The queue was sorted by arrival, not by risk
Northwind Health reviewed every vendor the same way, whether it was an imaging platform holding protected health information or a catering supplier with a car park pass. Requests were worked in the order they landed in the ticket queue, which meant a scheduling tool with no patient data could sit ahead of a diagnostics vendor for three weeks.
Two analysts covered all of it. The median review took 38 working days, and the number that mattered more was the variance: an urgent clinical request could take anywhere from a week to two months depending on what else had arrived that day.
Routing by data sensitivity
Intake now asks two questions before anything else: what data class does this vendor touch, and does it connect to a clinical system. Those answers pick the tier, and the tier picks the evidence.
A tier 4 vendor — no patient data, no network access — clears against a public trust page and an attestation, usually inside a day. A tier 1 clinical vendor gets the full questionnaire, a review of the current pen test, and a named clinical owner who signs off. The analysts spend their time on the reviews that can hurt someone.
“We stopped treating the car park vendor and the radiology platform as the same problem. That was most of the 38 days right there.”
What the year looked like
- Every one of the 240 existing vendors was re-scored against the sensitivity model, which surfaced eleven that had been approved years earlier under rules nobody could now reconstruct.
- Evidence for the 60 vendors shared across all six sites is collected once, not six times.
- The queue is cleared weekly. It has not carried work into a second week since November.
What’s next
The same tiering is being extended to research collaborations, which arrive through a different front door and have never been part of the vendor programme. The review team is still two people.
About Northwind Health
Northwind Health runs six hospitals and thirty outpatient clinics in the upper Midwest. 9,400 staff, HIPAA-regulated, HITRUST r2 certified. Priya Raman leads the information security team that reviews every vendor touching patient data.
