Annual review: Kiteway Check-In

1. Patient data access and data types are still accurate

Ask the internal owner what the vendor actually touches today, not what the contract says.

If the answer is no, correct it first under Data, access and contacts; the BAA requirement and risk tier are recomputed from the new answer.

2. A signed, current BAA is on file with the required terms

Breach notice within 60 days, termination for breach, return or destruction of data, subcontractor terms. Check the signature and effective dates on record against the signed copy. A BAA entered long after it was signed that covers days already held is confirmed separately, on the vendor page.

3. Security evidence is current

Every vendor with patient data: a questionnaire from the last 12 months. Vendors rated critical or high before any evidence points also need a SOC 2 report or HITRUST certification that is still valid.

For this vendor: Before any evidence points it rates moderate, so it needs a security questionnaire from the last 12 months. A SOC 2 report or HITRUST certification is welcome but not required.

4. Subcontractors that handle our data are listed and bound by the same terms

Mark not applicable only if the vendor uses no subcontractors for our data.

5. No security incidents or breach reports since the last review

Mark failed if anything was reported, even if it was resolved, and describe it in the notes.

6. A named internal owner is still responsible for this vendor

Someone at the practice who would notice if the service changed.

Outcome