Are Human Resource vendors (such as payroll, medical plan, life insurance companies, where the bank shares or provides employees' information) subject to vendor risk assessment and require the GLBA language in place?

Are some of your employees account holders at your institution?

It is my thought that yes, they are high risk... however I do not think specifically under GLBA... with maybe the exception of payroll.

At our institution any vendor with whom we share covered personal information gets the full due diligence, risk assessment process, whether they are performing those duties at an account level or on our employees or customers in general.

Cheers!

Don't forget HIPPA language for those receiving personal health information (PHI).