Why half of every vendor AI review is about a provider the health system has already reviewed, and what answering that half once looks like in practice
Every AI vendor that reaches a health system gets the same review. Privacy asks what data the application sees. Security sends the questionnaire. Legal opens a BAA and asks whether one exists downstream with the model provider and what that provider keeps. Half of that review is about the vendor's application, and it is different for every vendor. The other half is about the vendor's model traffic, and it is the same handful of questions against the same three or four providers, with an answer that goes stale the day the vendor upgrades its model. This paper separates the two halves, shows why the second is answered the same way every time and why the answer decays, and lays out the alternative: the health system writes the model-traffic half down once, as a route on a governed path in its own cloud account, and every vendor inherits the system's provider agreements, retention configurations, and record. What remains for the reviewer is the application and a registry entry. The paper closes with the checklist: what to ask a vendor once.