The deal did not stall on price.

The champion loved it. Legal was fine. Then the questionnaire arrived, and the close date moved a quarter to the right.

The natural response is to answer the questionnaire faster.

But the questionnaire is not the obstacle. It is the moment your architecture becomes legible to someone whose job is to find what you have not thought about.

What they are actually assessing

A health system reviewer is not scoring your feature set. They are deciding how much of their risk you are about to become. Underneath the document, the questions are consistent:

• **Where does our data live, and who can reach it?** Tenancy model, isolation mechanism, and who on your team can read production data. "Role-based access" is a claim; they want the enforcement point.
• **What happens when you are breached?** Not whether. Detection, notification timelines, and who calls whom. A named process beats a confident assurance.
• **Can you prove access after the fact?** Audit logging that is complete, tamper-evident, and retained long enough to matter.
• **What is your subprocessor chain?** Every vendor you use inherits their scrutiny. AI providers get read closely now.
• **How do changes reach production?** Review, testing, approvals, and rollback. They are assessing whether a bad change can reach patient-facing systems unnoticed.
• **What is your recovery posture?** Backups nobody has restored are not backups. They will ask when you last tested one.

Why teams fail it late

Almost none of this is hard to build. It is hard to *retrofit*, and retrofitting is exactly what happens when the review is the first time anyone asks.

Multi-tenant isolation chosen for convenience early becomes a rewrite under scrutiny. Audit logging added after the fact has a gap exactly where the history matters. A subprocessor added quietly to ship a feature becomes a contractual problem in the middle of a negotiation.

The mechanism is simple: security review is a *revealed* architecture decision. You are not being asked what you would like to be true. You are being asked what you built, eighteen months ago, when it was faster not to decide.

SOC 2 is not the same as being ready

A report tells the reviewer you have controls and that someone checked them. It does not answer whether your tenancy model survives their specific question, or whether your AI subprocessor has a BAA.

Teams with a clean report still stall here, because the report was scoped to what was easy to attest, not to what the buyer's reviewer cares about.

The better question

Do not ask how quickly you can answer the questionnaire.

Ask which answer you would not want to give truthfully today — and fix that one first, before it is worth a quarter of pipeline.

Next step

If enterprise health system reviews are in front of you and you would rather find the weak answer yourself than have a reviewer find it, that is a scoped diligence exercise. Book a fit review.