Image 1 of 1
Image 1 of 1
Image 1 of 1
Image 1 of 1
The workpaper for approving an AI tool before sensitive data goes in. 51 scored questions, 11 gating items, and an approval record you can defend.
Before anyone sends patient, customer, or confidential business data to an AI tool, someone should be able to say what the tool does with it and show the evidence. This questionnaire is how I run that review.
What's in it:
Section A defines the proposed use: what data goes in, through which account, for what purpose, and where the output goes.
Sections B through I cover the governing contract (including a HIPAA business associate agreement check), training use, retention and deletion, vendor access and subprocessors, model-change notice, legal process and breach notice, isolation, liability, and what you actually configured.
11 gating items cap the data a tool may receive until the gaps close.
Section J records the decision: approved data tier, conditions, what remains unknown, who approved it, and when to review again.
Every answer gets a source, a date, and an owner. Complete it from the vendor's published terms and your own admin console; no vendor call required.
Editable Word file plus a PDF. Use it for every AI tool you review.
This is a compliance workpaper. It is not legal advice.
The workpaper for approving an AI tool before sensitive data goes in. 51 scored questions, 11 gating items, and an approval record you can defend.
Before anyone sends patient, customer, or confidential business data to an AI tool, someone should be able to say what the tool does with it and show the evidence. This questionnaire is how I run that review.
What's in it:
Section A defines the proposed use: what data goes in, through which account, for what purpose, and where the output goes.
Sections B through I cover the governing contract (including a HIPAA business associate agreement check), training use, retention and deletion, vendor access and subprocessors, model-change notice, legal process and breach notice, isolation, liability, and what you actually configured.
11 gating items cap the data a tool may receive until the gaps close.
Section J records the decision: approved data tier, conditions, what remains unknown, who approved it, and when to review again.
Every answer gets a source, a date, and an owner. Complete it from the vendor's published terms and your own admin console; no vendor call required.
Editable Word file plus a PDF. Use it for every AI tool you review.
This is a compliance workpaper. It is not legal advice.