Hospital and health system discharge planning teams have become inadvertent cybersecurity assessors. In the wake of high-profile healthcare supply chain breaches — most consequentially the Change Healthcare incident that disrupted hospital revenue cycles by compromising a downstream vendor — health system risk management teams have begun applying vendor risk assessment standards to post-acute care partners that were previously evaluated primarily on clinical quality and relationship factors. Hospice agencies that are not prepared for these security questions are losing preferred partner conversations to competitors who are.
The hospice organisations I see winning hospital preferred partner relationships in 2026 are not always the largest or the most clinically sophisticated. They are the ones who can answer security questions with documentation rather than reassurance — who have a compliance programme that is current, documented, and producible within 24 hours of a request. The difference between those two conversations — "we take security very seriously" versus handing over a two-page security summary with an attached evidence portfolio — is the difference between a follow-up meeting and a preferred partner agreement.
This article covers three things: the security questions hospital partners now ask verbally, the written security assessment questionnaires that formal preferred provider programmes send, and the security summary document and evidence portfolio that answer both effectively.
The Security Questions Hospital Partners Ask in Preferred Partner Conversations
Hospital discharge planning and care coordination teams are not cybersecurity experts. They are clinical and operational professionals who have been given a set of questions by their compliance and legal teams and asked to evaluate potential partners against them. Understanding the underlying concern behind each question — not just the surface question — is what allows a hospice administrator to answer in a way that builds confidence rather than triggering follow-up.
"Are you HIPAA compliant, and when was your compliance programme last reviewed?"
The underlying concern: has the hospice invested in a genuine, maintained compliance programme, or does "HIPAA compliant" mean they read the regulation once and have a policy document somewhere? The answer that builds confidence: "Yes. Our HIPAA Security Rule compliance programme was last formally reviewed in [month/year]. We completed our annual risk analysis in [month/year], we implemented the 2026 HIPAA mandatory requirements including MFA enforcement and annual penetration testing, and our written security programme documentation is current. I can provide you with our security summary document today."
The answer that raises concerns: "Yes, we are HIPAA compliant." Full stop. No date, no description of what compliance means, no documentation offer. This answer makes the hospital compliance reviewer wonder what "HIPAA compliant" actually means for this organisation.
"Do you have cyber liability insurance?"
The underlying concern: if this hospice experiences a breach involving our patients' data, will they have the financial resources to manage the notification and remediation — or will the consequences fall on the hospital as the referring organisation? The answer: carrier name, total policy limit, ransomware sublimit, and whether the coverage includes breach notification costs. "Yes — we carry cyber liability insurance through [carrier], with a $[X] million total policy limit including a $[X] sublimit for ransomware. The policy covers breach notification costs, forensic investigation, and legal counsel." The specificity signals that the hospice has actually engaged with its insurance coverage, not just purchased a policy.
"How do your clinical staff access patient records in the field?"
The underlying concern: are hospice nurses using unmanaged personal devices and personal email accounts to handle patient data — creating a data security exposure that touches hospital patients who are referred to this hospice? The answer: MDM, MFA, container model, encryption verification. "Clinical staff access patient records through our EHR mobile application on devices enrolled in our mobile device management system. MDM enforces encryption, screen lock, and requires an active security agent on every enrolled device. Personal devices access work applications through a managed container that is isolated from personal applications. MFA is required for every EHR login regardless of device or location."
"What happens to our patients' information if you experience a cyberattack?"
The underlying concern: will this hospice be able to continue caring for our patients during a cyber incident, and will they manage the breach notification process correctly and promptly? The answer: "We have documented clinical downtime procedures that our clinical staff are trained on and that allow us to continue delivering care and documenting visits when electronic systems are unavailable. We have immutable backup with a tested restoration process that allows us to restore clinical systems without paying a ransom. And we have a documented incident response plan with a 72-hour initial response protocol and HIPAA breach notification procedures. If a breach occurs that affects your patients, we notify you as a partner within [timeframe] of discovery, in addition to the individual patient notifications required by HIPAA."
"Can you sign our Business Associate Agreement?"
The answer is always yes — and the hospice should be prepared to execute the BAA without a lengthy legal review delay. Review the hospital's standard BAA template with legal counsel before the preferred partner conversation, identify any provisions that require modification, and prepare a redline response so that when the BAA is requested, the response time is days rather than weeks. A hospice that takes three weeks to return a redlined BAA is communicating to the hospital compliance team that its legal and compliance infrastructure is not well-organised.
Written Security Assessment Questionnaires: What Formal Preferred Provider Programmes Send
Informal verbal questions are the first filter. Formal preferred provider programmes — hospital systems with structured vendor risk management processes, Medicare Advantage plans with network credentialing requirements, and Managed Medicaid plans with preferred provider frameworks — send written security assessment questionnaires that hospice agencies must complete before preferred status is granted.
These questionnaires vary in format and depth. Some are adapted from NIST Cybersecurity Framework control families. Some are proprietary to the health system's vendor risk management programme. Some are standard vendor risk assessment forms used across the health system's entire vendor ecosystem. All of them ask variants of the same questions — and all of them can be answered from a well-maintained HIPAA compliance programme if that programme is organised for this purpose.
The Ten Questions That Appear Most Consistently
• "Does your organisation conduct an annual information security risk assessment?" — Yes, with a specific date. Attach the most recent risk analysis executive summary if the questionnaire permits attachments.
• "Does your organisation enforce multi-factor authentication for all users with access to protected health information?" — Yes, with a description of the enforcement mechanism. The word "enforce" is deliberate — questionnaire designers want to know that MFA cannot be bypassed, not just that it is available.
• "Does your organisation conduct annual penetration testing by a qualified third party?" — Yes, with the date of the most recent test and the testing firm's credentials. Questionnaires issued after the 2026 HIPAA update increasingly specify "qualified third party" — matching the HIPAA mandatory standard language.
• "Does your organisation have a documented incident response plan?" — Yes, with a description of the plan's key elements including the breach notification timeline and the partner notification process.
• "Does your organisation carry cyber liability insurance? If yes, what is the policy limit?" — Yes, with carrier, total limit, and ransomware sublimit.
• "Does your organisation have a Business Associate Agreement process for all vendors with access to protected health information?" — Yes, with a description of the BAA inventory and review process.