Review a healthcare AI deployment

Start with the exact service and workflow

Record the intended task, endpoint, region, account and enabled features. This guide does not identify an approved vendor or certify a deployment.

HHS explains that a cloud provider handling electronic protected health information for a covered entity or business associate may itself be a business associate, including when it holds encrypted data without the key. Review the applicable relationship and agreement with the responsible team.

Map the complete data flow

Identify prompts, outputs, logs, support access, backups and subprocessors. Record where each is stored, how long it remains and who can retrieve or delete it.

Keep retention, training use, geographic restrictions and contract coverage tied to the actual configuration. A model developer name does not establish the terms of a hosting service.

Assign security and recovery responsibilities

HHS describes administrative, physical and technical safeguards. Review the organization's risk analysis, access controls, audit controls and contingency arrangements for the selected deployment.

Document which party operates each control, who reviews changes and how an outage or incident is escalated. Review notification duties against the applicable rules and agreement rather than using a universal countdown.

Separate security review from model evaluation

Use synthetic examples and a reviewed reference set to assess the intended workflow. Record omissions, unsupported additions and human-review needs. General model rankings and checked review questions do not establish clinical suitability.

Primary references

Inspect the current HHS source pages during the organization's review. No account, patient record, contract upload or provider execution is requested here.