Quick answer
SNF EHR due diligence should connect each enabled workflow to the organizations handling its information, then connect important security claims to scoped evidence. Review application, hosting, support, backup and optional processing separately. A completed questionnaire or signed agreement does not establish how the full arrangement operates or which controls the facility must configure itself.
Follow one enabled workflow
Start with a document arriving in the EHR. It might be stored by one service, processed by an optional extraction feature, copied into support tooling and retained in backup. The application screen does not reveal those boundaries. Ask which legal entities perform each function, what data they handle and why.
Under HHS Guidance on HIPAA and Cloud Computing, a cloud provider maintaining ePHI on behalf of a covered entity or business associate can itself be a business associate even when it lacks the encryption key. Have qualified legal and security reviewers assess the facts, roles and agreements. A diagram alone does not determine legal status or compliance.
Build a purpose-based map
Use this original example as a request structure. It describes hypothetical services, not any supplier's actual architecture.
| Processing purpose | Information to identify | Operational question | Review evidence |
|---|---|---|---|
| Main application | Defined resident and operational objects | Which entity provides the contracted service? | Proposed scope and data map |
| Storage/hosting | Stored and processed data | Who maintains it, and through what arrangement? | Current hosting explanation |
| Optional extraction | Selected documents and generated output | What enables transfer and where does output return? | Feature-specific flow and configuration |
| Support | Screens, logs or records available to support | How is access authorized and ended? | Access process and bounded example |
| Recovery | Copies and configuration | Who restores what, and what can the facility verify? | Recovery scope and exercise evidence |
Record production, testing and support uses separately. “Same supplier” does not make their purposes equivalent. An optional feature may change the reviewed information flow without changing the main application contract's product name.
Ask the next question according to the evidence supplied
The NIST SP 1305 supplier risk quick-start guide focuses partly on defining and communicating supplier requirements. Turn that into a decision sequence for each important claim:
- Is the claim about the proposed product, environment, module and configuration? If not, ask for the applicable scope.
- Is the evidence a policy, a completed operating record or observed behavior? Record that level rather than treating them as interchangeable.
- Does implementation depend on a facility choice? Put that setup and ongoing task into the facility's plan.
- Is a consequential gap unresolved? Identify the missing fact and the person qualified to decide the disposition. Avoid inventing a favorable answer.
For example, a supplier says temporary support access expires automatically but provides only a policy. That proves an intended process. A scoped configuration demonstration and relevant completed access record provide different evidence. The next request should target the unproven step, not accuse the supplier of failure or grant an unconditional pass.
Test the optional-service decision
A fictional buyer initially plans document storage only. During implementation, an administrator enables extraction that sends selected files to another processor. The reviewed data map no longer describes the enabled workflow.
Before enabling that service, establish what triggers transfer, which content is sent, what output is retained, who can access it and what happens when the service is disabled. Disabling a toggle can stop future processing while leaving previously stored information subject to a separate handling arrangement. Do not equate a configuration change with verified deletion.
The decision may be to proceed under a reviewed arrangement, narrow the data scope, or defer the optional function. Each choice should include its operating cost. If manual processing remains, estimate the work rather than assuming deferral is free.
Make the facility side of the control visible
Suppose the product supports a role model, but implementation requires the facility to choose privileges and review assignments. A supplier's capability does not establish that the buyer's configuration is ready. Include local access approval, devices, training, incident contacts and recovery verification in the implementation record as applicable.
An independent facility may use an external reviewer to examine the evidence, but still needs a named person to act on supplier changes. A group may centralize due diligence while acquired sites use different optional modules or agreements. Record those variations rather than extending one approval to every configuration.
The final review should distinguish verified evidence, supplier statements, untested dependencies and qualified legal or security conclusions. Keep version dates and change triggers with the record. This allows later reviewers to update the questions affected by a new feature or processor instead of repeating a broad questionnaire without learning what changed.
Questions & answers
Does encryption remove the need to examine the cloud provider’s role?
No. HHS explains that a cloud provider maintaining ePHI on behalf of a regulated entity can be a business associate even without the encryption key. Qualified reviewers must assess the actual arrangement and agreements.
Should we demand every supplier security document?
Request evidence relevant to the proposed service, important dependencies and open questions. Record confidential evidence in approved restricted storage and reference its scope; a large unexamined document collection is not a completed review.
Primary sources
Use the cited source and its applicable version when making a facility-specific decision. These guides explain operational evaluation methods; they are not individualized clinical, coding, or legal advice.