EHR mega-vendor concentration
SCRM plan under SR-2 documents concentration risk and monitoring metrics for the primary EHR supplier.
Supply Chain Risk Management Plan
High Risk
Moderate
Low Cost
SR-2 requires developing a plan for managing supply chain risks associated with systems and system components, reviewing/updating the plan, and protecting it. Healthcare SCRM plans must cover EHR vendors, cloud hosts, clearinghouses, and device OEMs — not only electronics manufacturing.
Control Objective
Maintain an approved, reviewed supply chain risk management plan that defines how the organization identifies, assesses, mitigates, and monitors supplier risks to ePHI systems.
Implementation Guidance
- Write an SCRM plan covering roles, tiering, assessment methods, contractual tools, and monitoring.
- Include healthcare-specific suppliers (EHR, HIE, billing, biomed OEMs, staffing tech).
- Define integration with RA-3, SA acquisition, and BA management.
- Review/update at least annually and after major supply incidents.
- Protect the plan (reveals critical dependencies).
- Train procurement and IT owners on plan duties.
- Measure plan execution (assessment completion rates).
- Align SR-2 with SR-3 control processes and SR-6 strategies.
Real-World Use Cases
How this control shows up in healthcare and HIPAA-covered environments.
Infusion pump OEM recall/security bulletin
Plan-defined intake routes OEM notices into risk treatment within defined SLAs.
Annual SCRM refresh
Plan update adds generative-AI subcontractors used by a transcription BA.
Best Practices
- Approved living SCRM plan.
- Healthcare supplier coverage.
- Annual review.
- Protected distribution.
- Metrics for execution.
- Linked to BA and RA processes.
Common Gaps & Violations
- No SCRM plan — only ad-hoc questionnaires.
- Plan ignores clinical devices.
- Never updated after incidents.
- Plan world-readable on intranet.
- Procurement unaware of plan duties.
Required Documentation
- Supply chain risk management plan (SR-2)
- Roles and tiering model
- Review/approval records
- Plan access controls
- Execution metrics reports
How to Test & Validate
- Verify current approved SCRM plan exists.
- Confirm healthcare suppliers are in scope.
- Check last review date.
- Interview procurement on plan awareness.
- Review metrics or KPIs for assessments.
Audit Considerations
SCRM plans are increasingly expected in mature healthcare security programs. SR-2 shows intentional governance of vendor dependency risk to ePHI.
HIPAA Mapping
How this NIST control supports HIPAA Security Rule expectations.
- 164.308(a)(1) Risk Analysis / Risk Management — supply chain is part of enterprise risk.
- 164.308(b) Business Associate Contracts — plan should drive ongoing BA oversight.
- 164.314 Organizational requirements — arrangements with partners need operational planning.
- 164.306 Reasonable safeguards — include supplier-dependent controls.
Compliance Tips
- Keep SR-2 short enough executives will read the dependency section.
- Embed plan links in procurement SOPs.
- Report tier-1 supplier risk as a standing board metric.
Frequently Asked Questions
Is a vendor management policy the same as SR-2?
Related; SR-2 is specifically the SCRM plan for system/component supply chain risks — include tech and clinical system suppliers explicitly.
How often update?
At least annually and after significant supply chain events.
Who owns SR-2?
Typically CISO/supply-chain risk lead with procurement and clinical engineering input.
References & Resources
- NIST SP 800-53 Rev. 5 — SR-2
- NIST SP 800-161
- Related controls: SR-3, SR-5, RA-3, SA-9
Related Guidelines
Related controls that commonly accompany SR-2.
Need Help Implementing SR-2?
Our auditors map NIST SP 800-53 controls to your HIPAA Security Rule program — policies, technical evidence, and audit readiness.