It's up to the covered entity. Don't rely on the vendor for HIPAA compliance.
Kongstvedt
Peter
P
Cap Gemini Ernst & Young, McLean, Va., USA.
Lewis
Margie
M
Quinn
John
J
D003284:Contract Services / Q000331:legislation & jurisprudence*; D019983:Guideline Adherence / Q000458:organization & administration*; D019981:Health Care Sector / Q000331:legislation & jurisprudence / Q000458:organization & administration; D020408:Health Insurance Portability and Accountability Act; D007256:Information Systems / Q000331:legislation & jurisprudence*; D014481:United States