Healthcare AI vendor review checklist
Thirty-five questions about contract scope, data handling, access, audit, incident response, architecture and vendor continuity.
Mark questions you have reviewed. Marks stay in this page's memory and disappear when it is reloaded or left. They do not certify a vendor, establish compliance or authorize patient use.
Contract scope and independent evidence
Record supporting evidence in your organization's approved review process. This website collects no answers or documents.
- Which proposed services and features are covered by the agreement, and has your legal team reviewed any required BAA?
- Can the vendor provide a current SOC 2 Type II report and explain its scope and exceptions?
- What independent healthcare security assessments are available, and which services do they cover?
- What current documentation supports the exact service, account, region and feature eligibility?
- Which additional privacy obligations apply to the proposed jurisdictions and processing?
- Has the responsible legal reviewer assessed applicable state health privacy requirements?
Data handling and security
Record supporting evidence in your organization's approved review process. This website collects no answers or documents.
- What protection is used for stored data, and how is the selected configuration verified?
- How are all transmission paths protected, including integrations and exports?
- Who controls encryption keys, and what rotation and recovery options exist?
- What are the actual prompt, response, log and backup retention and deletion rules?
- What contract and configuration govern training use of customer data?
- Where can data and subprocessors operate, including support access and backups?
Access and identity
Record supporting evidence in your organization's approved review process. This website collects no answers or documents.
- Which enterprise sign-in and identity lifecycle controls are supported?
- How is multi-factor authentication applied to users and administrators?
- Which roles restrict access to data, administration and model execution?
- How are API credentials scoped, stored, rotated and revoked?
- What session and inactivity controls apply to the intended application?
Audit and monitoring
Record supporting evidence in your organization's approved review process. This website collects no answers or documents.
- Which access and configuration events are recorded without exposing sensitive prompt content?
- Which audit retention period has the responsible team approved, and how is it enforced?
- Can audit records be exported to the approved monitoring system?
- Which security events trigger alerts, and who responds?
- Can the organization inspect access, usage and changes to permissions?
Incident response
Record supporting evidence in your organization's approved review process. This website collects no answers or documents.
- What notification duties, recipients and timelines apply under the contract and applicable rules?
- Who owns the incident response plan, escalation and containment steps?
- What incident support coverage and escalation contacts are available?
- What evidence preservation and investigation assistance can the vendor provide?
Technical architecture and recovery
Record supporting evidence in your organization's approved review process. This website collects no answers or documents.
- Which private connectivity and endpoint restrictions apply to the chosen deployment?
- How are network boundaries and outbound destinations controlled?
- What request, concurrency and usage limits protect the workflow?
- What availability commitments and failure modes have been reviewed?
- Have backup restoration and recovery responsibilities been tested?
Vendor continuity and exit
Record supporting evidence in your organization's approved review process. This website collects no answers or documents.
- What continuity risks and support commitments has the organization assessed?
- What evidence supports experience with the intended healthcare workflow?
- Can the vendor provide appropriate references and relevant evaluation evidence?
- How can data, audit records and integrations be moved or removed when the service ends?
Sources and next steps
Use the primary references and deployment guide to review the actual service. Evaluate workflow performance separately from security and contract review.