Six facts set the depth of the review.
The review lead records how the tool will be used. The facts resolve to a pattern that scopes the question set: 118 core questions here, plus state overlays. A baseline set of PHI handling and subprocessor questions applies to every review.
The vendor answers its scoped set and attaches evidence.
The vendor sees only the 118 questions that apply. Each answer is written, and each evidence artifact is attached to the specific question it supports. Status is visible to both sides throughout.
Illustrative. Sample data shown.
Are all third-party model providers named in the agreement and flowed down under the same PHI restrictions?
Evidence is rated separately. Where documentation does not substantiate a response, a finding is logged.
The reviewer scores the answer against the published band and rates the evidence on its own. Here the uploaded subprocessor register names a provider with no executed agreement, contradicting the written answer. That gap is recorded as a tier-4 finding, and an open tier-4 finding caps the overall score.
The uploaded register names a model provider with no executed agreement, which contradicts the written answer.
Vendor shall identify each subprocessor in the processing chain and maintain an executed agreement with each prior to processing PHI. Reference: finding Q 02.3, vendor answer dated 2026-04-18.
The committee receives one packet.
Domain coverage, open findings, the evidence record and the sample contract controls export together. Counsel carries the controls into negotiation; the committee approves, declines or conditions the vendor; the record is retained for renewal.
Run this review on a vendor you are evaluating now.
A 30-minute walkthrough with a member of our team.