Subprocessor and Third-Party Risk in Healthcare AI Vendor Stacks
Practices remain liable for AI vendor breaches even when subprocessors hide the risk.
Darnell Okafor
Section
Compliance & Security
7 stories in Compliance & Security.
Incident Response Obligations When an AI Vendor Has a Breach
Covered entities must notify patients within 60 days, even when the vendor delays.
Priya Subramaniam
Audit Trail and Access Logging Requirements for AI Agents in Healthcare
AI agents accessing patient data must generate detailed audit logs to meet HIPAA requirements.
Soo-Jin Kwak
Payer Portal Access Security Risks in Automated Workflows
Screen-operating agents holding portal credentials create security exposures human logins never do.
Marcus Bellweather
PHI Data Minimization Obligations When Deploying Automation Agents
Automation agents expose PHI across multiple systems and logs beyond traditional compliance checks.
Soo-Jin Kwak
What SOC 2 Type II Actually Certifies — and What It Does Not
SOC 2 Type II audits specific controls within defined scope, not security comprehensively.
Darnell Okafor
HIPAA Compliance Verification for Healthcare AI Vendors
Healthcare organizations, not vendors, bear responsibility for verifying AI compliance.
Priya Subramaniam