Identify the vendor
Six deployment facts are captured: clinical context, systems touched, write access, autonomy level, states of operation and the decision date. The resulting pattern sets question depth; a baseline set of PHI and subprocessor controls applies to every review.
Illustrative. Sample data shown.
Evaluate the vendor
The vendor answers its own scoped set in the portal and files each artifact against the question it supports, with clarifications threaded on the original question.
Illustrative. Sample data shown.
Independent Evidence Rating & Discrepancy Scoring
Vendor responses and supporting documentation are evaluated independently against a transparent rubric. If a submitted artifact, such as a subprocessor register, does not fully substantiate a questionnaire response, the platform logs a documentation gap. High-priority gaps trigger structured findings that apply an objective ceiling to the domain score until verified documentation is supplied.
Illustrative. Sample data shown.
Approve or decline
Qualifying findings produce suggested clause templates for counsel review, each linked to the finding reference and supporting evidence, and the decision closes in the ledger with its named reviewer.
Illustrative. Sample data shown.
Vendors respond in a dedicated portal, against the scoped question set.
A review is delayed when a vendor receives a spreadsheet it cannot map to its own documentation. The portal sends only the questions the deployment draws and names the artifact each one expects.
Response time depends on the size of the scoped set and the documentation the vendor has on hand. A declined question is recorded with the stated reason and its evidence rating becomes missing, which limits the score that question can reach.
One record. Two readers.
The committee reads a summary drawn from the record. The auditor reads the record itself. Both come from the same ledger, written as the review happens rather than assembled afterwards.
See how AITPRM Health evaluates vendor risk across 12 core domains.
Thirty minutes covering scoping, the portal, scoring and the contract controls it produces, on a deployment you are actually reviewing.