Healthcare hosting questions for an initial scoping conversation

Start with the clinical and front-office workflows the proposed service would support. Identify application dependencies and where sensitive information may be stored, processed or exchanged.

Clarify the roles of your organization, application vendors and prospective service providers. Review required agreements with the appropriate qualified advisers before sharing sensitive information.

Ask what evidence will be available for access controls, data protection, operating responsibilities and recovery. Agree the acceptance criteria and any limitations for your specific environment.

Keep patient information out of the public website, contact form and assistant. These questions are a discussion aid, not a compliance checklist, legal assessment, certification or representation that a BAA is already available.