A Supplier Update Can Change More Than One System
The supplier marked its update complete. A dependent clinical workflow now takes a different path. Consider a healthcare technology vendor that changes an access rule for its data service. The vendor tests the update and confirms that its service works. However, the change may affect how another system retrieves patient information. The Department of Health and Human Services (HHS) includes vendor and supplier cybersecurity requirements in its voluntary Healthcare and Public Health Cybersecurity Performance Goals. These goals encourage healthcare organizations to assess third-party risks and strengthen incident preparedness. A successful vendor test alone cannot confirm that the changes support every dependent workflow.
Hidden Dependencies Create Workflow Risks
A supplier change can disrupt the handoffs that healthcare teams rely on. For example, a new access rule may prevent a clinical application from retrieving information during patient intake. The supplier may see a successful update while the care team encounters missing information. System owners must identify each critical workflow that depends on the supplier. They should map the affected systems, access rules, data exchanges, and support contacts. This helps teams identify where a supplier change affects users before deployment.
HITS Connects Supplier Changes to Release Evidence
Health Information Technology Solutions (HITS) LLC helps federal health programs connect system requirements, configuration control, and quality assurance to release readiness. For DHA’s Individual Longitudinal Exposure Record (ILER), HITS strengthened requirements traceability, quality assurance, and configuration control. Through DHA’s Veterinary Services Systems Management (VSSM) project, HITS supported systems integration engineering and quality assurance to identify defects earlier. HITS also draws on Fortify Static Code Analyzer (SCA) support experience to inform secure-delivery evidence reviews. HITS continues to apply these capabilities to help programs map dependencies, test system handoffs, review configuration changes, and track defects that affect release decisions.
Turn Supplier Requirements Into Testable Evidence
Healthcare programs need more than contract language or a supplier’s confirmation of success. Teams should review five forms of evidence. These include a change notice, a configuration record, an end-to-end test result, an incident contact, and a recovery handoff. Each item answers a different question about the supplier change. The notice identifies what the supplier changed. The configuration record shows the affected settings. Test results show whether dependent workflows still function. Incident contacts and recovery procedures clarify who responds and how teams restore the workflow. Together, these records help leaders assess supplier changes and make better release decisions.
Make Mission Readiness Part of Supplier Acceptance
Before accepting a supplier change, leaders should ask three questions. Who owns the dependence, what did teams test end to end, and who responds when the change fails? These questions help assign responsibility, verify critical workflows, and prepare for incidents. Teams should document unresolved issues and confirm recovery handoffs before approving deployment. HITS helps federal health programs connect supplier dependencies, testing evidence, and configuration control to release decisions. Contact HITS to discuss how stronger handoff testing and release evidence can support your program’s mission.
Book a 15-minute fit call to discuss teaming or direct support: https://calendly.com/jhoyte-hits/teamfit
References
- https://hhscyber.hhs.gov/cybersecurity-performance-goals.html
- https://www.nist.gov/itl/health-it-testing-infrastructure
- https://www.ncbi.nlm.nih.gov/books/NBK189662/
- https://us.pagefreezer.com/en-US/wa/browse/0a7f82bb-be6e-448a-ae11-373d22c37842?find-by-timestamp=2024-01-02T03:56:59Z&url=https:%2F%2Fwww.hhs.gov%2Fabout%2Fnews%2F2023%2F12%2F06%2Fhhs-announces-next-steps-ongoing-work-enhance-cybersecurity-health-care-public-health-sectors.html×tamp=2024-01-02T03:43:14Z