What a healthcare AI vendor should ask every subprocessor

Why subprocessors decide your ceiling

When a hospital's security team evaluates a medical AI vendor, they evaluate the whole chain: your app, your cloud, your model providers, and every tool that might see PHI. A weak answer anywhere in the chain becomes your weak answer.

The questions

1. Will you sign a BAA — and what does it actually cover?

"HIPAA-eligible" marketing is not a BAA. Get the agreement executed and read which services it covers; many providers exclude specific features or require particular configurations for coverage.

2. Is our data used for training — and is that off by default?

For any model provider: can our prompts, files, or outputs be used to train or improve models? Where is that switch, is it contractual or just a setting, and does the BAA-covered tier enforce it?

3. What is retained, where, and for how long?

Prompt logs, abuse-monitoring buffers, and debugging captures are all retention. Get numbers and regions, not adjectives — then align your own deletion commitments with what your chain can actually honor.

4. Who at the provider can see our data?

Human review for abuse or quality is common. Under what controls, and can it be excluded for BAA-covered workloads?

5. What proof of security do you have?

Ask for the SOC 2 report (under NDA, not the marketing badge) and read the exceptions and the carve-outs in scope.

6. What are your subprocessors?

Your model provider has its own chain. You need to know when it changes — subscribe to their subprocessor notifications and reflect material changes in your own list.

7. If we claim de-identification, does it survive your pipeline?

De-identification claims must meet Safe Harbor or Expert Determination standards, and combining datasets can raise re-identification risk. If your architecture depends on the claim, document the basis carefully — and involve qualified experts where the call is close.

Keep the answers current

Record every answer, date it, and review it on your vendor-review cycle. In diligence, "here is our subprocessor register with verification dates" is a different conversation from "we think our providers are fine."