Devdent — Implementation Playbook (DSO)

Devdent Implementation Playbook

Revenue Cycle AI for Dental Support Organizations

---

1. Executive Summary

What Devdent Does

Devdent is an AI-powered revenue cycle management platform that automates insurance verification, claims processing, and denial management. The system uses machine learning to predict claim outcomes, identify coding optimization opportunities, and streamline the entire revenue cycle from patient scheduling through final payment collection.

Why DSOs Benefit from Revenue Cycle AI at Scale

Revenue cycle inefficiencies compound exponentially across multiple locations. A 2% claim denial rate that costs a single practice $15,000 annually translates to $750,000 in preventable losses across 50 locations—before accounting for the labor hours spent on rework. Revenue cycle AI delivers three scale advantages that single practices cannot access:

1. Data Aggregation: Devdent learns from claims patterns across your entire organization. A denial trend identified at one location becomes preventive intelligence for all locations before they make the same error.

2. Standardization: Inconsistent coding practices, verification workflows, and follow-up protocols between locations create unpredictable cash flow. AI enforces best practices organization-wide while adapting to payer-specific requirements in each market.

3. Centralized Visibility: Real-time dashboards allow revenue cycle leadership to identify underperforming locations, benchmark against internal peers, and deploy targeted interventions—capabilities impossible when each location operates as an island.

Expected Timeline: Decision to Full Deployment

Phase	Timeline	Scope
Pre-Implementation	Weeks 1–2	Technical prep, stakeholder alignment, baseline capture
Wave 1 Pilot	Weeks 3–6	2–3 pilot locations
Wave 2 Expansion	Weeks 7–12	8–12 locations
Wave 3 Full Deployment	Weeks 13–20	Remaining locations
Optimization	Weeks 21–26	Performance tuning, ROI validation

Total timeline: 5–7 months from signed contract to full organizational deployment, depending on portfolio size and IT infrastructure consistency.

---

2. Pre-Implementation Checklist (Weeks 1–2)

Technical Requirements

Hardware

☐ Verify all workstations meet minimum specs: 8GB RAM, modern browser (Chrome 90+, Edge 90+, Firefox 88+) ☐ Confirm reliable internet connectivity at all locations (minimum 25 Mbps download/10 Mbps upload per location) ☐ Identify locations with known connectivity issues for infrastructure remediation ☐ Confirm dual-monitor setup availability for billing staff (strongly recommended)

Software

☐ Document current PMS version at each location (Dentrix, Eaglesoft, Open Dental, or other) ☐ Verify PMS versions meet Devdent integration requirements ☐ Identify any locations running legacy PMS versions requiring upgrades ⚠️ ☐ Catalog all third-party revenue cycle tools currently in use (clearinghouses, eligibility verification services, patient financing platforms)

Network & Security

☐ Confirm HTTPS capability across all locations ☐ Whitelist Devdent IP ranges and domains on firewalls/security appliances ☐ Verify VPN configuration if centralized hosting model selected ☐ Document current data backup protocols

---

Vendor Onboarding Steps 🔵

Step	Responsible Party	Timeline
Execute BAA and master service agreement	Legal + Vendor	Day 1–3
Complete vendor security questionnaire	IT + Vendor	Day 3–5
Receive implementation project plan	Vendor	Day 5
Establish primary and secondary vendor contacts	Operations	Day 5
Schedule kickoff call with implementation team	Operations + Vendor	Day 5–7
Receive sandbox/test environment credentials	Vendor	Day 7–10
Complete technical discovery call	IT + Vendor	Day 7–10

Key Vendor Contacts to Establish

☐ Implementation Project Manager (primary day-to-day contact) ☐ Technical Integration Specialist (for PMS/clearinghouse connectivity issues) ☐ Customer Success Manager (post-go-live relationship owner) ☐ Support escalation path (Tier 1, Tier 2, Tier 3 contact methods) ☐ Executive sponsor on vendor side (for escalation beyond support)

---

Data/Access Prerequisites

☐ Compile PMS admin credentials for each location (or centralized admin if applicable) ☐ Document clearinghouse login credentials and API access ☐ Gather payer portal credentials for top 10 payers by volume ⚠️ ☐ Export 12 months of historical claims data in required format 🔵 ☐ Prepare provider NPI and credential information for all billing providers ☐ Compile fee schedules for all active payer contracts ☐ Document current CPT/CDT code customizations or mapping rules

---

Enterprise-Level Requirements

Network Standards

☐ 🟣 Decision Required: Centralized vs. location-level hosting architecture

• Centralized: Lower per-location cost, easier updates, requires reliable connectivity
• Location-level: More resilient to connectivity issues, higher maintenance burden

☐ Establish minimum network standards for Devdent deployment:

• Latency requirements: <100ms to Devdent servers
• Uptime requirements: 99.5% connectivity during business hours
• Failover protocol: Define acceptable degraded-mode operations

Identity & Access Management

☐ 🟣 Decision Required: SSO integration vs. standalone authentication ☐ If SSO: Document IdP (Okta, Azure AD, Google Workspace, etc.) and initiate configuration 🔵 ☐ Define role-based access control (RBAC) structure:

• Corporate Admin: Full access, all locations
• Regional Manager: Read access to region, limited write
• Location Manager: Full access to single location
• Billing Staff: Operational access, no configuration rights
• Provider: Read-only claims/patient data for their production

Centralized Credentialing

☐ Verify provider credentialing data is current and centrally accessible ☐ Identify any providers with pending credentialing (flag for manual workflow during transition) ☐ Document credentialing update protocol (who updates, how often, what triggers updates)

---

Internal Stakeholder Alignment

Stakeholder Alignment Map

Stakeholder Level	Key Individuals	Role in Implementation	Communication Cadence
Board/Investors	Board members, PE sponsors	Awareness, ROI validation	Monthly summary
C-Suite	CEO, CFO, CDO, VP Ops	Strategic oversight, go/no-go decisions	Weekly during rollout
Revenue Cycle Leadership	VP/Director of RCM	Project ownership, success metrics	Daily during active waves
Regional Managers	Regional Directors/Managers	Cascade communication, location readiness	Weekly during their region's wave
Location Office Managers	Office Managers	Operational execution, staff coordination	Daily during location go-live week
Providers	Dentists, Specialists	Workflow adoption, clinical input	Training + go-live touchpoints
Billing Staff	Insurance coordinators, billers	Primary users, daily operations	Training + ongoing support

Approvals Required

☐ 🟣 Budget approval (CFO or Finance Committee) ☐ 🟣 Data governance approval (Compliance/Legal) ☐ 🟣 Technology architecture approval (IT leadership) ☐ 🟣 Rollout timeline approval (VP Operations) ☐ 🟣 Training resource allocation approval (HR/Operations)

Internal Announcement

☐ Draft internal communication announcing initiative ☐ 🟣 Executive sponsor identified and committed ☐ Schedule regional manager briefings (before any location-level communication) ☐ Prepare FAQ document for anticipated questions

---

Baseline Metrics Capture ⚠️

Critical: Capture these metrics BEFORE go-live to enable ROI measurement. Inconsistent measurement across locations will undermine your ability to demonstrate value.

Standardized Metrics (Measure Identically Across All Locations)

Metric	Definition	Data Source	Capture Method
Days in A/R	Average age of outstanding receivables	PMS/RCM reports	90-day average
Clean Claim Rate	% of claims accepted on first submission	Clearinghouse	90-day average
Claim Denial Rate	% of claims denied (any reason)	Clearinghouse	90-day average
Days to Payment	Average days from service to payment posted	PMS	90-day average
Cost to Collect	RCM labor cost / collected revenue	Payroll + PMS	Monthly average
Insurance Verification Accuracy	% of verifications correct at time of service	Manual audit	Sample 50 patients/location
Write-off Rate	% of production written off	PMS	90-day average
Staff Hours on RCM	Hours spent on verification, claims, follow-up	Time study	2-week sample

Baseline Capture Checklist

☐ Assign baseline data collection owner (typically Director of RCM) ☐ Create standardized reporting template for all locations ☐ Pull 90-day historical data from each location's PMS ☐ Conduct 2-week time study for staff RCM hours ☐ Complete insurance verification accuracy audit (50 patients per location) ☐ Compile data into centralized baseline report ☐ Flag any locations with data quality issues or missing metrics ⚠️ ☐ Store baseline data in accessible location for post-implementation comparison

Cross-Location Normalization

☐ Normalize metrics for practice size (per-provider, per-patient, or per-$100K production) ☐ Document any location-specific factors affecting baseline (new providers, payer mix shifts, etc.) ☐ Identify statistical outliers and investigate causes before attributing to workflow

---

3. Location Readiness Assessment

Scoring Framework

Rate each location on the following factors using a 1–5 scale. This assessment should be completed by regional managers with input from office managers and IT.

Factor 1: IT Infrastructure Maturity

Score	Criteria
5	Modern PMS (current version), <2-year-old workstations, 100+ Mbps internet, no connectivity complaints
4	Current PMS version, adequate workstations, 50+ Mbps internet, occasional connectivity issues
3	PMS version 1–2 releases behind, aging workstations, 25+ Mbps internet, monthly connectivity issues
2	Outdated PMS requiring upgrade, old workstations, inconsistent internet, frequent connectivity issues
1	Legacy PMS with integration limitations, hardware replacement needed, unreliable connectivity

Factor 2: Staff Tenure and Adaptability

Score	Criteria
5	Low turnover (<10% annually), history of successful tech adoptions, staff requests new tools
4	Moderate turnover (10–20%), successful past implementations with initial resistance
3	Average turnover (20–30%), mixed history with technology changes
2	High turnover (30–50%), past implementations met significant resistance
1	Very high turnover (>50%), failed past implementations, active resistance to change

Factor 3: Patient Volume

Score	Criteria	Risk Consideration
5	High volume (top quartile)	Highest impact potential, also highest disruption risk
4	Above average volume	Strong impact, manageable risk
3	Average volume	Balanced impact and risk—often ideal for pilots
2	Below average volume	Lower impact, lower risk
1	Low volume (bottom quartile)	Minimal impact, minimal risk

Note: For Wave 1 pilots, scores of 3–4 are often preferable to 5—enough volume to validate impact without excessive risk.

Factor 4: Tech Stack Compatibility

Score	Criteria
5	PMS with native Devdent integration, compatible clearinghouse, no conflicting tools
4	PMS with available integration, compatible clearinghouse, minor tool overlap
3	PMS with integration requiring configuration, clearinghouse migration needed, moderate overlap
2	PMS with limited integration, complex clearinghouse situation, significant tool conflicts
1	PMS with no current integration path, major infrastructure changes required

Factor 5: Local Champion Availability

Score	Criteria
5	Tech-forward Office Manager AND provider actively advocating for implementation
4	Strong Office Manager champion OR engaged provider advocate
3	Office Manager willing to champion with support, neutral providers
2	No clear champion, but no active resistance
1	No champion identified, potential resistance from leadership

---

Composite Score Calculation

Factor	Weight	Rationale
IT Infrastructure	25%	Technical foundation is prerequisite for success
Staff Tenure/Adaptability	25%	People determine adoption outcomes
Patient Volume	15%	Influences impact but also risk
Tech Stack Compatibility	20%	Integration complexity drives timeline
Local Champion	15%	Change management accelerator

Composite Score = (IT × 0.25) + (Staff × 0.25) + (Volume × 0.15) + (Tech × 0.20) + (Champion × 0.15)

Readiness Tiers

Score Range	Tier	Recommendation
4.0–5.0	High Readiness	Wave 1 candidate
3.0–3.9	Moderate Readiness	Wave 2 candidate
2.0–2.9	Developing Readiness	Wave 3 candidate; remediation may be needed
<2.0	Low Readiness	Delay deployment; address foundational issues first

---

Sample Location Readiness Matrix

Location	IT (25%)	Staff (25%)	Volume (15%)	Tech (20%)	Champion (15%)	Composite	Tier
Downtown Metro	4	4	5	4	5	4.25	High
Suburban East	5	3	3	5	4	4.05	High
West Side	3	4	4	3	4	3.55	Moderate
Northgate	4	3	3	4	2	3.35	Moderate
Southtown	2	2	4	3	2	2.50	Developing

---

Recommended Rollout Sequence

Wave 1 Selection Criteria (2–3 Locations)

• Composite score 4.0+
• Geographic diversity (different regions if applicable)
• Payer mix representative of broader portfolio
• Avoid locations with imminent staffing changes or renovations
• At least one location should be "typical"—not your showcase location

Wave 2 Selection Criteria (8–12 Locations)

• Composite score 3.0–3.9
• Prioritize locations with strong champions
• Group geographically when possible for efficient support
• Include one or two "stretch" locations (score 2.5–3.0) to stress-test support model

Wave 3 Selection (Remaining Locations)

• Address remediation items for low-readiness locations before scheduling
• Consider accelerated timeline for high-readiness locations that missed earlier waves
• Plan additional support resources for developing-readiness locations

---

4. Rollout Strategy

Wave Structure

Recommended Wave Configuration

Wave	Locations	Duration	Cumulative Timeline
Pre-Implementation	N/A	2 weeks	Weeks 1–2
Wave 1 (Pilot)	2–3 locations	4 weeks	Weeks 3–6
Learning Capture	N/A	1 week	Week 7
Wave 2	8–12 locations	5 weeks	Weeks 8–12
Learning Capture	N/A	1 week	Week 13
Wave 3	Remaining locations	6–8 weeks	Weeks 14–21
Optimization	All locations	5 weeks	Weeks 22–26

---

Wave 1: Pilot Locations (Weeks 3–6)

Selection Criteria Checklist

☐ 🟣 Select 2–3 locations with composite readiness score 4.0+ ☐ Ensure geographic/regional representation ☐ Confirm payer mix is representative of portfolio ☐ Verify no competing initiatives (renovations, provider transitions) ☐ Confirm Office Manager commitment and availability ☐ Validate provider buy-in at each pilot location

Wave 1 Timeline

Week	Activities
Week 3	Integration setup, test environment configuration, champion training
Week 4	Staff training, parallel run begins, daily check-ins
Week 5	Go-live, intensive support, workflow adjustment
Week 6	Stabilization, initial metrics collection, documentation of learnings

Wave 1 Success Metrics

• System uptime >99%
• User adoption rate >90% (measured by daily active users)
• Clean claim rate maintained or improved
• No unresolved critical issues at week 6
• Champion confidence level (self-reported) ≥7/10
• Staff sentiment survey average ≥6/10

---

Go/No-Go Criteria ⚠️

To Advance from Wave 1 to Wave 2

Criteria	Threshold	Current Status
System Stability	No critical outages in Week 6	☐ Met / ☐ Not Met
Integration Reliability	<1% transaction failures	☐ Met / ☐ Not Met
User Adoption	>90% daily active users	☐ Met / ☐ Not Met
Training Completion	100% staff certified	☐ Met / ☐ Not Met
Clean Claim Rate	No decline >2% from baseline	☐ Met / ☐ Not Met
Support Ticket Backlog	<10 open tickets per location	☐ Met / ☐ Not Met
Champion Readiness	Champions confirm readiness to train others	☐ Met / ☐ Not Met

Decision Authority: 🟣 VP Operations, with input from Revenue Cycle Director and IT

If criteria not met: Extend Wave 1 by 1–2 weeks, address gaps, reassess. Do not proceed to Wave 2 with unresolved foundational issues.

---

Wave 2: Expansion (Weeks 8–12)

Wave 2 Adjustments Based on Wave 1 Learnings

☐ Document all Wave 1 learnings in structured format ☐ Update training materials based on common questions/issues ☐ Refine configuration templates based on pilot optimization ☐ Adjust support resource allocation based on actual demand ☐ Communicate Wave 1 successes to Wave 2 locations (build momentum)

Wave 2 Timeline

Week	Activities
Week 8	Integration setup (batch of 4 locations), champion training
Week 9	Staff training, parallel run begins
Week 10	Go-live batch 1 (4 locations), integration setup batch 2
Week 11	Go-live batch 2 (4–6 locations), stabilization batch 1
Week 12	Stabilization all locations, learning documentation

Wave 2-to-Wave 3 Criteria

Same framework as Wave 1→2, plus:

• Wave 2 locations achieving equivalent or better metrics than Wave 1
• Support model validated at scale (no bottlenecks)
• Training materials require no further major revisions

---

Wave 3: Full Deployment (Weeks 14–21)

Wave 3 Approach

• Larger batches possible (8–10 locations per batch)
• More reliance on trained champions, less central support
• Focus support resources on low-readiness locations
• Accelerated timeline for high-readiness locations

Wave 3 Batch Structure (Example for 30 Remaining Locations)

Batch	Locations	Go-Live Week	Notes
3A	10	Week 14	High readiness, experienced regions
3B	10	Week 16	Moderate readiness, standard support
3C	10	Week 18	Includes low-readiness locations, enhanced support
Buffer	—	Weeks 19–21	Remediation, stragglers, optimization

---

Rollback Plan ⚠️

Triggers for Wave Pause

• Critical system outage affecting >50% of wave locations
• Data integrity issue identified
• Clean claim rate drop >5% sustained over 5 business days
• Unresolved integration failure affecting revenue posting
• Staff safety or compliance concern

Rollback Procedure

Step	Action	Owner	Timeline
1	Document issue and notify VP Operations	RCM Director	Immediate
2	🟣 Pause decision confirmed by VP Operations	VP Operations	Within 2 hours
3	Notify affected locations of pause status	Regional Managers	Within 4 hours
4	Revert to pre-Devdent workflows at affected locations	Office Managers	Same day
5	Engage vendor escalation for root cause	IT + Vendor	Within 24 hours
6	Communicate status to unaffected/future wave locations	Communications	Within 24 hours
7	Resume criteria defined and communicated	VP Operations	Within 48 hours

Isolation Protocol

• A failure at one location does not automatically affect other wave locations
• Regional managers assess whether issue is location-specific or systemic
• Only systemic issues trigger full wave pause
• Location-specific issues handled with targeted rollback and support

---

5. Configuration & Integration (Weeks 2–3)

Practice Management System Integration

Dentrix Integration 🔵

Prerequisites ☐ Dentrix version 16.0 or higher (verify with Help > About) ☐ Dentrix API access enabled (may require contacting Henry Schein) ☐ Administrative credentials available ☐ Backup of Dentrix database completed

Integration Steps

Step	Action	Owner	Duration
1	Request API credentials from Henry Schein	Practice/IT	3–5 days
2	🔵 Provide Devdent IP addresses to Dentrix for whitelisting	Vendor	1 day
3	🔵 Configure Devdent-Dentrix connector in test environment	Vendor	2–3 hours
4	Test patient demographic sync	IT + Vendor	2 hours
5	Test appointment data sync	IT + Vendor	2 hours
6	Test insurance/benefit data sync	IT + Vendor	2 hours
7	⚠️ Test claim data bi-directional sync	IT + Vendor	4 hours
8	Validate payment posting accuracy (sample 20 transactions)	Billing	3 hours
9	Document any customizations required	IT	2 hours
10	Production environment deployment	IT + Vendor	2 hours

Eaglesoft Integration 🔵

Prerequisites ☐ Eaglesoft version 20.0 or higher ☐ Patterson API partnership confirmed (Devdent handles this) ☐ Administrative credentials available ☐ Database backup completed

Integration Steps

Step	Action	Owner	Duration
1	🔵 Devdent initiates Patterson API connection request	Vendor	3–5 days
2	Verify Eaglesoft firewall settings	IT	2 hours
3	🔵 Configure Eaglesoft adapter in Devdent	Vendor	2–3 hours
4	Test data synchronization (demographics, appointments)	IT + Vendor	3 hours
5	⚠️ Test insurance eligibility data flow	IT + Vendor	3 hours
6	Test claim submission and status retrieval	IT + Vendor	4 hours
7	Validate EOB/ERA processing	Billing + Vendor	3 hours
8	Production deployment	IT + Vendor	2 hours

Open Dental Integration 🔵

Prerequisites ☐ Open Dental version 20.1 or higher ☐ Open Dental API access enabled ☐ Customer key and developer key available (from Open Dental account) ☐ Database backup completed

Integration Steps

Step	Action	Owner	Duration
1	Generate API keys in Open Dental	IT	30 minutes
2	🔵 Provide API keys to Devdent implementation team	IT	Immediate
3	🔵 Configure Open Dental connector	Vendor	1–2 hours
4	Test API connectivity	IT + Vendor	1 hour
5	Test patient/appointment sync	IT + Vendor	2 hours
6	Test insurance plan and benefit sync	IT + Vendor	2 hours
7	⚠️ Test claim creation and submission	IT + Vendor	3 hours
8	Validate posting accuracy	Billing	2 hours
9	Production deployment	IT + Vendor	1 hour

---

Clearinghouse Integration 🔵

Supported Clearinghouses

• Dental Xchange
• NEA (National Electronic Attachment)
• Tesia
• Apex EDI
• Office Ally

Integration Steps

Step	Action	Owner	Duration
1	Document current clearinghouse and credentials	IT	1 hour
2	⚠️ Verify clearinghouse supports Devdent integration	Vendor	1 day
3	🔵 Configure clearinghouse connector	Vendor	2–3 hours
4	Test claim submission routing	IT + Vendor	2 hours
5	Test ERA/835 retrieval and processing	IT + Vendor	3 hours
6	Test rejection/denial notification flow	IT + Vendor	2 hours
7	Validate payer ID mapping	Billing + Vendor	2 hours
8	Production go-live	IT + Vendor	1 hour

---

Test Environment Setup

Validation Checklist

☐ Sandbox environment provisioned with location-specific configuration 🔵 ☐ Test patients created (minimum 10 with varied insurance scenarios) ☐ Test claims submitted and tracked through lifecycle ☐ ERA processing validated with sample remittance files ☐ User roles and permissions tested for each access level ☐ Integration error handling confirmed (what happens when PMS is unavailable?) ☐ Performance benchmarked (page load times, claim submission speed)

Test Scenarios

Scenario	Description	Pass Criteria
New patient eligibility	Verify coverage for new patient with commercial insurance	Benefit details returned within 30 seconds
Claim submission	Submit clean claim for routine prophy	Claim accepted by clearinghouse within 5 minutes
Claim with error	Submit claim with intentional error (missing tooth number)	Error flagged before submission
Denial processing	Process ERA with denial	Denial reason captured, routed to appropriate queue
Payment posting	Post payment from ERA	Payment matches EOB, applied to correct claim
Secondary claim	Generate secondary claim after primary payment	Secondary claim created with primary payment info

---

Data Migration / Historical Ingestion

☐ Define historical data scope (claims, payments, adjustments) ☐ Recommended: 24 months of claims history ☐ 🔵 Export data in Devdent-specified format ☐ 🔵 Vendor processes data ingestion ☐ ⚠️ Validate migrated data accuracy (sample audit of 50 claims per location) ☐ Reconcile open A/R balances between PMS and Devdent ☐ Document any data gaps or quality issues

---

Enterprise-Level Configuration

Standardized Configuration Template

Settings to Standardize Across All Locations

Setting	Standard Value	Rationale
Claim scrubbing rules	Devdent recommended + custom rules	Consistency reduces errors
Denial category taxonomy	Corporate standard categories	Enables cross-location analysis
Aging bucket definitions	0–30, 31–60, 61–90, 91–120, 120+	Consistent reporting
User role definitions	Corporate RBAC template	Security compliance
Report templates	Corporate standard dashboards	Executive reporting consistency
Alert thresholds	Corporate standards	Proactive issue identification
Audit log retention	7 years	HIPAA compliance

Location-Specific Configuration

Settings That Can/Should Vary

Setting	Variable By	Rationale
Provider preferences	Location	Provider autonomy in low-risk areas
Specialty-specific rules	Location	Specialty mix varies
Local payer rules	Location/Market	Payer behavior varies by geography
Work queue assignments	Location	Staff structure varies
Appointment types	Location	Workflow differences
Business hours	Location	Time zones, operating schedules

---

Centralized vs. Per-Location Testing

Recommended Approach: Centralized test environment with location-specific configurations

☐ Single enterprise test environment maintained by central IT ☐ Location configurations loaded as separate "practices" within test environment ☐ Champions test their location's configuration in centralized environment ☐ Critical integrations tested centrally first, then validated per-location ☐ Performance testing conducted with realistic multi-location load

---

Security and HIPAA Compliance

Enterprise HIPAA Checklist

Documentation ☐ 🟣 Business Associate Agreement (BAA) fully executed ☐ Devdent SOC 2 Type II report reviewed and approved ☐ Data flow diagram documented (where does PHI move?) ☐ Vendor security questionnaire completed and reviewed by Compliance ☐ Breach notification procedures documented and aligned with corporate policy

Technical Controls ☐ Encryption in transit (TLS 1.2+) verified ☐ Encryption at rest confirmed ☐ Access logging enabled and retention period confirmed (minimum 6 years) ☐ Role-based access controls implemented ☐ Automatic session timeout configured (≤15 minutes of inactivity) ☐ MFA enabled for all administrative access ☐ SSO integration (if applicable) validated for security compliance

Administrative Controls ☐ User access provisioning process documented ☐ User termination/deprovisioning process documented ☐ Access review schedule established (quarterly recommended) ☐ Minimum necessary access principle applied to role definitions ☐ Training records for HIPAA/security maintained

Physical/Vendor Controls ☐ Data center security certifications confirmed ☐ Disaster recovery/backup procedures documented ☐ Data location (US-only requirement, if applicable) confirmed ☐ Subcontractor/subprocessor list reviewed