ESBD_566676_1791559267189_Joint Tech - Technical Review with AI Questions.pdf

Version 7/13/2026

CATEGORY QUESTION NO. QUESTION

1 Describe data center security standards for the hosted solution.

2 Describe data center compliance with those standards, including independent audit results or certifications.

3 Attach a security architecture diagram.

4 Attach a copy of the most recent data center SOC audit or other self-attestation regarding security and compliance.

5 Describe data center tier rating(s) and resiliency for redundancy and failover.

6 Describe the physical locations of data centers that will host our data, including those for redundancy. If the actual locations cannot be revealed, describe them geographically in terms of distance.

7 Describe any locations that are off-shore from the Continental United States.

8 Describe failover design.

9 Describe disaster recovery protocols and how data is restored.

10 Describe the thresholds and protocols to notify the customer when disaster recovery protocols are triggered.

11 Is there a dedicated Information Security Officer or CISO responsible for security architecture and operations?

12 Describe incident response protocols and how security events are investigated and remediated.

13 Describe Risk Management and Risk Assessment protocols, including any 3rd party Risk Assessments.

14 Describe Penetration Testing protocols including frequency.

15 Describe physical security controls for any facilities in which our data may be processed.

16 Are internal systems protected with dedicated firewalls and anti-virus software?

17 Describe security within your development lifecycle - are DAST or SAST tools implemented?

18 Describe State and Federal Security Audit Certifications obtained such as TX-RAMP, FedRAMP, StateRAMP, FISMA, etc.

19 Describe any SSO or Federation capabilities.

20 Describe any MFA or 2FA capabilities.

21 Describe any other integration capabilities.

22 Describe the backup process, including but not limited to, frequency and method (e.g., incremental/full, onsite/offsite).

23 If the backup process involves a third party network/server/vendor, please identify the third party(ies).

24 Describe routine and emergency maintenance protocols.

25 Describe up-time.

26 Describe the protocol for monitoring services.

27 Describe Service Level Agreement.

28 Describe data retention protocols.

29 If data is not retained indefinitely, describe the alternatives for storage and destruction.

30 Describe scalability for growth of data.

31 Describe our ownership rights to the data while under contract and in the event the contractual relationship is terminated.

32 Is data used for any other purpose other than our stated purpose?

33 Is data encrypted during transit?

34 Is data encrypted at rest?

35 Describe measures or architecting strategies to protect health-related data for HIPAA compliance.

36 Describe data separation environment and/or shared computing resources so that we fully understand the physical or virtual machine environment that supports its data.

DATA CENTER

SECURITY &

COMPLIANCE

AVAILABILITY,

MONITORING &

ALERTS

PROTECTED HEALTH

INFORMATION /

HIPAA

REDUNDANCY &

DISASTER RECOVERY

BACK-UP,

MAINTENANCE

AUTHENTICATION

DATA PROTECTION,

RETENTION & USE

SECURITY

OPERATIONS

37 Describe the protocol to notify customers of security breaches.

38 Is this a web-based application? If not, describe the application such as locally installed on computers or on-premise environment.

39 Identify all compatible operating systems.

40 Identify all compatible browsers.

41 Identify all compatible devices, such as PC, laptops, tablets, etc.

42 Is there a mobile app? If yes, describe whether it is available for iPhones, Windows, Android.

43 Describe the service desk support process and resources, including but not limited to customer portal, hours of operation, escalation paths.

44 If available, describe the various levels of support plans and their cost.

45 Describe recommended certifications to properly administer the services from the customer side.

46 Describe training and continuous learning resources to properly administer the services from the customer side.

AGREEMENTS 47 Attach a copy of, or provide an online link, to the following documents:

a. All Terms and Conditions which may include, but not be limited to,

i. Business Associate Agreement

ii. End User License Agreement and/or all other licensing agreements

iii. Service Level Agreement

iv. Support and Warranty Agreements

b. All other documents and/or agreements not listed above that will require signature or attestation by Central Health in order to secure a contract.

AI (If Applicable) 48 Technical: Describe the E2E architecture of your solution, including key components (e.g., data ingestion, processing, model layers, storage, integration points, and user interfaces), deployment model (cloud/on-prem/hybrid), and how data flows across each stage. Include any dependencies, scalability mechanisms, and high-availability design considerations.

49 Technical: Does the AI "learn" from our patient data? If so, how do you prevent PHI leakage, including data isolation, de-identification, access controls, encryption. Is customer data used to train shared models?

50 Technical: Where is data processing happening and is data being sent to third-party LLM providers? If Yes, identify the providers, data shared, and confirm whether a BAA is in place.

51 Technical: For HITL (Human-In-The-Loop) workflows, what confidence score thresholds trigger straight-through processing vs. human review, and how are these thresholds defined, calibrated, and monitored?

52 Technical: Does the solution support active learning or feedback-based improvement? If so, describe: (a) the mechanism by which corrections or user feedback are incorporated; (b) how model updates are validated before redeployment (including regression testing); (c) the approval process for model retraining using our data; and (d) how the System (Central Health, Sendero, CUC) is notified of material model changes.

53 Technical: How does the system ingest, process, and extract insights from unstructured data (e.g., text, PDFs, images, audio), and what techniques are used to ensure accuracy and data quality?

54 Explainability: If an application is rejected, can the system generate a "Reason Code" or a natural language explanation ?

If yes, describe how these outputs are generated, validated for accuracy, and audited for consistency and compliance.

55 Bias Mitigation: Have you tested the model for bias in general? How have you tested the model for bias against certain demographics ? Is there any documented bias testing performed?

Bias can include but is not limited to biases on human factors such as gender, race, socioeconomic status, disability, culture, age, or other protected classes, or biases on general factors such as a sampling bias, survivorship bias, detection bias, or observer bias.

56 Model Versioning: How do you detect and manage model drift, and what is your process for updating and re-validating models when, for example, new document types are introduced or existing formats change? Include typical turnaround time, validation approach, and version control practices

57 Auditability: Does the system maintain a thread of evidence? Can an auditor see, for example, exactly which part of a scanned document the AI used to extract a specific data point?

SUPPORT, ON-GOING

ADMINISTRATION &

TALENT

WEB-BASED, OS &

BROWSER

COMPATABILITY

58 Hallucination Prevention: What guardrails and validation checks are in place to prevent hallucinated values (e.g., dates, addresses), for example, when source data is missing or unreadable, how does the system detect, flag, and handle low-confidence or incomplete inputs?

59 Input Validation: How does the system detect and handle adversarial or fraudulent inputs (e.g., tampered or synthetic documents), include validation techniques, fraud detection methods, and escalation workflows?

60 AI Model Training: Copy of the policy of the AI model training data usage 61 Incident Response Plan: Copy of the plan documented 62 Business continuity/disaster recovery plan documented DPA Data Processing Agreement (DPA) (if applicable)

Other Data protection Frameworks Vendor complies with (e.g., NIST 800-53, NIST AI RMF) and certifications (e.g., SOC II, HIPAA (R42C1), FERPA, CJIS (R72C1).

CJIS CJIS Security Addendum (If applicable) Insurance Certificates Cyber Liability and E&O Regulatory Regulatory: Has this AI solution been assessed for classification as Software as a Medical Device (SaMD) under FDA guidelines? If applicable, describe any

FDA submissions, clearances, or 510(k) exemptions. Does the solution comply with ONC HTI-1 regulations regarding AI-generated clinical decision support (effective 2025)?

Responsible AI Please share any relevant information, links, or resources regarding your organization’s responsible AI strategy

OFFEROR'S COMMENTS

Tech Review