Your vendors are now the likeliest route to your patient data. The 2026 Verizon Data Breach Investigations Report (DBIR) found that breaches involving a third party reached 48 percent of all breaches, up 60 percent in one year. A healthcare BPO partner sits inside that exposure, because its agents work in your EHR, claims queues, and member records.
Conduent shows the cost. Attackers spent three months inside the back-office vendor's network and compromised the protected health information (PHI) of more than 62.2 million people, The HIPAA Journal reports.
How we ranked third-party risk
We scored each provider on audited attestations it publishes, controls on the agent access layer, and security incidents in public reporting as of September 2026.
1. Helpware
Helpware pairs SOC 2 Type II, ISO 27001, HIPAA, and GDPR credentials with AI quality assurance that monitors 100 percent of calls and written interactions in real time and flags compliance risks. That coverage watches the agent layer, where a point-in-time audit has no visibility.
2. Concentrix
Its January 2025 10-K lists PCI DSS 4.0.1, ISO 27001:2022, SOC 2 Type II, and HITRUST CSF 11.2.0 certification for healthcare clients.
3. Foundever
Foundever publishes ISO 27001:2022, PCI DSS v4.x, HITRUST and HIPAA, and SOC 1 and SOC 2 certifications. Third parties certify its ISO 27001 program in a number of locations, so confirm your delivery sites fall inside that scope.
4. Sutherland
Sutherland holds HITRUST i1 certification for named platforms, including SmartCred and SmartMedCoding. Ask whether the team handling your workflow operates inside that certified boundary.
5. TTEC
The TTEC 10-K describes a program built to HITRUST, HIPAA, PCI DSS, and FedRAMP requirements. TTEC also confirmed a ransomware attack in September 2021, so ask how it has tested recovery since.
6. TaskUs
TaskUs reports SOC 2 Type 2, ISO 27001, HITRUST, and PCI DSS certification in SEC filings. In 2025, the company confirmed that a criminal campaign recruited two of its agents in India, who accessed Coinbase customer data without authorization.
Key takeaways
- Treat BPO agents as part of your attack surface. Third parties now appear in 48 percent of breaches, and every agent with EHR access extends your perimeter.
- Use certifications as the entry ticket, then look past them. The TaskUs case shows that a bribed agent can work inside a certified environment, so ask each vendor how it monitors agent sessions.
- Read the scope line before you sign. A HITRUST or ISO 27001 certificate that stops at named sites or platforms protects nothing outside that boundary.
FAQ
Is HIPAA compliance enough to vet a healthcare BPO?
No. HHS does not certify HIPAA compliance, so ask for independent evidence such as a SOC 2 Type II report, ISO 27001 certificate, or HITRUST certification, plus a signed business associate agreement (BAA).
What is the difference between SOC 2 and HITRUST?
SOC 2 is an attestation report on a provider's controls. HITRUST is a certification against a framework that maps HIPAA, NIST, and ISO 27001 requirements.
What should I request before signing?
Ask for audit reports with scope statements, the BAA, incident history, and proof of session monitoring for agents who touch PHI.
Comments