Before a vendor holds patient information, ask ten questions: where the data lives, who can see it, how it is encrypted, which subprocessors touch it, how incidents are announced, how software flaws are handled, how access is logged, how data is returned or deleted, what you get in writing, and what happens if they are acquired.
How to use the list
Send it before contract signature, not after. Ask for specific answers and for documents where they exist. Score each answer as clear, partial or missing, and decide which gaps you will accept in writing. Your legal and compliance teams decide what contract terms health data requires; this list covers the technical side.
The ten questions
- Where is our data stored? Regions, cloud provider, backups and any copies used for support or testing.
- Who can access it? Customer staff, vendor staff, and under what approval. Ask whether support engineers can see records by default.
- How is it protected? Encryption in transit and at rest, and who holds the keys.
- Which subprocessors are involved? Names, purposes and how you are told about changes.
- How do you authenticate users and staff? MFA for admin access, single sign on options, session limits.
- How is access logged? Can you get logs of who viewed what, and how long are they kept?
- How do you find and fix software flaws? Scanning in the build, dependency management, time to patch critical issues, a way to report vulnerabilities.
- How will you tell us about an incident? A named contact and a stated notice period. Compare it with your own obligations so their delay does not use up your time.
- How do we get our data out, and how is it deleted? Format, timing and confirmation, including backups.
- What changes if you are acquired or shut down? Data return commitments and notice.
Red flags
- Answers that quote a certification but do not describe controls
- No subprocessor list
- Support staff with standing access to all customer data
- No way to report a security issue
- Refusal to put incident notice timing in the contract
- Real patient data used in demos or test systems
Ask about the software supply chain
A vendor's code includes many open source parts. Ask whether they keep an SBOM, scan dependencies on each release and track known exploited flaws. You do not need to see the whole list, only a credible process. If your own product incorporates their component, you can scan that component yourself. Safeguard offers SBOM and dependency scanning, and a free scan at gold.safeguard.sh/scan.
Keep the answers
Store responses with the contract, note the date and set a review a year out, or sooner after any incident. A questionnaire answered once and filed does not describe the vendor next year.
Quick check
Is a vendor's certification a substitute for these questions?
No. A certificate or report tells you something about a defined scope and period. These questions test whether that scope covers your use.
Last reviewed: 19 October 2026.
