Start with architecture and data flow
Ask the vendor to explain what data enters the platform, where it is processed, how it is stored, which components can access it and what external services are involved. The review should distinguish production architecture from development or demonstration environments.
Access-control questions
- How are organizations and tenants separated?
- Can facility or business-unit access be scoped?
- How are roles and permissions administered?
- How are privileged roles restricted and reviewed?
- How is authentication handled?
- Can access be removed promptly when staff leave or change roles?
Patient-identity questions
Revenue-cycle platforms may need to connect financial and operational records to patient identity. Review how identity is represented in routine workflows, whether masking or surrogate keys are used, when direct identity can be revealed, who can reveal it and whether that privileged action is audited.
Files and evidence
- Are uploaded documents private by default?
- How is authorization checked before file access?
- Are file actions logged?
- How are file types and sizes controlled?
- How does retention or deletion work?
Audit and incident evidence
- Authentication events.
- Permission changes.
- Privileged access.
- Patient-identity reveal where applicable.
- Data import and processing events.
- Configuration changes.
- Administrative overrides.
- Security-relevant failures or exceptions.
Shared responsibility
No software vendor controls every part of the customer’s security posture. Customers typically retain responsibilities such as identity lifecycle, appropriate role assignment, endpoint security, secure source-data preparation, workforce training and internal policy. A serious review should make those boundaries explicit.
Avoid unsupported compliance shortcuts
Compliance should be supported by documented controls, agreements, implementation choices and operating evidence. Ask which claims are independently validated, which are contractual, which depend on customer configuration and which are simply design principles. Security due diligence should produce a list of evidence reviewed and any open items that must be resolved before production use.