Question 1

What does Not Approved status mean?

Accepted Answer

Not Approved means a vendor currently does not meet VNDRIQ's minimum governance and compliance requirements for healthcare deployment involving PHI. This may be due to lack of BAA availability, insufficient security controls, undisclosed AI training practices, or critical compliance gaps.

Question 2

Can I use a Not Approved vendor in my organization?

Accepted Answer

VNDRIQ strongly advises against deploying Not Approved vendors in any workflows involving PHI. Healthcare organizations that choose to proceed against VNDRIQ's guidance should conduct a comprehensive internal compliance review, obtain legal and compliance counsel approval, document the decision formally, and implement compensating controls.

Question 3

What are the primary reasons a vendor receives Not Approved status?

Accepted Answer

Common reasons include: no BAA available or BAA terms are inadequate, AI model training on PHI without documented opt-out, critical security certification gaps, undisclosed data sharing practices, history of regulatory violations, insufficient HIPAA compliance documentation, or failure to respond to compliance verification requests.

Question 4

Can a Not Approved vendor be re-evaluated?

Accepted Answer

Yes. VNDRIQ re-evaluates Not Approved vendors when they publish material improvements to their compliance posture — such as new BAA availability, updated AI training policies, security certifications, or independent compliance audits. Organizations can also request re-evaluation through VNDRIQ's contact process.

Question 5

How long does Not Approved status last?

Accepted Answer

Not Approved status remains until the vendor addresses the governance and compliance deficiencies identified during evaluation. VNDRIQ monitors Not Approved vendors for material changes and re-evaluates when sufficient evidence of improvement is available.

Question 6

What governance concerns typically lead to Not Approved status?

Accepted Answer

Key governance concerns include: absence of HIPAA BAA, active AI model training on PHI, insufficient data retention controls, opaque subprocessor practices, no breach notification procedures, consumer-grade security posture in enterprise healthcare contexts, and lack of any formal compliance program.

Question 7

What alternatives should I consider instead of Not Approved vendors?

Accepted Answer

Healthcare organizations should explore VNDRIQ's Approved and Conditional Approval vendor listings within the same category for viable alternatives that meet baseline governance requirements. The VNDRIQ Vendor Registry and Compare Hub can help identify suitable alternatives.

Question 8

Does a vendor know it is listed as Not Approved on VNDRIQ?

Accepted Answer

VNDRIQ's assessments are based on publicly available documentation and published compliance postures. Vendor assessments reflect VNDRIQ's independent analysis, not vendor self-assessment. Vendors are encouraged to contact VNDRIQ if they believe their compliance posture has materially improved since last evaluation.

Not Approved Healthcare AI Vendors

Governance Concerns Leading to Not Approved

Re-evaluation Policy

Frequently Asked Questions