MediClaim: A Conditional Go on a US-Headquartered SaaS Claims Tool
MediClaim administers health insurance claims for 2.1 million members in the EU. It is evaluating 'Clarity', a SaaS claims-analytics product, to replace a spreadsheet-based process. Vendor facts: parent company and head office in Boston; primary processing region Frankfurt; a 24/7 support team in Manila with production access to customer tenants; nine sub-processors, three of them in the US; encryption at rest using keys the vendor generates and manages; a 99.9% monthly availability commitment with service credits capped at 10% of monthly fees; a 30-day termination notice; and no contractual audit right beyond an annual SOC 2 Type II report. MediClaim's own obligations include GDPR Article 28 processor terms, a national rule that claims data may not be transferred outside the EEA without explicit approval, and an internal policy that privileged access to claims data must be reviewed quarterly. The security officer has been asked to give a go/no-go recommendation with conditions rather than a simple yes or no.
1. Identify the four material risks in this arrangement and, for each, name a control that reduces it and state whether the control is contractual, technical or organisational.
Read the worked answer
Separate the risks by which obligation they threaten.
Risk 1 - access from Manila and US sub-processors. Remote access to EEA claims data from a third country is itself capable of constituting a transfer, and the national rule bars transfers without explicit approval. Controls: contractual - Standard Contractual Clauses plus a transfer impact assessment, and prior approval evidence for the national rule; technical - just-in-time, time-boxed privileged access with no standing production accounts, and session recording; organisational - quarterly review of privileged access, which the internal policy already requires and which the vendor must evidence, not merely permit.
Risk 2 - vendor-managed encryption keys. MediClaim cannot revoke the vendor's own access to data at rest, and cannot prove deletion. Control: technical - customer-managed keys held in a MediClaim-controlled key management service, so access can be withdrawn by disabling the key. This is the single highest-value technical condition.
Risk 3 - no audit right. A SOC 2 Type II report is a point-in-time opinion against the auditor's chosen criteria; it does not let MediClaim test the specific controls its regulator cares about, nor does it cover every sub-processor. Control: contractual - a right to audit or to commission an agreed third-party assessment, plus a current sub-processor list and advance notice of changes with a right to object.
Risk 4 - 30-day termination and weak remedies. Thirty days is short for extracting and migrating 2.1 million members' claims history, and a 10% credit cap does not reflect the operational consequence of an outage. Controls: contractual - a longer notice period, a defined data-export format, deletion certification, transition assistance, and renegotiated remedies.
Note that three of the four are addressed primarily by contract and access design, not by technology alone - a common failure in vendor assessments.
2. Draft the go/no-go recommendation. Why is a conditional go more defensible here than either a clean approval or a rejection?
Read the worked answer
Recommendation: conditional go, with signature withheld until the conditions are met.
A clean approval is indefensible because at least two facts are incompatible with MediClaim's own obligations as stated: production access from Manila with US sub-processors conflicts with a national no-transfer rule unless approvals and safeguards exist, and vendor-managed keys plus no audit right fail the internal privileged-access review policy in a way MediClaim cannot compensate for on its own side. Rejection is also hard to defend, because the risks are addressable - none of them is inherent to the product's function.
Conditions to be satisfied before contract signature:
- Executed DPA containing the Article 28 terms, SCCs and a completed transfer impact assessment; written confirmation of the national-rule approval.
- Customer-managed keys, or a documented compensating control with a named risk owner and a review date.
- Contractual audit or assessment right, current sub-processor list, change notification with an objection right.
- Privileged access redesigned to just-in-time with quarterly evidence delivered to MediClaim.
- Termination notice extended, export format and deletion certificate defined, transition assistance priced.
Why this framing works. It converts a security opinion into a set of testable, dated obligations with owners, which is what a risk committee can actually accept or reject. It also avoids the common failure mode of approving on the strength of a SOC 2 report and a Frankfurt region - neither of which addresses third-country access, key custody, or the ability to leave.
3. Twelve months later MediClaim decides to exit Clarity. Using only the facts given in the setup, describe the exit risks and what should have been negotiated.
Read the worked answer
The clock. Thirty days' notice is the binding constraint. Extracting, transforming and loading a multi-year claims dataset for 2.1 million members into a successor system in thirty days is not credible unless the export was designed and tested in advance. The risk is not losing the right to leave; it is losing the ability to leave cleanly.
The format. Nothing in the setup guarantees a usable export. A PDF report or an aggregated extract is not a migration. The contract should have specified a machine-readable, documented schema delivered on request, at a stated cost, without a discretionary approval step.
The deletion question. With vendor-managed keys, MediClaim cannot verify that data has actually been destroyed at the end of the term; it can only accept an assertion. Customer-managed keys make cryptographic erasure demonstrable - disable the key, and the ciphertext is unusable.
The dependencies. Clarity replaced a spreadsheet process, so there is no parallel system to fall back on. The exit plan needed a defined transition-assistance period, a data-integrity reconciliation, and a documented list of integrations and identities to unwind.
What to negotiate, in priority order: a machine-readable export clause with a tested sample; an extension of notice to at least 90 days and the right to a transition period; deletion certification backed by customer-managed keys; transition assistance at pre-agreed rates; and a right to retain a copy for the statutory retention period.
The general lesson for the exam: exit is a design-time property. A clause written after the decision to leave is a negotiating position, not a control.