Vendor review
Works like SIG Lite or the CSA CAIQ, with a risk register. Judge a vendor's answers against their evidence and make the call.
Works like SIG Lite or the CSA CAIQ, with a risk register. Judge a vendor's answers against their evidence and make the call.
Third-party risk
Risk management
Security questionnaire, returned for access to the patient records system.
Attachments
QuickCruit Assistant mapped the evidence on all 11 answers.AI
AI responses can be inaccurate.
Q1Do all Invopath Billing staff who can reach customer data sign in with multi-factor authentication?
Vendor response
Yes. MFA is required for every workforce account at our identity provider. A screenshot of the sign-in policy is attached.
Environment: staging. Policy: require multi-factor authentication. Assigned to: all users. State: on. Captured by Invopath Billing IT.
QuickCruit AssistantAI
This evidence partly satisfies question 1. The evidence backs only part of the response, so it's worth a follow-up.
Suggested rating: Needs follow-up
Q2How often do you review who has access to customer data, and how fast do leavers lose it?
Vendor response
Managers recertify access every quarter. An HR termination disables the account automatically within one business day.
Test: for 25 sampled leavers, compared HR termination dates with account disable dates. Result: no exceptions noted.
QuickCruit AssistantAI
This evidence satisfies question 2. The evidence backs each claim in the response.
Suggested rating: Satisfactory
Q3Who can change production systems, and does every change get approved?
Vendor response
Only the platform team can deploy. Every change needs a second engineer's approval in our deployment tool.
Test: inspected 40 sampled production changes. Result: exception noted. 1 of 40 changes had no recorded approval. Management response: approval was made mandatory in the deployment tool in March. Retest of 15 later changes: no exceptions.
QuickCruit AssistantAI
This evidence satisfies question 3. The exception in the evidence was fixed and retested clean, so the control works now.
Suggested rating: Satisfactory
Q4How is our data protected in transit between Lakeshore Family Health and Invopath Billing?
Vendor response
TLS 1.2 or higher on every connection, with older protocols turned off and HSTS on every web endpoint.
TLS 1.0 and 1.1 disabled on all tested hosts. No weak cipher suites found.
QuickCruit AssistantAI
This evidence satisfies question 4. The evidence backs each claim in the response.
Suggested rating: Satisfactory
Q5Is our data encrypted at rest, including backups and any copies?
Vendor response
Yes. Our production databases are encrypted with AES-256.
Nightly database exports are copied to the archive bucket and kept for 35 days. Archive access is limited to the operations team.
QuickCruit AssistantAI
This evidence satisfies question 5. The response confirms the control, and the evidence covers the backups and any copies.
Suggested rating: Satisfactory
Q6If an incident affects our data, how soon will you tell us?
Vendor response
We notify affected customers within 30 days, once our investigation is complete.
Customer notice follows completion of the internal investigation, within 30 days.
QuickCruit AssistantAI
This evidence partly satisfies question 6. The evidence backs only part of the response, so it's worth a follow-up.
Suggested rating: Needs follow-up
Q7When was your last independent penetration test, and is anything still open?
Vendor response
An outside firm tested us in March. No critical or high findings. Two mediums were fixed and passed a retest in April.
Findings: 0 critical, 0 high, 2 medium (fixed, retest passed), 4 low.
QuickCruit AssistantAI
This evidence satisfies question 7. The evidence backs each claim in the response.
Suggested rating: Satisfactory
Q8How fast can you restore service after an outage, and when did you last prove it?
Vendor response
Recovery point 4 hours, recovery time 24 hours. We restore from backup into a clean environment every quarter. August's test passed.
Test: inspected the last two restore tests. Both met the stated recovery objectives. Result: no exceptions noted.
QuickCruit AssistantAI
This evidence satisfies question 8. The evidence backs each claim in the response.
Suggested rating: Satisfactory
Q9Is our data ever copied into development or test environments?
Vendor response
No. Test environments use generated data only. Production access is limited to the on-call team and logged.
Test: inspected test data sources for 10 sampled releases. All used generated data. Result: no exceptions noted.
QuickCruit AssistantAI
This evidence satisfies question 9. The evidence backs each claim in the response.
Suggested rating: Satisfactory
Q10Will any other company (a subprocessor) touch our data?
Vendor response
Two: our cloud host and our email delivery provider. The list is public, and we give 30 days notice before adding one.
Test: inspected risk reviews for both subprocessors. Both current. Result: no exceptions noted.
QuickCruit AssistantAI
This evidence satisfies question 10. The evidence backs each claim in the response.
Suggested rating: Satisfactory
Q11Will you sign our Business Associate Agreement before you receive any protected health information?
Vendor response
Yes. It's signed on your template with no changes. Our copy is attached.
Status: signed by both parties. Version: Lakeshore Family Health template, no changes.
QuickCruit AssistantAI
This evidence satisfies question 11. The evidence backs each claim in the response.
Suggested rating: Satisfactory
Should Invopath Billing get access to the patient records system?