Third-Party Risk Management (TPRM)
Third-Party Risk Management
The broader program of identifying, assessing, monitoring, and mitigating risks introduced by third-party relationships.
1 min read · Last reviewed May 23, 2026
At a glance
- Category
- Security
- Acronym for
- Third-Party Risk Management
- Primary sources
- 1
- Workspace handoff
- compliance binder →
Where this comes up
This sits inside the security risk analysis under 45 CFR 164.308(a)(1)(ii)(A) — workstation controls, EHR access roles, ePHI transmission encryption, audit logging, vendor risk, and incident response. Reviewers expect dated evidence of the control, not a policy PDF that says it exists.
Full definition
What it is in practice
TPRM integrates with vendor management, procurement, BAA tracking, and incident response. The NIST Cybersecurity Framework treats supply-chain risk as a foundational category.
How it shows up in your practice
Maintain a TPRM register that links vendors to BAAs, risk tier, last assessment date, and outstanding remediation.
Sources
- NIST Cybersecurity Frameworkhttps://www.nist.gov/cyberframework
Build the TPRM register in the Compliance Binder
Open compliance binder →Related terms
- SecurityVendor Risk AssessmentThe process of evaluating a vendor's security and privacy posture before sharing PHI or granting system access.
- HIPAA & PrivacyBAA (Business Associate Agreement)A written contract required between a covered entity and any vendor that creates, receives, maintains, or transmits PHI on its behalf.
- SecuritySecurity Risk AnalysisThe accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI required by the HIPAA Security Rule.
D3rx is a healthcare-billing and compliance research aid maintained by D3rx Inc. Articles are drafted by an LLM (Anthropic Claude) against primary HHS, OCR, CMS, eCFR, NIST, and state-regulator publications, and reviewed for restraint and source fidelity by the D3rx team.
Reviewer status: a named credentialed reviewer (CHC, CHPC, or healthcare attorney) is being engaged. Until that engagement is finalized, this page does not claim credentialed review.
Related across the archive
- GlossarySecurity Risk AnalysisThe accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of ePHI required by the HIPAA Security Rule.
- GlossaryVendor Risk AssessmentThe process of evaluating a vendor's security and privacy posture before sharing PHI or granting system access.
- GlossaryBAA (Business Associate Agreement)A written contract required between a covered entity and any vendor that creates, receives, maintains, or transmits PHI on its behalf.
- RegulationNIST Cybersecurity Framework 2.0The 2024 update to the NIST CSF added the Govern function alongside Identify, Protect, Detect, Respond, and Recover — providing a common language for organizational cybersecurity risk management.
- RegulationNIST SP 800-66 Revision 2: HIPAA Security Rule Cybersecurity Resource GuideNIST's 2024 update to the implementation guide for the HIPAA Security Rule, mapping the rule's standards to NIST Cybersecurity Framework subcategories and current cybersecurity practices.
- GlossaryRisk Management PlanThe documented plan that implements security measures sufficient to reduce risks identified in the Security Risk Analysis to a reasonable and appropriate level.
- GlossaryAccess ControlsTechnical policies and procedures that allow only authorized persons or software programs to access ePHI.
- GlossaryAdministrative SafeguardsPolicies and procedures designed to manage the selection, development, implementation, and maintenance of security measures protecting ePHI.
This glossary entry is a research aid for billing and compliance staff. It does not provide legal, medical, or financial advice and does not replace counsel. References cited link to primary sources at HHS, OCR, CMS, eCFR, NIST, and the relevant payer or industry body.