Healthtech pilot scorecard

Blank worksheet, HIPAA/BAA/security parallel-path checklist, filled fictional example, and AI prompt for scoring a healthtech / digital health pilot toward MSA or PO.

Blank worksheet

Update weekly. Bring this to midpoint and to the commercial ask. Bound scope to one site / one specialty / one workflow unless the agreement says otherwise.

Criterion	Baseline	Target	Current	Status	Owner
1. ___	___	___	___	[ ] G [ ] A [ ] R	___
2. ___	___	___	___	[ ] G [ ] A [ ] R	___
3. ___	___	___	___	[ ] G [ ] A [ ] R	___
4. ___ (optional)	___	___	___	[ ] G [ ] A [ ] R	___
5. ___ (optional)	___	___	___	[ ] G [ ] A [ ] R	___

HIPAA / BAA / security parallel-path checklist

Start these in week one of serious interest, often before or alongside clinical proof instead of after "liked it." Track them as first-class workstreams beside product proof.

Workstream	Status	Blocker	Owner	Due
BAA / BA agreement	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
HIPAA / privacy questionnaire	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
SOC2 / HITRUST / security packet	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
Vendor-risk / InfoSec review	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
EHR / integration / FHIR / SSO	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
Pen-test / security review	[ ] Not started [ ] In flight [ ] Cleared	___	___	___
IRB / research path (if applicable)	[ ] N/A [ ] Not started [ ] In flight [ ] Cleared	___	___	___
MSA / GPO / insurance / order-form path	[ ] Not started [ ] In flight [ ] Cleared	___	___	___

Working steps

Paste written success criteria into the scorecard before kickoff: turnaround time, read rates, documentation time, denial rate, throughput. No soft "clinicians liked it" or NPS-only lines.

Score green / amber / red every week with evidence links compliance or finance could re-read.

Run the HIPAA / BAA / security parallel-path checklist every week with named owners. Teams that find BAA or interface gaps in the final week miss the EHR go-live or quality deadline.

At midpoint, narrow to one site / specialty if amber, and don't add service lines without saying so. Keep design-partner / IRB work on a separate clock if it exists.

In the final week, ask for the PO or MSA schedule; if budget wobbles, cut sites or specialties, not list price.

Filled example (fictional: ambulatory documentation)

Teaching example only. Pattern-check your deal; do not cite these numbers as a real case study.

Criterion	Baseline	Target	Current (wk 7)	Status	Owner
Median documentation time (specialty)	18 m	≤10 m	9.5 m	Green	Ruiz / you
Note completeness / QM pass rate	81%	≥92%	94%	Green	Ruiz
BAA + security questionnaire cleared	Not started	Cleared before ask	Cleared wk 6	Green	InfoSec + you
Epic interface / SSO	Pending	Live before midpoint	Live wk 3	Green	IT
Pen-test scheduled	None	Complete or waived	Report in review	Amber	Vendor risk

AI prompt

Paste into ChatGPT or Claude. Replace bracketed placeholders with your deal facts.

You are helping a healthtech / digital health founder run a paid pilot that must convert to a PO or MSA schedule with a provider, payer, or life-sciences buyer.

Company / product: [YOUR COMPANY + PRODUCT]
Buyer account: [HEALTH SYSTEM / SPECIALTY GROUP / PAYER / LIFE SCIENCES + SEGMENT]
Scope in pilot: [ONE SITE / ONE SPECIALTY / ONE WORKFLOW]
Pilot window: [START] to [END]
Target phase-two ACV / MSA intent: [AMOUNT]
Clinical champion: [NAME / TITLE, e.g. CMO / CMIO / specialty lead]
Economic buyer: [NAME / TITLE, e.g. CFO / COO / CIO]
IT / InfoSec / EHR contact: [NAME / STATUS]
Privacy / compliance / BAA: [NAME / STATUS]
IRB / research path (if any): [N/A / SEPARATE CLOCK / STATUS]
Compelling event: [EHR MODULE GO-LIVE / QUALITY MEASURE DEADLINE / STAFFING CRISIS / PRIOR-AUTH BURDEN / SITE EXPANSION / OTHER]

Produce:
1) A markdown scorecard table with columns:
Criterion | Baseline | Target | Current | Status (green/amber/red) | Evidence | Owner
Include 3-5 underwritable criteria (turnaround time, read rates, documentation time, denial rate, throughput, prior-auth cycle time). No soft "clinicians liked it" or NPS-only lines.
2) A second table: Stakeholder | Role | Attitude | Next action this week
(Roles: clinical champion, EB, IT/InfoSec/EHR, privacy/compliance, procurement, end users)
3) A third table for the HIPAA/BAA/security parallel path: Workstream | Status | Blocker | Owner | Due
(Include BAA, HIPAA/privacy questionnaire, SOC2/HITRUST, vendor risk, EHR/integration/SSO, pen-test, IRB if applicable, MSA/order form)
4) End with 5 bullets: biggest risk, whether to ask for PO/MSA this week, scope-cut options (one site / one specialty; no discount), one quick-win memo angle for EB + clinical sponsor, one thing to stop doing.

Rules:
- Invent no fake metrics; use ___ when unknown.
- Every status needs a next action.
- Prefer reduce sites / specialties / workflow over discounting list price.
- Clinical champion is not the economic buyer.
- Design partner / IRB / co-development is not a paid customer pilot. Keep the clocks separate.
- HIPAA / BAA / security often start before or alongside the pilot instead of after "liked it."