An ambient documentation vendor, reviewed before signature
The privacy officer had a security questionnaire and a redlined BAA, and no way to ask about training rights or the audio consent model. The scoped set surfaced an unnamed foundation model provider in the subprocessor register.
Foundation model provider not named in the BAA or any flow-down agreement. Vendor answer to Q 02.3 identifies “a leading commercial LLM provider” without naming it; the architecture diagram (E-11) names it. Evidence rated as a documentation gap.
Vendor shall identify in Schedule B each third party that provides, hosts or operates any machine learning model used to process Customer Data, and shall deliver executed flow-down agreements within thirty (30) days of the Effective Date.
Illustrative. Scenario, finding and sample clause templates are fictitious. Not legal advice.
A predictive risk tool already running, brought under review at renewal
The tool had been in production for two years without an AI-specific review. The renewal was the first opportunity to set terms on derivative data and model incident notification.
Session audio retained for 90 days for “quality purposes” with no Part 2 consent language and no patient-facing disclosure. Evidence: retention policy verified; consent model missing.
Vendor shall not retain audio or transcript content beyond completion of the encounter note, shall obtain and document consent in the form Customer specifies, and shall not redisclose Part 2 records except as 42 CFR Part 2 permits.
Illustrative. Scenario, finding and sample clause templates are fictitious. Not legal advice.
Utilization management vendor, aligned with CMS expectations
The plan needed to show that coverage determinations reflected individualized review, not algorithmic output alone, and needed the evidence to be inspectable.
Prior-authorization recommendations can be batch-approved by a reviewer without opening the individual case. No individualized determination is evidenced. Review paused pending resolution.
Vendor shall configure the Service so that no coverage determination is finalized without a named clinical reviewer opening and attesting to the individual case, and shall log each attestation with reviewer identity and timestamp.
Illustrative. Scenario, finding and sample clause templates are fictitious. Not legal advice.
Run the same framework on your vendor.
The findings in these cases came from specific questions. On the demo you see those questions scoped against your own deployment.