanctions policy, and how it monitors access logs for unusual lookups, such as an agent opening records unrelated to their tickets.
Offshore and Nearshore Delivery under HIPAA and PCI DSS
These controls are harder for you to check in person when agents work in another country, which raises the question of whether offshore support is allowed at all. HIPAA doesn’t ban it. HHS confirms that a covered entity is allowed to use a service provider that stores ePHI outside the United States, as long as a BAA is in place and the rules are met. HHS also notes that overseas outsourcing raises risks that belong in your risk analysis, including whether you’d be able to enforce protections in the provider’s country.
Location doesn’t decide whether a vendor is compliant, but it does change what you need to ask. For each vendor, find out:
- Where do agents and data sit? Get the list of delivery sites assigned to your account and the country where each system stores data.
- Which sites are in the audit scope? Confirm the SOC 2 report and PCI AOC cover the exact sites your agents work from.
- How are home-based agents controlled? Look for company-managed devices, locked-down desktops, clean-desk rules, and network controls.
- What do your contracts require? Client, payer, and government contracts sometimes add location limits that HIPAA doesn’t impose. Check yours before you shortlist.
Time zones matter as well. Nearshore call center teams close to US time zones share more working hours with your staff, so live training, compliance reviews, and urgent escalations happen during your normal day. That makes nearshore a common path for live voice support. If you serve customers in several languages, multilingual customer support often requires agents in more than one country, so confirm that every site in the mix falls under the same audit scope.
Red Flags in a Vendor’s Compliance Pitch
The questions above also expose vendors that aren’t ready for regulated work. Treat any of these answers as a reason to slow down or walk away:
- The vendor says it’s “HIPAA certified.” Since no official HIPAA certification exists, ask what assessment the phrase refers to and who performed it.
- It won’t sign your BAA, or it offers only a one-page template. A vendor that pushes back on standard HHS terms during the sale won’t be easier to work with after a breach.
- It sends a summary instead of the report. A “security overview” PDF is not a SOC 2 Type II report. Ask for the full report under NDA.
- The audit scope doesn’t match your team. For example, the certificate covers the headquarters site, while your agents work somewhere else.
- It can’t name its subcontractors. Every tool and partner touching PHI or card data needs a flow-down agreement.
- Card data shows up in recordings or tickets. If agents type card numbers into notes or calls record verification codes, the payment process isn’t PCI-ready.
- The breach notice clause just says “per the law.” That lets the vendor use the full legal maximum, leaving your team little time to investigate and respond.
Vendor Due-Diligence Checklist
A vendor that gets past those red flags still has to back up its answers with documents. Paste this request list into your RFP or security questionnaire. A vendor ready for regulated work sends most of it within a week.
Contracts
- Draft BAA (healthcare) and data processing agreement (GDPR), marked up against your templates
- Subcontractor and sub-processor list, with the services each one performs
- PCI DSS responsibility matrix showing which requirements the vendor owns
Independent evidence
- Current SOC 2 Type II report and bridge letter covering the gap since the report period ended if it did
- PCI DSS AOC for the services and sites in scope
- ISO/IEC 27001 certificate with scope statement and certificate number
- Most recent penetration test summary and remediation status
Operations
- Delivery sites assigned to your account and data storage locations
- Access control, offboarding, and MFA policies for agents and supervisors
- Call recording, transcript, and card data handling procedures
- Incident response plan with notification timelines and named contacts
- Training curriculum and completion records for the assigned team
References
- Two client references in your industry, ideally with a regulatory audit during the engagement
How Helpware Handles Regulated Support
We expect prospects to ask us for the same documents. We run regulated support for healthcare and fintech clients under one control set: SOC 2 Type II, ISO 27001, ISO 9001, HIPAA, GDPR, and PCI DSS, backed by the commitments on our ethics and compliance page. Engagements that involve PHI run under a signed BAA.
For healthcare clients, our HIPAA-trained teams handle patient support, technical support, and back-office work such as claims processing and insurance verification.
Our healthcare clients include Headspace, HealthComp, and NexHealth. For one telehealth platform, 24/7 support cut its time to resolution by 35 percent.
In fintech, our fintech customer service teams have supported clients including Bittrex Global and Bitcoin.com, and a ticketing platform cut its fraud resolution time by 35 percent with a new fraud team and robotic process automation. We work from 19 locations across four continents in 45+ languages, with a 90 percent CSAT and an average client partnership of five years.
HITRUST isn’t part of the certification set we list. If your contracts require it, ask us how our SOC 2 and ISO 27001 controls map to your requirements. And as with any vendor, check our evidence yourself instead of relying on this section alone.
Choose a Partner That Proves Compliance
A vendor’s compliance claim is only as strong as the documents and controls behind it. Before you hand over patient calls or payment conversations, you need a contract that assigns responsibility, independent evidence whose scope matches the team serving you, and controls you’ve seen working at the agent’s desk. A well-prepared vendor answers these requests quickly, and gaps tend to show up in the first round of document requests.
In practice, that means sending the checklist with your RFP, ranking what comes back on the evidence ladder, and negotiating the breach notice window before you sign. If you’re scoping regulated support now, talk to our team about a 30- to 60-day pilot, and request our compliance evidence as part of scoping.
This guide is for general information and isn’t legal advice. Confirm requirements for your organization with your compliance counsel.
