A risk tier anyone can recompute

Each vendor gets a score from facts: patient data access (none 0, limited 2, full 4), the kind of service (up to 2), remote access into our systems (1), subcontractors that handle our data (1), and for vendors with patient data, no current SOC 2 or HITRUST (2) and no security questionnaire in the last year (1).

A SOC 2 report or HITRUST certification is an outside auditor's report on how well the vendor protects data, rather than the vendor's own answers. A security questionnaire is the vendor's own answers.

8 and up is critical, 5 to 7 high, 2 to 4 moderate, below 2 low. The tier sets how often the vendor is reviewed: every 6 months for critical, 12 for high and moderate, 24 for low. Missing evidence raises the tier, so a vendor with gaps gets closer scrutiny.

What evidence a review can accept comes from the first four lines only (patient data access, kind of service, remote access and subcontractors), before any evidence points. Every vendor with patient data needs a questionnaire from the last year. A SOC 2 report or HITRUST certification is also required only when those first four lines alone reach high or critical, like an EHR with full patient records. Counting the missing SOC 2 there would let it demand itself, and an answering service, a law firm or a shredding company could never be approved outright.

Every vendor page lists each point and why it was added, so the tier survives an auditor asking "why is the billing company critical?" (answer on screen: full patient records, remote access, subcontractors that handle our data, and a SOC 2 report more than a year old).