Patient information has rules. The tool has to keep them.

On the call, we would ask

• Which tools in the practice already see patient information, including the ones nobody approved?
• Does the vendor sign the agreement your rules require for a third party handling patient data?
• Where does the tool store what it reads, and for how long?
• Who in the practice owns this question?