Clinical and operational accountability
Identify who remains responsible for decisions, records, follow-up and patient communication. Test normal work, urgent exceptions, downtime and human override. Document where automation ends and professional judgment begins.
Privacy and information handling
Confirm purpose, necessity, consent, data categories, hosting, cross-border processing, subprocessors, model providers, access, retention, deletion and secondary use. Complete the applicable EFVP for the exact project.
Security and identity
Review authentication, least privilege, role changes, logging, encryption, incident response, vulnerability handling, backups and recovery. Ask how the clinic detects misuse and retrieves evidence after an incident.
Patient and commercial resilience
Test French, English, accessibility, identity, sensitive messages, urgent escalation, caregiver access and alternatives. Check service levels, support, insurance, subcontractor dependence, portability and termination. Assign every open risk to an owner and date.
