Network Vendor Review: What athenaOne Practices Expect

If your practice belongs to a physician enablement network, a management services organization, or an independent physician association, you already know that adopting software is not a decision you make alone. Before a new vendor touches athenaOne or sees a patient record, the network runs its own review. Security controls, data handling, business associate terms, and increasingly how the vendor uses AI with protected health information.

Practices tend to discover this review at the worst possible moment: after they have picked a vendor, built internal enthusiasm, and set a go-live date. The review then takes weeks nobody budgeted for, and some of it gets repeated because the vendor was not ready for the questions.

This article covers what these reviews actually look at, and what to ask a vendor before you start one.

What a network vendor review covers

Reviews differ by organization, but the substance converges on five areas.

Security controls. How the vendor stores and transmits data, who inside the vendor can reach it, how access is logged, and what independent assessment backs the answers. Expect to be asked for a current SOC 2 Type II report or an equivalent, and expect the network to actually read it.

Data handling and retention. What leaves your athenaOne instance, where it is processed, how long it is kept, and what happens to it when you stop using the product. Vague answers here stall reviews more than any other topic.

Business associate terms. Whether the vendor will sign the network’s BAA rather than insisting on its own, and whether its subprocessor list is disclosed and current.

AI usage specifically. This is the newest section and the one most vendors handle badly. A reviewer wants to know what the models see, whether protected health information is used for training, where inference runs, what is retained afterward, and how staff stay in control of the outcome. “We use AI responsibly” is not an answer. The answer is a data flow.

Integration method. Whether the vendor connects through the EHR’s sanctioned integration path or works around it. For athenaOne practices this is straightforward to verify, and a vendor that cannot describe its own integration depth precisely is a vendor that will struggle in review.

Why the AI section is where reviews stall

Most vendor security programs were built before generative AI was in the product. The questionnaire asks about encryption at rest and gets a clean answer. Then it asks whether patient data is used to train a model, and the vendor’s own team is not sure, because the answer depends on which subprocessor is handling which call and under what contract.

A practice can shortcut a lot of this by asking three questions early:

1. Is protected health information used to train or fine-tune any model, by you or by any subprocessor?
2. Where does inference run, and under what contractual terms with the model provider?
3. What is retained after a call or message is handled, for how long, and can we configure it?

If a vendor cannot answer those three in writing on a first call, the network review will not go quickly.

What completing a review does and does not mean

This is where expectations most often break.

Completing a network’s vendor review means the vendor has satisfied that organization’s diligence process. It is a procurement and security milestone, and a real one. It is not an endorsement, a recommendation, or a certification, and it does not commit the network or any of its practices to buying anything. Each practice still makes its own decision on its own timeline.

It also does not substitute for the EHR’s own review. On athenaOne, a vendor listed in the athenahealth Marketplace has passed athenahealth’s integration review, which is a separate process with separate criteria. A practice inside a network gets the benefit of both, but they are not interchangeable and neither one implies the other.

Be cautious with vendors who describe a completed review as approval to deploy anywhere in the network. Passing a network’s review generally permits the vendor to market to that network’s practices. The deployment decision stays with the practice.

Where Pretty Good AI fits

Pretty Good AI is built exclusively for athenaOne practices. We have completed third-party vendor reviews with physician networks whose practices run on athenaOne, including the AI-usage portion of those reviews, and we are listed in the athenahealth Marketplace.

Practically, for a practice inside a network, that means the security and AI documentation a reviewer asks for already exists and has survived that kind of scrutiny before. It does not mean your network has approved us for your practice, and we will not tell you it does. If your organization requires its own review, we will go through it.

What we can tell you up front: we do not use protected health information to train models, our integration runs through athenaOne’s sanctioned API path, and we will sign your network’s business associate agreement rather than insisting on ours. Every workflow is tailor-fitted to your protocols, your processes, and your rules. Live in weeks, and refitted as your needs change.

What to ask before you start

If you are early in evaluating any AI vendor from inside a network, the questions that save the most time are the unglamorous ones.

• Have you completed a vendor review with a physician network or MSO before, and can you describe what it covered?
• Will you sign our network’s BAA?
• Can you provide a current SOC 2 Type II report?
• Is protected health information used for model training, by you or any subprocessor?
• Do you connect through athenaOne’s sanctioned integration path?
• What does your documentation package include, and can we see it before we start the review?

A vendor that has been through this before will answer all six quickly, because the documents already exist. A vendor that has not will assemble them while your review clock runs.