MicromeetAI
All answers
Security

What should a hospital IT team ask an AI vendor about data security?

Hospital IT teams should ask where patient data is processed, who can access it, how it is encrypted, retained, and deleted, and how incidents are reported. They should also request the certification scope, subprocessor list, customer-visible audit logs, and written contractual evidence.

Each question exists because a common failure hides behind it. Residency decides which laws apply; encryption claims mean little without protocol versions and key-management detail; internal vendor access is where many real-world leaks start; retention terms determine what is still exposed years later; audit logs the hospital cannot see are audit logs it cannot use in front of a regulator; a certification without its scope statement may not even cover the product being sold; incident-notification clauses decide whether the hospital hears about a breach from the vendor or from the news; and every subprocessor extends the attack surface. A vendor that answers all eight in writing is showing its operating model, not its marketing.

Micromeet answers these questions in a published security whitepaper and holds ISO/IEC 27001:2022 certification for its AI application platform development, with encryption in transit (TLS 1.3 where supported) and at rest. Security and governance are two halves of the same evaluation: beyond protecting the data, governed healthcare AI also controls what the AI does with it — every clinical output from MCU CoPilot or AI Scribe (Voice-to-EMR) passes a doctor-review gate with an audit trail before it enters the record. AI writes. Doctors decide.

Related questions

Is ISO 27001 certification enough on its own?+
No. ISO/IEC 27001 proves the organization runs an audited Information Security Management System, not that every product or system is covered. Always request the certification scope, then pair it with penetration-test evidence and contractual terms on residency, retention, and breach notification.
Should we insist on on-premise deployment?+
Not automatically. The sharper questions are where data is processed, who can access it, and what controls and audit evidence apply. Residency guarantees, encryption, access control, and audit logs can be met in more than one deployment model — evaluate the controls, not the label.
What written evidence should the vendor hand over?+
At minimum: a security whitepaper describing architecture and controls, the certification with its scope statement, a recent penetration-test summary, and a data-processing agreement covering residency, retention, deletion, subprocessors, and incident notification.

Micromeet builds governed healthcare AI infrastructure for continuous care. MCU CoPilot, AI Scribe, AI Front Desk and Care Loop support focused workflows; Micromeet Care Workspace carries approved context and next steps between them. Clinicians and authorized staff review consequential outputs. See the public benchmark →

See also

Talk to our team FAQ