Data & Interoperability Readiness

• HL7 FHIR R4 vs. legacy HL7 v2 interfaces mapped for every system the AI needs to read from or write to
• EHR integration points inventoried (Epic, Cerner, or other) with API access confirmed, not assumed
• PHI data-flow diagram exists showing every system the data touches, including any third-party model vendor
• Data quality and completeness assessed for the specific clinical workflow being automated

Governance & Oversight

• An AI governance committee (or equivalent) with clinical, compliance, and technical representation is named and meeting
• A model risk review cadence is defined before go-live, not designed after an incident
• Clinician-in-the-loop sign-off is required for any AI output that influences a diagnostic or treatment decision
• A clear owner is named for monitoring model drift and retraining triggers post-deployment

Compliance & Security

• Current HIPAA risk assessment covers the new AI workflow specifically, not just the base EHR
• Business Associate Agreements (BAAs) are in place with every vendor touching PHI, including the AI/ML vendor
• Audit logging covers AI-generated recommendations and clinician overrides, not just data access
• FDA Software as a Medical Device (SaMD) classification has been assessed if the tool influences diagnosis or treatment

Clinical Change Management

• Clinical workflow impact assessment completed with the staff who will actually use the tool day to day
• A training plan exists for clinicians and administrative staff before go-live, not a user manual after
• A rollback plan exists — if the AI output is untrustworthy in production, staff know how to revert to the manual process

Regulatory Fit

• Does the vendor disclose FDA SaMD classification status (if applicable) rather than avoiding the question?
• Will the vendor sign a BAA, and does their infrastructure meet HIPAA technical safeguards without exception?
• Is there a documented process for handling a regulatory audit request involving the vendor's model?

Interoperability

• Native HL7 FHIR R4 support, or a documented integration path for HL7 v2 environments
• Confirmed integration experience with your specific EHR (Epic App Orchard / Cerner CODE, or equivalent)
• No forced data export to a vendor-hosted environment outside your existing data governance boundary, unless explicitly accepted

Clinical Validation

• Peer-reviewed or clinically validated performance data disclosed — not just an internal benchmark
• Real-world performance data available, not only a controlled-study result
• Explainability sufficient for a clinician to understand why a recommendation was made, not just what it was

Total Cost & Governance

• Total cost of ownership modeled over 3 years, including retraining, support, and integration maintenance
• Model retraining cadence and drift-monitoring process disclosed and contractually committed to
• Exit plan exists — data portability and de-implementation process defined before signing