An AI evidence pack for a healthcare group's insurer renewal and a hospital customer's vendor questionnaire
An outpatient medical group in Arizona with six clinics and about 140 clinicians, a leader in its segment.
- Scale
- 6 clinics, about 140 clinicians, 9 AI tools in use, 12 evidence artifacts, 1 insurer renewal, 1 hospital questionnaire
- Engagement
- Eight weeks to assemble the pack, then a refresh before each renewal
The challenge
Two requests arrived in the same quarter. The group's cyber insurer added questions about AI use to the renewal, and a hospital that refers patients to the group sent a vendor questionnaire asking how AI tools handle patient information. Clinicians had adopted a transcription assistant, a scheduling bot and a coding assistant, mostly without central approval. The administrator could not answer either request from records, only from memory.
An outpatient medical group in Arizona with six clinics and about 140 clinicians received two requests in the same quarter. Its cyber insurer added questions about AI use to the renewal, and a hospital that refers patients to the group sent a vendor questionnaire asking how AI tools handle patient information. Clinicians had adopted a transcription assistant, a scheduling bot and a coding assistant, mostly without central approval. The administrator could answer both requests only from memory, and an answer from memory is the kind that fails a later review.
We started with an inventory of the nine AI tools in use: who uses each, which data it reaches, whether a business associate agreement is in place, and where patient information could be pasted into a prompt. For the tools that act on their own we built an identity and permission register with a yearly access review. A human-review map shows where a clinician must check AI output before it reaches a chart or a patient, and the group tested how to switch each tool off, because a kill switch no one has tried is a hope.
The technical controls were documented rather than newly invented. Clinical systems sit on segments apart from guest and office networks, and staff who reach patient records sign in with phishing-resistant methods. We exported configurations and drew diagrams so that each statement the group makes has a file behind it. For the tools that offer logging we collected the evidence, and for each tool we wrote down plainly what it does not log. Honest limits help a reviewer more than a claim of full visibility.
We drafted an AI use policy and a training record for the group's executive to adopt and sign, because a policy only counts when the accountable person owns it. Then we built a crosswalk from the twelve artifacts to the insurer's wording and the hospital's questionnaire, and ran a consistency check: what the group had attested on past applications against what the evidence shows. Two answers were out of date, and the group corrected them before it sent anything.
The group sent the same pack to its broker, its counsel and the hospital, and answered both requests from documents in days rather than by reconstruction. In this illustrative case the figures are modeled. The pack is technical evidence only. It is not insurance or legal advice, and it does not say the group is compliant or covered: the broker, the insurer and counsel draw those conclusions. The group refreshes the pack before each renewal. Our article on what underwriters ask explains the controls behind the questions.
What our team delivered
- An inventory of the nine AI tools in use: who uses each, the data it reaches, whether a business associate agreement is in place, and where patient information could enter a prompt
- An identity and permission register for the tools that act on their own, with a yearly access review and a record of who can approve a change
- A human-review map showing where a clinician must check AI output before it reaches a chart or a patient, and a tested way to switch each tool off
- Segmentation of clinical systems from guest and office networks, and phishing-resistant sign-in for staff who reach patient records, documented with diagrams and configuration exports
- Logging evidence for the tools that offer it, with a plain statement of what each tool does not log
- A written AI use policy and training records, drafted by us for the group's executive to adopt and sign
- A crosswalk from the twelve artifacts to the insurer's and the hospital's own wording, plus a consistency check between what the group attested on applications and what the evidence shows
Result
The group sent the same pack to its broker, its counsel and the hospital, and answered both requests from documents in days rather than by reconstruction. The pack is technical evidence only. It is not insurance or legal advice, and it does not say the group is compliant or covered: the broker, the insurer and counsel draw those conclusions.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.