10 RFP Questions to Ask Vendors About Data Security

If your vendors don’t secure resident data, your community carries the risk.

In 2023 alone, healthcare breaches exposed more than 168 million records. Nearly a third came from third-party vendors. For senior living communities, where health, financial, and personal data all converge, weak security isn’t just a tech problem — it’s a breach of trust.

This guide covers 10 critical questions to ask any vendor handling resident data. From encryption and breach protocols to compliance and liability, these questions help you vet partners, protect your community, and prevent risks like fraud, identity theft, and regulatory penalties.

Here’s what to ask — and why each one matters.

1. What sensitive data will you handle, and how do you protect it?

You need to know exactly what kind of sensitive data a vendor will access. Ask for a list of what they collect, how long they store it, and who can see it.

Then dig into how they protect it:

• How is data stored and accessed? That includes encryption for data at rest and in transit, MFA for all logins, and continuous monitoring to detect threats early. They should run regular vulnerability scans and keep firewalls current. Insider threats account for a significant share of breaches, so real-time monitoring is essential.
• Are they following the right regulations? Any vendor handling protected health information (PHI) must comply with HIPAA. Confirm they are willing to sign a Business Associate Agreement (BAA), which makes that responsibility legally binding.
• What happens if something goes wrong? Breaches can happen despite strong safeguards. Ask how they detect issues, what their response plan includes, and how quickly they will notify you. Look for clear timelines and defined procedures.

2. Where do you store data, and what location controls do you have?

It’s not just about digital protections. Physical security matters just as much. You need to know exactly where your data lives and how that place is kept secure.

Ask where the data is stored and how the location itself is protected:

• Where is the data stored? Ask if your data is stored in the U.S. or in another country. Privacy laws are different depending on where the data is kept. More than 130 countries have their own rules, and storing data outside the U.S. could create legal or compliance issues.
• What are the physical safeguards? Find out how their data centers are protected. Look for things like fences around the property, 24/7 video surveillance, strict entry rules, and biometric logins. You can also ask if they use extra security like mantraps (two-door systems that control access) and whether they keep surveillance footage for at least 90 days.
• How do they manage third-party risks? Many vendors don’t own their own data centers. They rent space from someone else. Ask who those third-party providers are and how they’re screened. The vendor should be able to show you audit reports and prove that their partners follow the same security rules.

Many vendors use third-party data centers or cloud-based platforms to store your information. That setup can be reliable, but only if it’s built on strong safeguards.

Cloud recovery in senior living is a strong partner for keeping operations running smoothly, with secure access to data wherever your team works. But any system that stores health records still needs to meet the same high bar for security, privacy, and accountability.

3. What security standards and compliance rules do you follow?

Regulations aren’t optional. They are the law. You need to make sure your vendor follows the right rules and can prove it.

Investigate their security framework with questions about:

• Do they comply with HIPAA? If they handle protected health information, they must follow the HIPAA Security Rule. HIPAA can be vague, so ask for specifics. For example, what kind of encryption do they use?
• Do they use other frameworks? Ask if they follow additional standards like the NIST Cybersecurity Framework (NIST CSF). This one gives more detailed security guidance and helps fill in the gaps where HIPAA leaves things open-ended.
• How do they handle third-party risks? Ask how they check that all their partners follow the same rules. Top vendors will have certifications like SOC 2 Type II or ISO/IEC 27001, which prove they’ve been audited by an independent group. HIPAA fines can range from $100 to over $50,000 per incident so this is not a small box to check.

Any vendor that handles resident data, like your CRM, EHR, or intake platform, needs to meet HIPAA compliance for third party integrations. That includes any outside tools or add-ons that plug into your system and can see or use protected information.

AI tools bring extra risk because they often track behavior, make decisions, or connect with other platforms. Ask for an AI compliance checklist that explains how they use data, how they protect privacy, and what happens when something goes wrong.

4. How do you control who can access our data?

Access control is one of the most important ways to keep your data safe. Only the right people should be able to view or use it.

• How do they authenticate users? At minimum, they should use multi-factor authentication (MFA). Look for Role-Based Access Control (RBAC), which limits each user to only the data they need for their role. You can also ask if they support Just-in-Time (JIT) access, where permissions are granted temporarily and then automatically expire.
• Do they have strong password rules? Ask to see their password policy. They should require complex passwords that get changed regularly and can’t be reused.
• How do they monitor access? They should run regular audits to clean up unused or excessive permissions. They also need audit logs that track who accessed what data, when, and what actions they took. That level of tracking is critical for spotting suspicious activity. Insider threats remain one of the most common causes of data breaches.

5. How do you respond to security incidents and notify customers?

No system is perfect. What matters is how quickly a vendor can catch a breach, contain it, and keep you informed.

Ask them to walk you through their full incident response process:

• What’s their plan? They should have a step-by-step response plan that includes containment, assessment, notification, and post-incident review. Speed is critical, and they should be able to explain how each step plays out in practice.
• When will they notify you? Ask how soon you’ll be informed if a breach happens. HIPAA requires vendors to notify you within 60 days. If 500 or more people in one area are affected, they also have to notify the media.
• How do they handle things after an incident? They should analyze what went wrong, update their policies, and retrain staff if needed. That follow-through is part of preventing the next issue before it starts.

6. Do you work with other vendors, and how do you check their security?

Your vendor might rely on other companies to deliver their service. That creates a chain of access you need to understand and control.

Find out who else is in the mix and how they’re being managed:

• Who are their partners? Ask for a full list of subcontractors that will have access to your data. Over 98% of organizations have worked with a vendor that experienced a breach in the past two years, so this step is critical.
• How do they vet them? They should have a formal process for approving partners, including detailed security reviews and ongoing evaluations.
• Do they follow regulations? Any third party that handles PHI should also have a signed Business Associate Agreement (BAA). Look for verified certifications like SOC 2 Type II rather than vague claims about being “HIPAA compliant.”

Your tech vendor’s partnerships are just as important as your own CRM integrations. Make sure nothing slips through the cracks, especially when those cracks aren’t visible from your side.

7. How long do you keep data, and who owns it?

Data retention and ownership affect your compliance and your control over information.

Ask how they handle data over its full lifecycle:

• What are their retention periods? Ask how long they keep each type of data. Their policies must follow all federal and state rules. For example, HIPAA requires some records to be stored for at least six years.
• Who owns the data? Your contract should make it clear that your community retains full ownership of all your data.
• How do they securely delete data? When your agreement ends, they should have a documented process to either return your data or securely delete it. You should get confirmation that all copies have been permanently removed.

8. Do you test your security regularly, and can you share the results?

Regular testing helps catch weaknesses before someone else does. If a vendor isn’t testing their own system, they’re leaving you exposed.

Look into how often they test their defenses and whether they’re willing to show their work:

• What are their testing methods? They should run both automated vulnerability scans and manual penetration tests. Scans catch common flaws. Pen tests go deeper by simulating a real attack.
• How often do they test? Best practice is monthly vulnerability scans and quarterly penetration tests, though the exact schedule may vary. Breaches from unpatched vulnerabilities rose 34% in the past year, so frequency matters.
• Can you see the results? Ask to see recent penetration test reports. They should include clear summaries and action steps showing how issues were found and fixed.

9. How do you fix security problems and update software?

Even with regular testing, new issues come up fast. Your vendor needs a reliable way to catch and fix them before they turn into bigger problems.

Check how they handle updates, patching, and lessons learned:

• What’s their patching process? They should have a clear system for spotting, prioritizing, and resolving security flaws. That includes emergency patches and testing every update before it goes live. Most intrusions come from known issues that were never patched.
• How do they handle third-party components? Most platforms use outside libraries and code. With thousands of new vulnerabilities reported each year, vendors need to track and update those tools just like they do their own.
• Do they learn from their mistakes? After any issue, whether it’s a failed update or a security event, they should run a post-mortem. That process helps them find weak spots and improve the system for next time.

10. Do you have cyber insurance, and what liability protection do you offer?

Technical safeguards matter. But financial protection matters, too. If something goes wrong, you need to know who’s covered and how.

Review their insurance coverage, contract terms, and regulatory alignment:

• What does their insurance cover? Ask to see their cyber insurance policy. It should go beyond ransomware payments and include coverage for business interruption, digital forensics, and legal support. In 2024, the median recovery cost for a ransomware attack in healthcare hit $750,000. And ransom demands reached as high as $4.4 million when backups were compromised.
• Does their insurance meet regulatory needs? Their policy should align with HIPAA standards and cover potential fines and legal expenses tied to a breach.
• What’s in the contract? Your agreement should spell out liability protections. Look for terms that cover reimbursement for investigation costs, legal fees, and other breach-related losses.

What These Questions Really Tell You

The goal here is to size up how your vendor handles accountability. Trust sounds like a soft trait, but in security, it has hard edges.

You’ll see it in how quickly they answer, how specific they get, and whether they’re willing to show their work. If something feels vague or brushed off, pay attention. The real risk isn’t asking too much. It’s assuming too much without proof.

How Do I Use These Security Questions When Choosing a New Vendor?

Think of these questions as a checklist built into your Request for Proposal (RFP) process. That’s where you set expectations and start comparing vendors fairly.

• Compare different vendors on equal terms: Use the same criteria to evaluate how each vendor handles security and risk
• Create a shared baseline for risk management: Set expectations early about how data will be handled once the contract begins

How Do I Make Sure a Vendor Is Secure Before I Even Hire Them?

Make cybersecurity a clear part of the RFP. Keep the questions focused and operational.

• Focus on the big picture: Ask for third-party audit reports and formal certifications instead of technical trivia
• Ask for detailed explanations: Don’t settle for “Do you use encryption?” — have them explain how it works, how long data is stored, and what their breach plan includes
• Tailor questions to the tool: For AI vendors, ask how the tool handles data, trains its models, and connects to your systems

How Can I Compare Vendors Fairly and Objectively?

A scoring matrix gives structure to your decision process. It helps reduce bias and aligns your priorities with the final choice.

• Create a list of criteria: Focus on what matters most, like data protection, compliance standards, or incident response
• Assign weights to each item: Prioritize based on what’s critical for your organization
• Score each vendor: Use a consistent scale (e.g., 1–10) and consider anonymizing responses to keep scoring unbiased

Does the Security Work Stop Once I’ve Chosen a Vendor?

It doesn’t. Ongoing oversight is part of protecting your data long term.

• Perform regular check-ins: Review security protocols at least once a year for any vendor handling sensitive data
• Monitor AI tools closely: Tools that run 24/7 need strong guardrails and clear alert systems
• Have a plan in place: Use real-time monitoring and communication protocols so you’re not scrambling when something goes wrong

Make Vendor Security Part of Your Intake Strategy

Every software tool that touches resident data needs to be held to the same standard. That includes the CRM you already use, the AI tools you’re testing, and the third-party platforms your vendors rely on.

These 10 questions aren’t just technical. They’re operational. They help you see who takes security seriously, who’s just checking a box, and who might be exposing your community without knowing it. Build them into your RFPs, your contracts, and your internal reviews. Then revisit them often. The stakes don’t go away once the tool is live.

FAQ: RFP Questions for Tech Vendors

1. What are RFP questions?

RFP questions are the items you include in a Request for Proposal to evaluate potential vendors. They help you compare providers based on security practices, pricing, service scope, and compliance before you sign a contract.

2. What is RFP in tech sales?

In tech sales, an RFP (Request for Proposal) is a formal document a company sends out to invite bids from software vendors. It outlines your requirements and gives vendors a structured way to respond so you can make an informed, side-by-side comparison.

3. How do companies use an RFP when sourcing software?

Companies use RFPs to standardize the selection process and avoid surprises after implementation. A strong RFP includes specific security questions, requests for certifications, and clear criteria for how proposals will be scored.

Use USR Virtual Agent to Keep Intake Secure and Trackable

Security starts with intake. If your system misses a call, misroutes a lead, or loses track of a conversation, you’re not just dropping sales—you’re losing visibility.

The USR Virtual Agent picks up every inquiry, qualifies the lead using your exact criteria, and sends clean, structured data straight to your CRM. That means no missed touchpoints, no data gaps, and no manual entry.

Book a demo to see how secure intake supports better data, faster follow-up, and cleaner KPI reporting from day one.