Why underwriters ask about it
the insurer's question is "where does customer data go?" — and the honest answer runs through your vendors' settings, not your intentions.
How to fix it
- For each tool in the inventory, check three settings: is your data used for model training (turn it off where offered)? how long is it retained? can you delete it?
- If health information touches any tool, ask that vendor for a Business Associate Agreement — and stop sending health data to any vendor that won't sign one.
- Record the answers in the inventory next to each tool.
Evidence to keep
the settings noted per tool; any BAAs on file.