The New Visibility Gap in Vendor Risk

Most healthcare organizations already maintain mature Third-Party Risk Management (TPRM) programs. Over the years, those programs have become increasingly sophisticated around:

• PHI governance
• cybersecurity controls
• vendor onboarding
• contractual safeguards
• privacy compliance
• data handling reviews
• application inventories
• ongoing risk monitoring

But, AI fundamentally changes what organizations purchase.

Healthcare entities are no longer just procuring software platforms or hosted infrastructure. They are acquiring systems capable of learning, summarizing, inferring, recommending, prioritizing, automating, and in some cases independently acting on sensitive information and operational workflows.

That introduces entirely new categories of exposure.

During the session, Kelly described this challenge as a growing “visibility gap” inside traditional TPRA workflows. Existing questionnaires were never designed to assess:

• AI governance maturity
• model integrity
• training data exposure
• hallucination controls
• prompt retention practices
• ethical safeguards
• autonomous decision-making
• AI supply chain dependencies
• external model integrations

And in healthcare environments, those gaps can carry significant consequences.

When AI-driven outputs influence workflows tied to patient care, claims processing, fraud analysis, care management, or clinical decision support, transparency and accountability become far more than compliance exercises. They become operational risk issues.

Extending TPRA Instead of Replacing It

One of the strongest aspects of Kelly’s presentation was its practicality.

At Community Health Network of Connecticut, Inc. (CHNCT), the approach was not to build a completely separate “AI governance program” disconnected from existing processes. Instead, the organization extended its current TPRA framework with targeted AI-specific controls and assessment questions.

That distinction matters.

Many organizations risk creating what some leaders now describe as “AI governance theater” — large policy structures that appear comprehensive but fail to integrate into operational workflows that teams already use daily. CHNCT instead incorporated AI governance directly into its established GRC-driven vendor management process and Master Vendor and Application List (MVAL). The goal was not to create friction for the sake of governance. The goal was visibility.

As Kelly emphasized during the session:  “You can’t get what you don’t ask for.”

That deceptively simple statement may be one of the most important lessons for organizations currently reviewing vendors.

Because many vendors are already embedding generative AI, machine learning, copilots, external LLM integrations, and autonomous functionality into products without customers fully understanding where or how those capabilities operate.

The Questions That Reveal Real Maturity

Instead of relying on lengthy, overly complex questionnaires, CHNCT implemented a streamlined set of AI-focused assessment questions aimed at quickly determining whether vendors genuinely understand the risks, governance requirements, and operational implications of their AI technologies.

Some of the most effective examples included:

• Does the product contain AI or machine learning functionality?
• Has the organization updated its Code of Ethics to account for AI usage?
• Has the Acceptable Use Policy been revised for AI/ML technologies?
• Does the platform recognize and enforce data classification controls?

Those questions alone often reveal whether a vendor has operationalized responsible AI governance or has added AI features faster than governance processes can keep up.

The framework then expanded into deeper operational areas, including:

• integrations with external models or datasets
• human validation of AI-generated outputs
• auditing of autonomous actions
• hallucination monitoring and mitigation
• sandbox testing environments
• OWASP AI vulnerability assessments
• PHI and PII handling within AI workflows
• confidentiality protections around training data
• prompt retention and logging practices
• lifecycle governance controls

Importantly, the process focused less on “checking boxes” and more on initiating meaningful conversations with vendors.

That operational mindset is increasingly critical because many organizations are discovering that vendor AI governance maturity varies dramatically — even among major technology providers.

Healthcare’s AI Challenge Is Different

One theme that stood out repeatedly throughout the session was that healthcare AI governance is fundamentally different from many other industries.  In healthcare, inaccurate outputs, poorly governed automation, or opaque decision-making processes can directly affect patient outcomes, operational continuity, regulatory exposure, and public trust.   That raises the stakes considerably.

To address this, CHNCT aligned portions of its approach with broader “Responsible Use of Artificial Intelligence” principles emphasizing:

• multidisciplinary review
• lifecycle governance
• ongoing monitoring
• transparency
• ethical usage
• continuous risk mitigation

The presentation also connected practical implementation with emerging industry guidance rather than attempting to invent entirely new frameworks from scratch.  Among the resources referenced were:

• OWASP Top 10 for LLM Applications
• HECVAT (Higher Education Community Vendor Assessment Toolkit)
• Connecticut Responsible AI Policy Framework
• Microsoft Responsible AI Impact Assessment Template

That balance between operational execution and alignment with evolving standards is exactly what many healthcare organizations are actively searching for right now.

Why Practitioner-Led Conversations Matter

Another reason the session resonated so strongly was because it came from an operator actively building these processes internally — not from a heavily scripted vendor presentation.

That practitioner perspective was a recurring strength throughout this year’s H-ISAC Spring Summit overall.

The event consistently emphasized peer-driven discussion, implementation realities, operational constraints, regulatory pressure, and lessons learned from healthcare environments. There was noticeably less “marketing theater” and substantially more candid discussion around what organizations are truly encountering across healthcare security and risk management programs today.

That same spirit is expected to continue later this year at the NorthEast Annual Cybersecurity Summit (NEACS) at Quinnipiac University, where Brian Kelly is scheduled to present an updated version of this work.

Given how quickly AI adoption is colliding with third-party risk exposure across healthcare, higher education, financial services, and critical infrastructure, the topic is likely to attract significant executive attention.

Because the uncomfortable reality is becoming increasingly difficult to ignore:

🤖 Many organizations are already inheriting AI risk through vendors long before formally deploying AI internally.

👁️ And if TPRA processes are not asking AI-specific questions yet, the visibility gap may already be wider than leadership teams realize.

COMMENTS?? 

Find the SUMMARY version of this article on LinkedIn, and post your comments there.