The short answer
Keep your existing vendor security questionnaire, and add a section for AI. The new questions cover six things the usual one misses: what the tool can write to your systems and who approves it; model changes and how you hear about them; whether your data trains anything; what records the tool keeps of its own actions and whether you can check them; how it handles prompt injection and untrusted text; and exit, including getting your records back. Ask every vendor to list its own gaps. A vendor that says it has none hasn’t looked.
Deedglass
Your data stays on your servers
Your own servers
Why the usual questionnaire misses AI
Standard questionnaires were built for software that stores and shows data. They ask where data is hosted, how it’s encrypted, who can access it and how incidents are reported. All still matter.
AI tools add behaviour the old questions don’t reach. The software makes decisions, can change when the vendor swaps a model, may write to clinical systems, reads untrusted text that can carry instructions, and can report doing something it didn’t do. None of that shows up in “Is data encrypted at rest?”.
The legal frame in brief
In the US, a vendor that creates, receives, maintains or transmits PHI on a covered entity’s behalf, including for data analysis or practice management, is generally a business associate, and that includes its subcontractors.1 The business associate contract must set permitted uses, require safeguards and that the vendor follow the Security Rule for ePHI, require reporting of breaches, and flow the same terms down to subcontractors.2 A business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and within 60 days of discovery.3 The Security Rule requires audit controls4 and regular review of system activity records.5 NIST SP 800-66 Rev. 2 is a practical guide to implementing the rule.6
In India, under the DPDP Act the hospital, as data fiduciary, stays responsible for processing its data processor does, and may engage one only under a valid contract.7 The DPDP Rules list minimum safeguards, including encryption or masking, access control, logs with monitoring and review, keeping logs for one year, and contract terms with data processors.8
For AI vendors, the subcontractor line matters: a model provider behind the vendor may be handling your data too.
The 30 questions
What it can write (1 to 6)
- List every system and resource type the tool can create, update or delete. Good answer: a specific list, by environment.
- Which writes need a person’s approval, and can we change that? Good: configurable tiers, enforced outside the model.
- Can the tool’s credentials be limited to exactly those writes? Good: separate credentials per tool with narrow scopes.
- After a write, does the tool read back and compare what was stored? Good: yes, with mismatches reported.
- How do we stop all writes in minutes? Good: a documented, tested switch.
- What happens if your service is down: do actions fail closed or run unchecked?
Model changes (7 to 11)
- Which models and providers do you use, and where do they run?
- How much notice do we get before a model change? Good: written notice and a test window.
- Can we pin a version during a pilot or audit?
- How do you test a new model before it reaches us?
- Are model providers bound by the same contract terms as you?2
Training and data use (12 to 16)
- Is our data used to train or improve any model, yours or a provider’s? Good: no, by default, in the contract.
- What leaves our network, to which regions, and for how long?
- Is data masked or tokenised before it reaches a model?8
- How is data deleted at the end of the contract, including from providers?
- Which subcontractors handle our data? Good: a named list with change notice.
Records of the tool’s actions (17 to 22)
- What record does the tool keep of each action: input, output, who approved, what changed?
- Does the record separate what the AI produced from what a person edited?
- Can we export records in a documented format?
- Can we check that records weren’t altered, without your help?
- How long are records kept, and can we set it?8
- Do you record reads as well as writes?4
Untrusted input and misuse (23 to 27)
- How does the tool treat instructions inside documents, messages or web pages it reads?
- Which tools or APIs can the model call, and what limits them?
- Have you run prompt-injection tests, and can we see the results?
- How is one patient’s data kept out of another’s context?
- What do you do when the model’s output fails a check?
Exit and gaps (28 to 30)
- How do we get all records and configuration back, and in what format?
- What’s your breach notification timeline to us?3
- What don’t you have yet? Audits pending, features missing, limits known.
Question 30 is the one to weigh most. We answer it ourselves: no SOC 2 report or ISO 27001 audit yet, no single sign-on yet, and not on ABDM’s list of approved integrators.9
Scoring the answers
| Answer quality | Looks like | Score |
|---|---|---|
| Specific and testable | Names systems, shows a config, offers a demo | 2 |
| General but plausible | “We follow best practice”, no detail | 1 |
| Missing or deflected | “Proprietary”, “not applicable” for a core question | 0 |
| Gap named honestly | “Not yet; planned for Q2” | 1, and note it |
Weight sections 1 and 4 double for tools that write to clinical systems. A tool that scores 0 on question 5 shouldn’t get write access in a pilot.
For your own side, a short pack that covers architecture and data flow, where data lives, the threat model, standard security answers, the clinical-safety boundary, operations and how a pilot is measured saves weeks of back-and-forth.9
Questions people ask
Is an AI scribe vendor a business associate?
If it creates, receives, maintains or transmits PHI for a covered entity, generally yes, and so are its subcontractors that handle the PHI.1 Confirm with counsel.
Should we accept a vendor’s SOC 2 report instead of the questionnaire?
It helps with general controls. It usually won’t answer the AI questions here, so ask them anyway.
Who should own this questionnaire?
IT security, with the privacy officer and a clinical lead reviewing sections 1, 3 and 4.
Our hospital page shows the review pack we hand IT, and the record spec describes records a vendor could export for question 20. To try approvals and read-backs on a real database in your browser, open the playground; to grade what an agent can reach on your own machine, run npx deedglass scan (the grade, explained).
Written with AI assistance and checked against our claims register.