The dashboard says 94 percent complete. Open the six percent.
One overdue control should tell you more about healthcare compliance software than a polished tour of green charts. Who owns the work? What failed? Which source requirement applies? Where is the evidence? Who accepted the fix, and can an auditor reconstruct the sequence without a vendor employee filling the gaps?
That sequence is the product test. A percentage is decoration until the underlying record holds up.
Quick answer
- Start with the practice’s real risk register, not the vendor’s control count.
- Trace obligation, control, test, exception, corrective action, approval, and export.
- Keep legal conclusions and clinical decisions with qualified people.
- Treat migration and offboarding as buying criteria, not contract clean-up.
Start with work the practice already owns
Healthcare compliance software is a broad label. One product may focus on HIPAA security work. Another may add fraud-and-abuse training, policy management, OSHA tasks, vendor oversight, incident intake, or credential files. Buying all of those modules does not establish that any one of them fits the practice.
The HHS Office of Inspector General’s General Compliance Program Guidance is voluntary, nonbinding guidance. It describes compliance-program infrastructure and tells organizations to adapt the work to their size and risks. That makes a useful procurement rule: map software to a program the organization has approved. Do not let the software silently define the program.
Build a one-page scope before the demo:
| Workstream | Accountable owner | Source of obligation | Proof produced |
|---|---|---|---|
| HIPAA security risk management | security and privacy leadership | current rule, OCR guidance, risk analysis | risk record, treatment decision, test result |
| Billing and federal-program compliance | compliance and billing leadership | applicable law, payer terms, OIG guidance | audit sample, finding, refund or correction trail |
| Workplace safety | safety and operations leadership | federal or state-plan OSHA requirements | programme, inspection, training, incident record |
| Vendor oversight | contract, privacy, and security owners | contract, BAA, policy, risk decision | diligence file, approval, issue, offboarding proof |
The table is deliberately short. A useful system can grow from it. A system that needs 900 imported controls before it can show one accountable loop is charging the practice to curate someone else’s database.
Trace one obligation end to end
Pick a requirement the practice understands. A HIPAA Security Rule risk-analysis item works well because the evidence crosses people, systems, and time.
The HHS OCR risk-analysis guidance says the analysis must cover electronic protected health information held by the organization and be accurate, thorough, and documented. It does not prescribe one universal form. The analysis should also be updated as technologies, operations, incidents, ownership, or other conditions change.
Ask the vendor to perform this sequence in a clean trial tenant:
- Record the source requirement and the practice’s interpretation.
- Link a system, owner, threat, vulnerability, current safeguard, and risk decision.
- Attach evidence without placing live patient information in the trial.
- Record a failed control test and assign corrective work.
- Approve the corrective action while preserving the earlier failure.
- Change the control owner, then show both the old and new assignments.
- Export the complete record in a readable, reusable format.
The sixth step catches a common weakness. A dashboard may show the current owner while erasing the handoff that explains why a task sat untouched for 19 days.
Separate the library from your record
Vendors often sell a maintained content library. That can save research time. It can also blur four different objects:
- the external source as published by the authority;
- the vendor’s summary of that source;
- the organization’s decision about applicability;
- the control and evidence used in this setting.
The software should preserve all four without presenting the vendor summary as law. Look for source links, effective dates, version history, review ownership, and a way to mark a requirement as not applicable with a reason and approval.
When a library item changes, test the impact workflow. Who receives the alert? Can the reviewer compare versions? Does the platform reopen affected controls, or merely put a red dot beside a document nobody owns?
Make failure visible
Compliance work is mostly exception work. The product should be comfortable showing a failed test, disputed interpretation, overdue correction, rejected attachment, or risk that leadership has formally accepted.
Use a synthetic control with incomplete evidence. Try to close it. A credible workflow should require the fields and approvals your program defined. It should not turn green because somebody uploaded a file named policy-final-v7.pdf.
Then test recurrence. Close the action, schedule a recheck, fail the recheck, and compare both cycles. If the second finding overwrites the first, trend reporting will lie.
Inspect permissions and data handling
The software may hold incident narratives, workforce details, contracts, investigation notes, security findings, and documents containing PHI. Buyers need a data map before they need an interface tour.
Ask what data the service receives, where it is stored, which subprocessors handle it, how administrators gain support access, what audit events are recorded, and how data is returned or destroyed. If the vendor is a HIPAA business associate for the proposed use, contract and BAA review belongs in the buying process.
Run a role test with four synthetic users: control owner, reviewer, system administrator, and read-only auditor. Remove one user. Confirm that access ends without erasing the person’s prior actions.
Demand an exit, not just an export button
Export a control register, evidence files, comments, approvals, tasks, attachments, user history, and the relationship between them. A folder of PDFs plus an unrelated CSV is not a usable exit if nobody can tell which evidence supported which test.
Ask the vendor to document identifiers and relationships in the export. Record file hashes or another integrity check where your policy requires one. Time the exercise. The result becomes a contract schedule instead of a hopeful sentence about data portability.
Run a 30-day proof
A small practice can learn enough from a narrow pilot:
| Week | Test | Exit signal |
|---|---|---|
| 1 | configure two real workstreams and roles | owners can find their work without vendor coaching |
| 2 | run evidence collection and one failed test | failure stays visible and routes correctly |
| 3 | change one requirement and one staff role | version and access histories remain intact |
| 4 | export and reconstruct the record | an independent reviewer can follow the loop |
Do not score the pilot by how many templates were activated. Score missing evidence, time to resolution, false closure, unowned tasks, permission defects, and export reconstruction.
Patient Square does not present this article as a claim that its products replace a healthcare compliance-management system. Use the worksheet to define the boundary between clinical operations, documentation tools, security records, and the system that owns formal compliance evidence.