Your Vendors' Data Practices Are Now Your Problem: Building a Third-Party Risk Framework

In the summer of 2023, a major US healthcare administrator discovered that a breach at one of its billing software vendors had exposed the protected health information of millions of patients. The healthcare organization had not been hacked. Its own systems had not been compromised. But under HIPAA's business associate provisions, it bore significant compliance responsibility—and faced the reputational fallout alongside the vendor that had failed to secure the data.

This scenario is no longer exceptional. It is becoming the defining compliance challenge for enterprises that rely on interconnected vendor ecosystems, which is to say, virtually every enterprise operating at scale in the United States today.

How Liability Travels Through Supply Chains

The legal and ethical framework governing data in the US is clear on one point that many organizations still underestimate: sharing data with a third party does not transfer your obligations. It multiplies them.

Under the California Consumer Privacy Act and its successor, the CPRA, businesses are responsible for ensuring that service providers and contractors handling consumer data adhere to equivalent data protection standards. Under HIPAA, covered entities must execute business associate agreements with every vendor that processes protected health information—and those agreements must impose specific safeguards. The FTC's broad authority over unfair and deceptive practices has been applied to organizations that made privacy representations they could not substantiate across their vendor relationships.

Beyond regulatory exposure, there is the matter of consumer trust. When a vendor breach results in customer data being exposed, the consumer's relationship is with your organization—not with your vendor. The erosion of trust that follows a third-party incident is indistinguishable, from the customer's perspective, from an incident you caused directly.

The Structural Weaknesses in Current Vendor Oversight

Most enterprises have some form of vendor risk management in place. The problem is that existing programs frequently treat data risk as a subset of cybersecurity risk, focusing on technical controls—encryption standards, penetration testing, SOC 2 reports—while underweighting the ethical and governance dimensions of how vendors actually handle data.

A vendor may pass a security assessment with strong marks while simultaneously maintaining data retention practices that exceed what the enterprise's own privacy policy permits, selling derived insights from customer data to additional parties, or operating in jurisdictions with inadequate data protection standards. None of these behaviors would be flagged by a conventional security audit.

There is also the challenge of assessment frequency. Vendor risk is often evaluated at contract signing and then revisited only when a contract renews, which may be years later. In the interim, vendors acquire new customers, change their subprocessors, update their data practices, and face their own regulatory scrutiny—none of which is automatically surfaced to the enterprises they serve.

A Framework for Ethical Vendor Data Assessment

Addressing third-party data risk requires expanding vendor oversight beyond cybersecurity compliance into a broader ethical data assessment model. The following framework provides a starting structure for US enterprises.

Tier Your Vendors by Data Sensitivity

Not every vendor relationship carries equivalent risk. A vendor that processes payment transactions on your behalf operates under different risk parameters than one that simply provides project management software used internally. The first step in any effective third-party data program is tiering vendors according to the sensitivity of the data they access, the volume of individuals affected, and the regulatory context governing that data.

High-tier vendors—those handling personal health information, financial records, children's data, or any data covered by a specific regulatory regime—should be subject to enhanced due diligence before engagement and more frequent review throughout the relationship. Mid-tier and low-tier vendors can be managed with lighter-touch processes, freeing resources for where the genuine risk concentration exists.

Assess Ethical Data Practices, Not Just Technical Controls

For high-tier vendors, the assessment process should extend beyond standard security questionnaires. Key areas of inquiry include:

• Data use limitations: Does the vendor contractually commit to using your data only for the purposes specified in your agreement? Do they retain any rights to use aggregated or derived data for their own commercial purposes?
• Subprocessor transparency: Who does the vendor share data with, and under what conditions? Are those subprocessors subject to equivalent contractual obligations?
• Retention and deletion practices: What is the vendor's data retention schedule? Can they demonstrate compliant deletion at contract termination?
• Breach response: What are the vendor's notification timelines and procedures in the event of a security incident? Do those timelines meet your own regulatory obligations?
• Geographic data handling: In what jurisdictions is data stored and processed? Are those jurisdictions subject to legal frameworks that could conflict with US privacy obligations?

Build Contractual Teeth Into Vendor Agreements

Assessment findings are only as valuable as the contractual mechanisms that enforce them. Vendor agreements should include explicit data processing terms that go beyond boilerplate confidentiality clauses. Specifically, contracts should define permitted data uses with precision, establish audit rights that allow your organization to verify compliance, require notification of material changes to data practices or subprocessor relationships, and specify remedies—including termination rights—for data practice violations.

The impulse to accept a vendor's standard contract language is understandable when procurement timelines are tight, but it is a significant source of downstream risk. Standard vendor terms are written to protect the vendor, not to align with your organization's compliance posture.

Implement Continuous Monitoring, Not Point-in-Time Reviews

Once a vendor relationship is established, ongoing oversight should not be left to the contract renewal cycle. Building a lightweight continuous monitoring program—drawing on vendor-published transparency reports, regulatory enforcement actions, news monitoring for incident reports, and periodic self-attestation questionnaires—creates an early warning system for emerging risk.

For the highest-tier vendors, consider scheduling annual on-site or virtual reviews that go beyond document submission to include direct conversations with the vendor's data governance and security leadership.

Extending Fair Data Practices Beyond Organizational Boundaries

The enterprises that will navigate the next decade of regulatory complexity most successfully are those that understand data ethics as a supply chain issue, not merely an internal one. Choosing vendors whose data practices align with your own standards is not only a compliance strategy—it is a signal to customers, regulators, and the market that your commitment to fair data handling is substantive rather than superficial.

Fair data practices cannot stop at your organization's perimeter. They must travel with your data, wherever it goes.