Ultimate Guide to Vendor Risk Scoring 2025
Post Summary
Vendor risk scoring is a structured way to evaluate third-party vendors by analyzing cybersecurity, compliance, operational reliability, and financial stability. In healthcare, where sensitive patient data and HIPAA compliance are critical, this process helps identify high-risk vendors and prioritize security efforts.
Key takeaways:
- Why it matters: Rising cyberattacks and regulatory demands (e.g., HIPAA updates) make vendor risk scoring essential for protecting patient data and ensuring operational continuity.
- Trends for 2025: Stricter HIPAA rules now mandate multi-factor authentication, encryption, and annual audits. Cyber threats are increasing, with over 275M U.S. healthcare records breached in 2024 alone.
- How it works: Vendors are assessed across four categories: cybersecurity posture, operational efficiency, regulatory compliance, and financial stability. Scoring models like Likelihood x Impact or weighted systems translate risks into actionable scores.
- Tools: Platforms like Censinet RiskOps™ streamline risk management with automation, shared intelligence, and real-time monitoring.
Risk scoring in Third-Party Risk Management (TPRM)
Core Components of Vendor Risk Scoring Methods
Vendor risk scoring in healthcare revolves around turning complex risk data into actionable steps to protect patient information and keep operations running smoothly. This process relies on three essential components: identifying key risk categories, applying effective scoring models, and using diverse data sources.
Primary Risk Categories in Vendor Risk Scoring
Healthcare organizations assess vendors based on four critical risk categories:
- Cybersecurity posture: This is the backbone of vendor risk evaluation. It involves analyzing security policies, procedures, and technical safeguards to protect sensitive healthcare data. While electronic health records (EHR) have helped address some HIPAA-related concerns, they’ve also introduced new vulnerabilities [1].
- Operational efficiency: This measures how well a vendor can provide reliable, consistent services without disrupting healthcare operations. Key factors include defect rates, service uptime, disaster recovery plans, and business continuity strategies - essential in environments where downtime can directly affect patient care.
- Regulatory compliance: Vendors are evaluated on their adherence to healthcare-specific regulations and standards, such as HIPAA, state privacy laws, FDA guidelines for medical devices, and frameworks like NIST and CISA.
- Financial stability: This assesses a vendor’s ability to sustain services throughout the contract period. Metrics like debt-to-equity ratios, liquidity, revenue trends, and market position are analyzed to identify potential risks to service continuity.
Here’s a quick breakdown of these risk categories and their key factors:
| Risk Scoring Factor | Examples |
|---|---|
| Cybersecurity posture | Security policies, technical controls |
| Operational efficiency | Defect rates, service uptime |
| Regulatory compliance | Compliance with HIPAA, GDPR, and other regulations |
| Financial stability | Liquidity ratios, revenue trends |
These categories form the groundwork for various scoring models used in vendor risk management.
Scoring Models and Approaches
Once the risk categories are defined, organizations use different models to quantify risk effectively.
One widely used method is the Likelihood x Impact model, which calculates risk by multiplying the probability of an event by its potential consequences. For example, a vendor scoring 6/10 on likelihood and 9/10 on impact would have a risk score of 54, signaling a high priority for action.
Another approach is weighted scoring systems, where organizations assign different importance levels to risk categories based on their priorities. For instance, a hospital might prioritize cybersecurity at 40%, regulatory compliance at 30%, operational efficiency at 20%, and financial stability at 10%.
Organizations often blend quantitative and qualitative scoring. Quantitative methods rely on numerical data like uptime percentages and financial ratios, while qualitative methods incorporate expert opinions and survey feedback.
Tiered classification systems simplify vendor management by grouping vendors into categories such as low, medium, high, or critical risk. Additionally, organizations use both internal risk scores (focused on their own risk landscape) and external risk scores (evaluating third-party vendors through publicly available data). External scores often provide a broader market perspective [2].
According to McKinsey & Company, using algorithm-driven third-party risk management software can cut the time needed to organize a vendor risk inventory from nine to six months [3]. The key to effective scoring lies in combining automation with human judgment, routinely validating models, and staying flexible to address unique challenges.
Data Sources for Effective Scoring
A comprehensive risk scoring process depends on diverse data sources that combine historical insights with real-time updates.
- Security questionnaires: These offer structured data on standardized risk categories. Automated tools can now validate responses and flag inconsistencies, improving the reliability of assessments.
- Continuous monitoring systems: Unlike one-time audits, these systems provide ongoing tracking of security incidents, financial performance, regulatory violations, and service availability.
- External risk intelligence platforms: Services like Dun & Bradstreet, EcoVadis, and Moody’s compile data on financial stability, ESG compliance, geopolitical risks, and cybersecurity threats to create detailed vendor profiles.
- Regulatory and compliance databases: These highlight vendor violations, sanctions, and compliance issues across jurisdictions.
- Industry threat intelligence: This provides context on risks specific to the healthcare sector, including emerging cyberattack patterns and vulnerabilities.
By integrating these data sources, healthcare organizations can build a well-rounded risk profile that not only reflects current conditions but also anticipates potential challenges. As Richard Teuchler, Head of Demand Generation at Kodiak Hub, aptly puts it:
"Vendor risk management isn't just about compliance - it's about future-proofing your supply chain." [4]
To make this integration work, organizations need rigorous processes to validate external data, resolve conflicting information, and ensure scoring algorithms can handle diverse data formats. A strong data integration strategy enhances the overall reliability of vendor risk scoring, helping healthcare providers stay ahead of potential risks.
Step-by-Step Process for Vendor Risk Assessment in Healthcare
Healthcare organizations need a solid, efficient process for vendor risk assessment to protect patient data and meet regulatory demands. A structured, three-phase approach ensures consistency and practicality, regardless of an organization's size or technical capabilities.
Identifying and Classifying Vendors
The first step is to create a detailed inventory of all vendors and understand their role in your operations.
Start by listing every vendor that interacts with your systems, data, or facilities. This includes obvious partners like electronic health record (EHR) providers and medical device manufacturers, as well as less obvious ones, such as cleaning services, marketing agencies, and software platforms used by administrative teams.
Once you’ve identified your vendors, classify them based on their access to sensitive data and systems. For instance:
- Critical vendors: Those with access to protected health information (PHI), administrative privileges, or the ability to disrupt patient care.
- Medium-risk vendors: Those with limited data access or non-critical service roles.
- Low-risk vendors: Those with no access to sensitive data or systems.
Define clear risk thresholds for each category based on factors like patient safety, regulatory exposure, and operational impact. For example, a vendor managing backup systems would likely require stricter controls than a cafeteria service provider, even if both have some level of facility access.
Document the business need for each vendor. This helps prioritize resources, guides decisions on mitigating risks or replacing vendors, and demonstrates due diligence during audits. A well-documented inventory and classification lay the groundwork for a deeper analysis of each vendor’s security measures.
Collecting and Validating Evidence
With vendors classified, the next step is gathering evidence to evaluate their risk. Automation and AI can simplify this process significantly.
Start by aligning your cybersecurity and risk management programs with established standards. As Paul J. Caracciolo, Executive Vice President at CSI Companies, explains:
"One way to know if you are covering all of your cybersecurity and risk management bases is to map to a standard such as NIST, ISO, or Hitrust. Additionally, healthcare will have to overlay HIPAA requirements with this program." [5]
Automated tools now make evidence collection more efficient. These tools can connect directly to vendor systems via APIs, pulling control information without compromising sensitive data. They can analyze SOC 2 reports, review contracts for compliance gaps, and recommend controls to address identified risks. AI adds another layer by organizing data, flagging missing documentation, and ensuring evaluations are thorough.
However, validating the information provided by vendors is just as important. Cross-check their claims with independent sources like security ratings services, regulatory databases, and threat intelligence platforms. This step helps identify inconsistencies in their security practices or financial stability.
The 2015 Anthem Data Breach is a cautionary tale. Nearly 80 million individuals’ personal and medical data were compromised, leading to massive fines and lawsuits. It underscores the importance of validating vendor security measures through regular audits and risk assessments [6].
Scoring, Prioritization, and Monitoring
Once evidence is validated, translate the findings into risk scores and set up ongoing monitoring processes. This helps allocate resources effectively and address risks in order of priority.
Use established frameworks to calculate risk scores, applying them consistently across all vendors. These scores should reflect both current risks and potential future impacts based on each vendor’s role in your organization.
Prioritize high-risk vendors for immediate action. Develop detailed remediation plans with clear timelines, responsibilities, and success metrics. For lower-risk vendors, routine monitoring and periodic reassessments may suffice.
Continuous monitoring is crucial - it provides real-time insights into vendor security, financial health, and operational performance. Automated alerts can flag significant changes, such as security breaches, regulatory violations, or financial instability.
NIST guidelines offer a structured approach for ongoing monitoring, helping organizations track their cybersecurity progress. Establish review cycles that balance thoroughness with efficiency. For critical vendors, quarterly reviews may be necessary, while annual assessments might be enough for lower-risk ones. Always document these activities to maintain audit trails for compliance.
Prepare contingency plans for high-risk vendors. These should outline alternative vendor options, emergency procedures, and communication strategies to minimize disruptions to patient care and operations.
Finally, keep communication lines open with all vendors. Encourage them to alert you to potential issues, operational changes, or shifts in their security posture. This proactive collaboration can help identify risks early, strengthening your overall risk management program and safeguarding patient data while maintaining operational effectiveness.
Tools and Platforms for Vendor Risk Scoring in Healthcare
Managing vendor relationships in healthcare is no small feat. With sensitive patient data on the line and strict compliance requirements to meet, healthcare organizations rely on specialized tools to streamline their processes. These platforms are designed to handle the unique demands of the healthcare sector, offering automation, integration, and regulatory alignment. One standout in this space is Censinet RiskOps™, which provides a robust foundation for managing vendor risks effectively.
Overview of Censinet RiskOps™
Censinet RiskOps™ is a cloud-based solution tailored for healthcare organizations. It simplifies the traditionally cumbersome process of sharing cybersecurity and risk data between healthcare delivery organizations (HDOs) and vendors. By using this platform, organizations can move away from fragmented, manual workflows to a more efficient, centralized system for managing vendor risks [9].
At the heart of Censinet RiskOps™ is its Digital Risk Catalog™, which includes over 50,000 vendors and products. More than 100 healthcare providers and payers actively use the platform's Censinet Risk Network, benefiting from shared intelligence that speeds up risk assessments and decision-making [8].
The platform's automation capabilities are a major advantage. Vendors complete standardized questionnaires once and can share them with multiple customers, saving time while maintaining high security standards. This streamlined approach eliminates redundant work and ensures consistent risk evaluations [8].
Censinet RiskOps™ also provides end-to-end risk coverage throughout the vendor lifecycle. Features like breach alerts, dynamic risk tiering, and automated reassessments ensure continuous monitoring and quick responses to emerging risks [8]. Its Delta-Based Reassessments feature, for example, allows organizations to complete vendor reassessments in less than a day, helping them stay on top of evolving risks without overburdening their teams [8].
Another standout feature is Censinet AITM™, which leverages automation to let vendors complete questionnaires in seconds. It also generates risk summary reports automatically, making it easier for healthcare organizations to scale their risk management efforts.
How Censinet Supports Scalable Risk Management
Censinet is built to grow alongside healthcare organizations, addressing the increasing complexity of vendor networks and regulatory demands. Its capabilities are designed to provide flexibility and efficiency, no matter the size of the organization.
The platform's centralized risk register links assets, controls, and risk owners, giving organizations a clear, comprehensive view of risks across departments. This interconnected approach fosters collaboration among clinical, administrative, and technical teams, ensuring vendor risk management efforts are aligned [7].
Censinet also extends visibility beyond direct vendor relationships, offering fourth-party risk monitoring. This allows healthcare organizations to identify risks within their vendors' networks, helping them proactively address vulnerabilities that could affect patient care or data security [8].
The platform's automated corrective action plans (CAPs) simplify the transition from identifying risks to mitigating them. By offering in-platform tracking and recommended solutions, even healthcare organizations with limited cybersecurity resources can manage vendor risks more effectively [8].
Real-time alerts for breaches and ransomware incidents are another critical feature. These notifications allow organizations to respond quickly to security events, which is especially important given the healthcare sector's susceptibility to ransomware attacks.
Censinet also supports multiple compliance frameworks simultaneously, including HIPAA and HITRUST, reducing the administrative burden of meeting various industry standards. This ensures healthcare organizations maintain comprehensive compliance without duplicating efforts [7].
Customizable dashboards make it easy for executives and board members to access actionable insights. With a clear, consolidated view of cyber risks, decision-makers can allocate resources more effectively and align their strategies with organizational priorities [8].
For organizations managing large vendor portfolios, Censinet's risk tiering and reassessment scheduling features help focus attention on high-risk vendors while efficiently managing lower-risk relationships. This targeted approach ensures resources are used where they’re needed most.
Lastly, the platform’s longitudinal risk record preserves historical data for all vendors, allowing organizations to track trends, measure progress, and demonstrate compliance over time. This combination of real-time monitoring and automated documentation supports long-term improvements in risk management [8].
sbb-itb-535baee
Best Practices and Common Challenges in Vendor Risk Scoring
Balancing thoroughness with efficiency is key to effective vendor risk scoring. However, real-world obstacles can often disrupt even the best-laid plans.
Best Practices for Accurate Vendor Risk Scoring
Tailor scoring criteria to match your organization's specific risks.
The priorities of a small rural clinic won't align with those of a sprawling academic medical center. Adjust your scoring framework to emphasize categories like operational risk, information security, or compliance risk based on your unique vulnerabilities and regulatory requirements.
Adjust assessments based on vendor risk levels.
Vendors managing sensitive patient data or critical clinical systems should undergo detailed, on-site evaluations. On the other hand, low-risk vendors, such as those handling administrative tasks, might only need to complete standardized questionnaires. This targeted approach ensures resources are focused where they’re most needed.
Incorporate vendor scoring into your GRC framework.
Vendor risk assessments aren’t just a good idea - they’re often mandated by regulations in many industries [10]. Your scoring system should fit seamlessly into your governance, risk, and compliance (GRC) framework. This integration promotes consistent decision-making and reduces administrative burdens across teams.
Use visual dashboards to secure executive buy-in.
Clear, visual reporting tools can help leadership understand the importance of investing in vendor risk management processes, technology, and personnel.
Document your starting point before making changes.
Begin by cataloging your current policies, tools, and third-party relationships [12]. This baseline helps identify gaps and redundancies, providing a foundation for tracking improvements over time.
Standardize assessment templates to streamline evaluations.
Centralizing templates ensures consistency. When vendors receive varying questionnaires from different departments within the same organization, it can lead to inefficiencies and misaligned responses. A unified approach simplifies the process and avoids confusion.
By refining these practices, organizations can not only improve vendor risk scoring but also bolster the protection of sensitive patient data. However, even with these strategies, challenges remain.
Common Challenges and How to Overcome Them
Despite robust frameworks and tailored methods, several hurdles can complicate vendor risk scoring.
Static assessments miss evolving risks.
Annual evaluations may overlook new threats or changes in a vendor’s security posture. Implement continuous monitoring and schedule reassessments based on the vendor’s risk level to stay ahead of emerging challenges.
Unclear protocols for handling assessment findings.
Defining ownership, timelines, and securing vendor cooperation can be tricky [11]. Clear escalation procedures and remediation requirements in vendor contracts create accountability and ensure timely resolution of identified risks.
Overlooking fourth-party risks.
Vendors often rely on their own subcontractors, introducing indirect vulnerabilities [11]. Require vendors to disclose key subcontractors and include fourth-party monitoring in your risk assessments to close this gap.
Navigating compliance across multiple jurisdictions.
Organizations operating in various states or regions face a maze of regulations [11]. Keeping up with state privacy laws, federal requirements, and industry standards is essential. Regularly updating your understanding of these laws ensures compliance [10].
Resource constraints limit effectiveness.
Limited resources can make it challenging to maintain a strong risk management program. Building flexible security and governance frameworks can help organizations adapt to shifting demands [12].
The stakes are high. With 23% of all cyberattacks targeting healthcare and 35% of those attacks stemming from third-party vendors [12], gaps in vendor assessments can have serious consequences. Even more alarming, 40% of vendor contracts are finalized without a security risk assessment [12], underscoring the need for systematic processes to identify risks early.
A comprehensive approach to third-party risk management - one that includes risk profiling, detailed contracts, and clear issue management [11] - can transform vendor risk scoring into a valuable strategic tool rather than just a compliance requirement.
Regulatory and Industry Standards for Vendor Risk Scoring in 2025
Healthcare organizations are navigating a regulatory maze that directly impacts how they evaluate and manage vendor relationships. Staying compliant not only safeguards patient data but also ensures smooth operations. These regulations, when integrated into the vendor assessment process, bring sharper focus to scoring criteria and operational controls.
Key Regulations Shaping Vendor Risk Scoring
HIPAA remains central to vendor risk management in healthcare. The Health Insurance Portability and Accountability Act requires healthcare organizations to conduct thorough risk analyses when working with third-party vendors. This includes identifying electronic personal health information (ePHI), evaluating external sources accessing this data, and addressing threats - whether environmental, natural, or human - that could compromise systems containing ePHI [15].
Across industries, there’s a growing emphasis on robust vendor management, reflecting the understanding that third-party relationships often pose significant vulnerabilities requiring structured oversight [13].
Federal banking regulators offer a useful framework that healthcare organizations can adapt. Guidance issued in 2023 by the Federal Reserve, FDIC, and OCC lays out five phases for managing third-party relationships: planning, due diligence and selection, contract negotiation, ongoing monitoring, and termination [13]. While designed for financial institutions, this framework provides a solid foundation for healthcare vendor management.
The COSO framework also supports third-party risk management, offering governance structures that align with regulatory expectations for risk oversight and internal controls [13].
Cybersecurity mandates are transforming vendor requirements. The Office for Civil Rights (OCR) is moving from voluntary guidelines to mandatory cybersecurity standards [16]. This shift will require healthcare organizations to scrutinize vendor cybersecurity capabilities more rigorously.
"We are committed to pursuing the changes needed to improve quality of care and eliminate undue burdens on covered entities while maintaining robust privacy and security protections for individuals' health information." – Roger Severino, Then OCR Director [16]
The Department of Health and Human Services (HHS) has outlined a Healthcare Sector Cybersecurity Strategy to combat rising cybersecurity threats. This strategy includes voluntary goals, incentives for hospitals to adopt best practices, a unified HHS-wide cybersecurity approach, and an expanded resource hub for healthcare cybersecurity [16].
Integrating Compliance into Vendor Risk Scoring
Incorporating these regulatory requirements into vendor risk scoring transforms compliance into a proactive strategy. By aligning compliance with risk management, healthcare organizations can address vendor-related risks more effectively.
Embedding compliance into scoring criteria is essential. Healthcare organizations should integrate regulatory requirements into their risk management strategies to ensure vendors adhere to industry rules and internal policies [17]. This approach shifts compliance from a simple checklist to a key part of risk mitigation.
A strong compliance program minimizes third-party risks by ensuring vendors meet regulatory, industry, and internal standards [17]. The goal is to create assessment frameworks that combine regulatory requirements with operational risks in a single scoring system.
- Focus on high-risk vendors. Prioritize vendors handling sensitive data or critical operations for detailed compliance evaluations [17]. This ensures resources are allocated efficiently while addressing the most significant risks.
- Strengthen due diligence. Incorporate regulatory requirements into vendor selection criteria. Evaluate compliance history, certifications, and the ability to meet ongoing obligations. Document these thoroughly to demonstrate compliance during audits [17].
- Draft robust contracts. Vendor agreements should mandate HIPAA compliance, outline breach notification protocols, and include audit rights [17]. Clear contracts create enforceable obligations that reinforce your compliance efforts.
- Monitor continuously. Don’t rely solely on annual assessments. Vendor capabilities and risks evolve, so implement ongoing monitoring processes to track compliance, security incidents, and changes in regulations [17].
- Enforce cybersecurity standards. Adopt zero-trust security models and comprehensive vendor cybersecurity programs that align with current regulations [14]. These measures provide clear indicators for your scoring system.
- Demand certifications. Require vendors handling sensitive healthcare data to maintain up-to-date regulatory and ethical compliance certifications. Regularly verify these certifications and ensure vendors notify you of any changes [17].
For Medicare Advantage organizations, conduct audits of contracts and risk adjustment methodologies, vet health risk assessment vendors thoroughly, and use advanced analytics to identify unusual diagnosis coding patterns [14].
Leverage technology to scale compliance oversight. Use tools like contract management platforms, real-time price file generators, and automated vendor evaluation frameworks to manage large vendor portfolios efficiently [14][17]. Automating routine compliance tasks allows organizations to focus on strategic oversight.
As regulations continue to evolve, healthcare organizations must remain agile. By building flexible, technology-driven compliance frameworks, they can adapt quickly to new requirements while maintaining operational efficiency. This adaptability is key to staying ahead in a rapidly changing regulatory landscape.
Conclusion: Improving Vendor Risk Scoring in Healthcare
The healthcare sector is at a crossroads when it comes to managing vendor risks. With cyber threats advancing rapidly and regulations becoming tougher, it's clear that healthcare organizations need to rethink how they assess and manage third-party risks.
Key Points Recap
Let’s revisit some of the critical takeaways. Data reveals a growing urgency for proactive vendor risk management, as cyberattacks on healthcare systems often exploit third-party vulnerabilities [12]. The shift must be away from outdated, compliance-only methods toward a proactive, system-wide strategy. As Sıla Özeren, Security Research Engineer at Picus Security, puts it:
"From static checklists to real-world proof. From reacting after damage is done to anticipating and mitigating risk before patient care is compromised"
– Sıla Özeren, Security Research Engineer, Picus Security [19]
Modern risk management calls for integrated tools that simplify processes and support better decision-making. Solutions like Censinet RiskOps™ offer healthcare organizations the ability to manage vendor risks at scale by combining AI-driven automation with human oversight.
Achieving accurate vendor risk scoring hinges on thorough evaluations, continuous monitoring, and stringent access controls [18]. These steps not only strengthen risk management but also help secure executive buy-in. Visual dashboards, for example, can effectively highlight the urgency of risks and their potential impact, encouraging leadership to invest in robust oversight frameworks.
Looking Ahead: Strengthening Risk Management
As risks grow and regulations evolve, adopting forward-looking strategies is no longer optional. Organizations must understand that acceptable risk levels can vary greatly depending on their size, resources, and patient populations. Steve Cagle, CEO of Clearwater, explains:
"What's acceptable risk? That's going to be different for a rural hospital versus a large, integrated delivery network. Is it a million dollars, or is it $10 million to get to a high level of impact? Those are all things that organizations need to spend time with and really understand"
– Steve Cagle, CEO, Clearwater [19]
AI-based automation and cloud security are emerging as priorities for scaling risk management efforts [12]. Combining these technologies with human expertise ensures patient safety remains front and center. Platforms like Censinet RiskOps™ strike this balance by leveraging AI while maintaining critical decision-making oversight.
As cybersecurity regulations grow stricter and enforcement becomes more aggressive, healthcare organizations can’t afford to wait for the next breach to take action. The rising tide of cyber threats, expanding vendor ecosystems, and tighter regulatory demands require immediate focus. These steps not only address current challenges but also lay the foundation for long-term advancements in healthcare risk management.
FAQs
What is vendor risk scoring, and how does it help healthcare organizations improve security?
Vendor risk scoring involves assessing and classifying vendors based on the security risks they may pose. In healthcare, this method is essential for pinpointing vendors with higher risk levels and addressing critical vulnerabilities. This ensures better protection for patient data, clinical systems, and other sensitive information.
By concentrating resources on the most pressing risks, healthcare organizations can simplify risk management, minimize exposure to cyber threats, and stay aligned with industry regulations. This focused approach not only strengthens data protection but also helps maintain trust and operational efficiency.
What challenges do healthcare organizations face with vendor risk scoring, and how can they address them?
Healthcare organizations face a variety of hurdles when it comes to vendor risk scoring. These include struggles with collecting accurate data, dealing with incomplete or outdated vendor lists, lacking clear insight into potential risks, and being stretched thin on resources like time and staff.
To tackle these challenges, organizations can implement several strategies. Automating risk assessments can save time and reduce errors, while prioritizing high-risk vendors ensures critical areas get immediate attention. Leveraging advanced technology for real-time monitoring can enhance oversight, and setting up well-defined vendor management policies and workflows can make the entire process more efficient and effective.
How does HIPAA impact vendor risk scoring for healthcare organizations?
HIPAA significantly influences how healthcare organizations assess and manage vendor risks. It requires regular risk assessments, in-depth evaluations of third-party compliance, and continuous monitoring to protect patient information and meet regulatory requirements.
By emphasizing the importance of data privacy and security, HIPAA encourages a systematic process for identifying and addressing risks tied to vendors managing sensitive data, such as Protected Health Information (PHI). This not only ensures compliance but also helps maintain patient trust.
