Healthcare Security · October 24, 2026

Your first payer security questionnaire: a triage checklist

The first security questionnaire from a health plan tends to arrive at an awkward moment: the business case is approved, the champion is eager, and procurement sends a spreadsheet with a few hundred rows, a vendor-portal login, or a security exhibit attached to the contract. It's tempting to open it and start typing. Don't. A first hour spent on triage saves days of rework and prevents the answers that come back to bite you in the contract.

Here's the checklist we use.

Step 1: Figure out what you've actually received

Before answering anything, write down:

  • The format. A custom spreadsheet, a vendor-risk portal, or a standard questionnaire. Two you may see are the Shared Assessments SIG (Standardized Information Gathering questionnaire) and the Cloud Security Alliance's CAIQ (Consensus Assessments Initiative Questionnaire).
  • The deadline, and whether it's firm.
  • Who owns the review on the buyer's side. Procurement, third-party risk management, information security, or privacy. You want a named contact for clarification questions.
  • The service in scope. The questionnaire should be answered for the product and data flows the plan is buying, not for your whole company in the abstract.
  • What evidence they expect alongside answers: audit report, policies, pen test summary, insurance certificates, network diagram.

Also ask whether the plan has published supplier security terms. Several do, and those documents tell you which answers matter most.

Step 2: Read it next to the contract and the BAA

The questionnaire, the master agreement's security exhibit, and the business associate agreement (BAA) often overlap and sometimes conflict. Anything you answer "yes" to can end up as a contractual commitment.

Flag every question that touches:

  • Breach and incident notification timelines
  • Audit rights, including on-site assessments
  • Data location and offshore access
  • Subcontractors and sub-processors
  • Encryption standards
  • Insurance coverage
  • Use of AI in the service

Make sure your answers line up with what you're willing to sign. Route the conflicts to whoever is negotiating the contract.

Step 3: Sort every question into four buckets

Go through once, quickly, and tag each question:

  1. Yes, and we can prove it. A control exists, it's documented, and you have evidence.
  2. Partially. Something exists but doesn't fully meet the question, such as MFA on most systems but not all, or a policy that's written but not yet reviewed.
  3. Not yet. The control doesn't exist.
  4. Not applicable. It genuinely doesn't apply to the service in scope. Be ready to explain why.

This gives you the real picture in an hour instead of discovering it on row 280.

Step 4: Identify the must-haves

Not all questions carry equal weight. In published health plan terms, a few themes come up again and again, and they're the ones most likely to stop a deal:

  • An independent audit report (commonly SOC 2 Type 2 or HITRUST) or a dated plan to get one
  • A recognized security framework underpinning the program
  • Penetration testing and vulnerability management, with evidence
  • Encryption of their data at rest and in transit
  • MFA and access reviews
  • A documented incident response plan and breach notification
  • Background checks for workforce with data access

If any of these land in your "partially" or "not yet" bucket, deal with them first. Everything else is usually negotiable or fixable after signing.

Step 5: Write answers that are true, specific, and short

A good answer states the control, its scope, and where the evidence is. For example:

"Yes. MFA is enforced for all workforce access to production cloud accounts and our identity provider. Evidence: identity provider policy screenshot, attached as Exhibit 4."

Rules that keep you out of trouble:

  • Never overstate. If it's partial, say so and describe what exists. Reviewers find inconsistencies, and an inaccurate questionnaire can be treated as a misrepresentation.
  • Answer the question asked. Don't paste a policy paragraph when the question is "how often?"
  • Use the same terms everywhere. If your SOC 2 report says "quarterly access reviews," your questionnaire shouldn't say "monthly."
  • Keep "not applicable" honest. "We don't store PHI" is only true if you've traced the data flow.

Step 6: Handle gaps with a dated plan

A "not yet" doesn't automatically end the deal. Many buyers will proceed with a credible remediation plan, especially for an early-stage vendor. For each gap, provide:

  • What you'll put in place
  • The target date
  • Who owns it
  • Any interim or compensating control

If the gap is the audit report itself, give a realistic timeline. SOC 2 readiness typically takes 2–4 months depending on your organization's size, and a Type 2 then needs an observation period. Some plans, such as Blue Cross Blue Shield of Michigan in its published terms, set their own clock: begin a SOC 2 Type II within 30 days of request and deliver results within six months. Know that clock before you promise a date.

Step 7: Assemble the evidence package

Collect, label, and review before you send:

  • Current SOC 2 or HITRUST report (shared under NDA), or bridge letter and timeline
  • Information security policy and key supporting policies
  • Penetration test executive summary and remediation status
  • Network or data-flow diagram, at the level of detail you're comfortable sharing
  • Incident response and business continuity plan summaries
  • Insurance certificates if requested

Share only what's asked for, and mark everything confidential.

Step 8: Review before it goes out

Have someone who didn't write the answers read them against the evidence. Check for contradictions, overstatements, and anything that conflicts with the contract. A security lead should sign off, and so should whoever owns the contract.

Step 9: Save everything for next time

Health plans reassess vendors periodically (Blue Cross Blue Shield of Michigan's published terms, for example, reserve the right to review a supplier's security program at least annually), and the next buyer will ask most of the same questions. Store the final answers in an answer library tagged by topic, keep evidence current, and note which commitments you made to which customer. Your second questionnaire should take a fraction of the time.

The one-page checklist

  • Format, deadline, buyer contact, and scope written down
  • Published supplier terms located, if any
  • Questionnaire read alongside the contract and BAA; conflicts flagged
  • Every question tagged: yes / partial / not yet / N/A
  • Must-have themes checked first
  • Answers true, specific, short, and consistent with your audit report
  • Gaps answered with dated remediation plans and owners
  • Evidence package assembled and marked confidential
  • Independent review and sign-off
  • Final answers saved to an answer library

How KN Cyber helps

We handle health plan and enterprise security reviews for health-tech companies: triage, accurate answers, evidence, and remediation plans for the gaps. We also run the SOC 2 and HITRUST readiness work and penetration tests that reviewers ask for, and our fractional CISOs can own the review relationship long term. See Health plan and vendor security reviews, SOC 2 readiness, and Fractional CISO. Pricing is scoped to your organization's size and needs.

Have a questionnaire due? Book a consultation.

Sources

Accessed October 22, 2026. KN Cyber is not affiliated with any health plan named in this article. This post is general guidance, not legal advice.

← All insights