Healthcare vendor review
Reviewing cloud vendors in a healthcare payment workflow
Identify which cloud services handle ePHI, establish each vendor’s role, and document who controls access, configuration, recovery, and data return. Encryption is one part of that review.
By Fluid Financial · Sources reviewed November 5, 2026
Look beyond the terminal
A cloud reporting portal, storage service, or connected application can become part of a payment workflow even when staff think of the terminal as the main system. Start by identifying the service behind each portal, export destination, and support process.
Use one synthetic payment to follow the outputs. Ask where reports are stored, which systems receive copies, and whether staff download files to other locations. Record the service and its function before deciding what agreements or safeguards apply.
What HHS says about encrypted cloud storage
HHS explains that a cloud service provider maintaining ePHI can be a business associate even when it cannot decrypt or view that information. Its guidance also addresses how customers and providers should allocate responsibilities. Encryption does not eliminate the need to assess integrity, availability, and other safeguards.
Source: HHS cloud computing guidance.
Apply that guidance to the actual service. A vendor offering multiple products may have different responsibilities for different configurations. Ask which service, agreement, and operating environment the proposed arrangement covers.
Prepare a responsibility matrix
| Area | Questions for the service review |
|---|---|
| Information and purpose | Which fields are stored or processed, and what does the service do with them? |
| Access | Who creates accounts, approves support access, and removes access after a role change? |
| Configuration | Which safeguards are controlled by the customer and which by the provider? |
| Subcontractors and locations | Which parties support the service and where is the relevant information handled? |
| Recovery | Who restores information and how will the practice validate it is usable? |
| Contract exit | How are records returned, exported, retained, or deleted when the service ends? |
Turn broad claims into reviewable evidence
Ask for the service description, relevant agreement, responsibility matrix, and evidence applicable to the proposed configuration. If a vendor supplies an audit report, identify the covered entity, service, period, and exclusions. Compare those details with the service you intend to buy.
Test the operational questions as well. Can an administrator remove a user? Can the practice export the records it needs? Who answers an urgent access or availability issue? Keep a record of unresolved gaps and their owners.
Plan for a service change or exit
Consider a practice replacing its reporting portal. Before switching, it needs a usable export, a way to reconcile outstanding items, and a clear understanding of what the previous provider retains. This example is an operational planning scenario, not a claim about a particular vendor.
Define the sequence before the change: identify required records, assign the export owner, verify the destination and permissions, test reconciliation, and record the agreed retention or deletion actions. Include support and incident contacts for the transition.
Place MedToken in the complete service map
MedToken is designed to remove unnecessary PHI at the transaction processor and create a second token before onward bank processing. MedPay+ combines that technology with merchant processing. Evaluate that handoff separately from the responsibilities of cloud reporting, storage, or other connected services.
Ask Fluid to identify the applicable components and supporting evidence for your proposed deployment. The technical review page provides a starting point for the discussion.
Continue your payment privacy review
Sources and publication information
Original analysis by Fluid Financial. Published November 5, 2026. The checklists are practical discussion tools; apply regulatory requirements to your circumstances with your privacy and compliance advisers.
Review your healthcare payment workflow
Discuss MedToken, your processing requirements, and how MedPay+ could fit your organization.
Request a Technical Review