Bearings

Most health systems can describe their own security controls in detail and know far less about the vendors holding copies of their patients' records. Start with a list: which vendors hold PHI, in whose cloud account, under what notification terms, and how the data comes back when the contract ends. Archive and migration vendors deserve particular attention because they hold complete copies of old systems. Regulators are penalizing late notification, and the letters to patients carry the health system's name.

Before applying, decide what is in scope, who authorizes testing, how the data-retention requirement fits your privacy and business associate obligations, and who will fix what the testing finds. Testing that finds more flaws than the team can patch only lengthens the queue, so pair any testing plan with patch capacity.

Each of these depends on settings and data that health systems control. Patients will expect price comparisons to be right, opt-out choices to be easy to find and honored everywhere they apply, and directory entries to match reality. Document your own opt-out path end to end, including what happens at the exchange level, before a patient or reporter asks. Check that your pharmacy and provider data are current, because price and directory tools are only as accurate as the data behind them.

The four questions work as an intake form for any agent, and most organizations could not answer them today for the agents already running. Start by finding those agents, then give each one a documented function, a test record, a defined scope, and a named owner. Expand an agent's permissions as its record builds, and pull them back when performance slips.

A network of independent rural providers can only coordinate care if referrals, results, and care plans move between their systems. Funded networks should settle the data-sharing design first: which records move, through which exchange, under what consent rules, and who maintains the interfaces after the grant ends.