4 Tips For Ensuring Vendor Compliance

With a majority of business operations riding on the shoulders of technology today, the success of one requires the coordination of many. That means a lot of vendors are involved in the handling and care of your sensitive data. How can companies ensure that the volumes of vendors they work with are compliant with all industry regulations and are properly protecting their business data?

1. Identify Your Vendors

Vendor procurement doesn't always involve human resources, compliance or legal departments, which means the full scope of information about a vendor doesn’t always get collected. Furthermore, the software organizations used to onboard, manage and track vendors may not have been specifically designed for their industry, or may be outdated and unaware of the growing complexity of regulations related to their industry. For this reason, organizations need to backtrack and collect as much identifying information about their vendors as possible to help ensure qualification, including:

• Legal entity name
• Federal Employer ID Number (FEIN)
• Current address
• Secretary of State ID number
• Owner(s) information (name, SSN, Address, DOB)
• State of incorporation
• Dunn & Bradstreet number (for searches in gov)
• Whether or not the vendor handles personal identifiable information (PII) or personal health information (PHI)
• Whether or not the vendor has signed a business associate agreement (BAA)

2. Qualify Each Vendor

Use the information collected above in addition to other foundational elements of a compliant business (legally speaking) to determine if each vendor is qualified. Legal organizations have been:

• Authorized to conduct business by a state Secretary of State: Each state has a Secretary of State for registering and enforcing compliance with required documents and reports.
• Issued a Certificate of Good Standing: These are issued if an entity demonstrates compliance with required filings such as annual reports and tax certificates/registration.

3. Clearly Establish Who’s Responsible for Compliancy

This step is a little tricky. Ideally, both the organization and the vendor should share the responsibility of compliancy. But we don’t live in an ideal world—and if there’s one thing organizational leaders and compliancy officers know, it’s never to get too comfortable. Ultimately, compliancy related to your business is your responsibility. Ask yourself, Is my vendor the type that would be forthcoming about any lapses in compliancy? If you waver on your answer—advance to tip No. 4.

4. Conduct Your Own Monthly Audits

Make routine monthly rounds and ask vendors for any updates to their information or compliancy status (refer to tip No. 1). Don’t believe everything you hear, either. Organizations should be actively monitoring their vendors for exclusions using resources like the Office of Inspector General's List of Excluded Individuals/Entities (LEIE), for healthcare organizations. Or the above-mentioned General Services Administration’s System for Awards Management (SAM).

Ensuring compliancy is a tough job, especially when you must rely on entities other than your own organization to protect information and uphold their end of the bargain. Following these tips and conducting thorough compliancy assessments is an excellent way to ensure vendors are amenable and actively working to safeguard data. It also lets your vendors know your organization takes compliancy seriously, and expects the same diligence of its partners.