Trust Center
CTO evaluation guide
What to ask any vendor before a hospital platform is approved: where the access decision is made, how activity is proved, what the network has to open, and what leaving costs.
- For: CTO / CIO / IT head
- Questions: 8
A scripted walkthrough shows features. A platform is decided one layer below them: where the access decision is made, how activity is proved after the fact, how it reaches the systems already running in the building, and what it costs to leave.
None of that is visible on a screen, and all of it is answerable in a sentence by anyone who built the thing. The questions below are the ones to put to whoever is in the room, and they are the ones to put to us.
Ask for the mechanism.
Discount the adjective and ask for the component. "Enterprise-grade security" and "bank-level encryption" name nothing an IT team can test, and a vendor who cannot get past that vocabulary in one sentence is describing an intention.
A complete answer has four parts:
- A named component, so there is a specific thing to check rather than a category.
- Where it runs: in the interface, in the service, or at the database read path. The three are not equivalent, and only the last one survives a screen that forgot to ask.
- The limit. Every real mechanism has one, and a vendor who names theirs unprompted is the one to keep talking to.
- Something you can hold: a diagram, a sample export, one real audit record with its fields visible, a clause in the contract.
Eight questions to put to any vendor.
- Ask what is enforced, and what is only documented.Every vendor has an architecture diagram. Ask which parts of it a build would fail for breaking. Rules that live in a document drift within a year of the person who wrote it leaving. Ours is on the architecture page.
- Ask where the authorization decision is made.A hidden menu item is not an access control. Ask whether the check runs in the interface, in the service, or at the database read path, and ask how a query issued by a user with no entitlement is stopped. Ours is on the security page.
- Ask whether the audit is part of the write.An audit written after the change is a second record that can disagree with the first, and a log an administrator can edit proves nothing in a dispute. Ask when the audit row is written and who can alter it afterwards. Ours is on the security page.
- Ask what your network team has to open.Ask for the exact firewall change, in the words the network team would use, and get it before the meeting ends. An inbound rule into a clinical network is a permanent liability. Ours is on the interoperability page.
- Ask what happens when the link drops.Connectivity in a hospital fails at the worst hour. Ask what queues, where it queues, how long it holds, and what a person sees while it is holding. Ask which parts keep working offline and which do not. Ours is on the interoperability page.
- Ask who can change a form, a tariff or a workflow after go-live.A platform your own staff cannot change becomes a change-request queue with a price list attached. Ask what a department head can alter without the vendor, what needs an engineer, and what needs a release. Ours is on the tools page.
- Ask where the data sits, and who holds the keys.Ask which country the record is stored in, which subprocessors touch it, and who at the vendor can read it without the hospital knowing. Ask for the answer in the contract rather than on a slide. Ours is on the trust page.
- Ask what the exit looks like.Ask for an export in a named standard, produced from a running system, and read it before signing. An export that arrives as a report rather than as a record is a lock-in with a friendly name. Ours is on the deployment page.
How to run the evaluation.
Put the questions in writing.
Send them before the meeting. A written answer can be held against the contract later, and it outlives whoever gave it.
Ask each answer for its component.
When an answer names a quality rather than a thing, ask again. The second answer is the informative one.
Ask for the artifact.
A diagram, a sample export, one real audit record, the data processing terms. Anything a vendor cannot show you at this stage is unlikely to exist at the next one.
Test the exit first.
Take the export, open it, and check that a patient, an encounter and a result survive the trip. The time to discover the exit is a PDF is before the signature.
Ask the same eight again after go-live.
The answers that change between the evaluation and the running system are the ones that were describing an intention.
Send this list to every vendor on the shortlist, including us. A checklist that only one company can pass was written by that company.