AI Governance Checklist for Healthcare & Regulated Industries

SOC 2 Type II certification confirmed and current

ISO 27001 certification confirmed (where applicable)

Access controls and authentication requirements reviewed

Encryption standards for data at rest and in transit confirmed

Vendor incident detection and response capability assessed

Penetration testing practices and cadence confirmed

Data retention policies reviewed — post-service and post-termination

AI model training data usage terms confirmed

Data residency and international transfer practices assessed

Sub-processor disclosures obtained and reviewed

Privacy rights support capabilities assessed

HIPAA business associate determination made

BAA availability confirmed

BAA terms reviewed for required provisions

Vendor regulatory incident history reviewed

Vendor HIPAA compliance audit or review status confirmed

Contractual data usage rights reviewed and limited appropriately

Vendor liability allocation reviewed

Termination and data return obligations confirmed

Vendor change notification obligations established

Vendor risk tier assigned and documented

Reassessment schedule established proportionate to risk tier

Vendor terms of service change monitoring implemented

Vendor security incident notification tracking established

Regulatory news monitoring for vendor compliance developments

Vendor registry entry maintained with current assessment status