Hospitals Still Own the Risk of Their Cloud Vendors

DORA‘s critical third-party oversight regime applies specifically to financial entities and the ICT providers designated as critical to that sector. Hospitals are not directly in scope. The pattern it exposes, however, applies just as much to a health system’s own reliance on cloud and clinical IT vendors: regulatory oversight of a vendor, wherever it exists, never transfers the health system’s own accountability for that relationship.

Some health systems watching this development assume the underlying lesson does not apply to them because they are regulated differently. That assumption misses the point: concentration risk in a small number of critical vendors is a structural property of relying on those vendors, not a consequence of a specific regulation. A health system can be entirely outside DORA’s scope and still be dangerously exposed to the same failure mode DORA was designed to manage.

Executive Summary

Health systems watching frameworks like DORA develop in financial services can draw a direct lesson for their own vendor risk, even without being in scope: concentration in a small number of critical vendors, and the accountability that concentration creates, does not go away because no external regulator happens to oversee that specific vendor. For compliance leads, the practical response is treating vendor concentration as a risk to manage continuously, not a compliance category that only applies to other sectors.

Key Takeaways

1. A vendor being subject to external oversight does not transfer a health system’s own accountability for that relationship. The obligation to understand and manage the risk sits with the health system regardless.
2. Hospitals relying heavily on a small number of cloud or clinical IT vendors carry concentration risk regardless of whether any external body oversees those vendors.
3. Regulators and patients increasingly expect continuous evidence of vendor oversight, not a one-time due diligence exercise performed at contract signing.
4. A register of vendor relationships and their criticality is worth maintaining regardless of sector-specific mandates, because the underlying risk exists independent of the regulation.
5. The health system’s own obligation to prove control over vendor relationships never moves, whoever else is watching.

What Critical Third-Party Designation Actually Does in Financial Services

Understanding why DORA’s mechanism exists helps clarify why the underlying lesson transfers even where the regulation does not. The designation mechanism gives regulators visibility into providers whose failure could have consequences across many financial entities at once, based on systemic impact and concentration of reliance.

Designation Is About Systemic Concentration, Not Individual Vendor Risk

A provider gets designated as critical because a large number of regulated entities depend on it in ways that could create sector-wide disruption. A health system’s own exposure to a vendor, based on how heavily it actually relies on that vendor, is a separate question that no designation mechanism, in any sector, answers on its behalf.

Why Your Own Accountability Never Moves

Whether or not a regulator directly oversees a vendor, the health system relying on that vendor retains full responsibility for understanding what happens if it fails. This holds regardless of which sector the health system operates in.

External Oversight of a Vendor Is Not Oversight of Your Contract

Even where a vendor is subject to intense regulatory scrutiny in another sector entirely, that scrutiny examines the vendor’s general risk management, not any individual customer’s specific contract, exit plan, or dependency. A health system cannot outsource its own due diligence to a regulator that has never reviewed its actual relationship with that vendor.

Concentration Risk Exists Independent of Regulatory Scope

A health system that depends on a small number of vendors for clinical systems, storage and communications carries the same structural concentration risk a financial institution carries toward its critical ICT providers, whether or not any regulation names that risk explicitly.

What Good Vendor Risk Management Looks Like, Regulated or Not

The practices that make DORA’s third-party risk regime effective for financial entities are the same practices that protect any organisation relying on a small number of critical vendors.

A Register of Vendor Relationships Is a Living Record

Maintaining an accurate account of which vendors support which clinical and administrative functions, and how critical each is, is worth doing regardless of sector-specific mandate, because the exercise itself is what surfaces concentration risk before it becomes a crisis.

Monitoring Has to Be Continuous, Not a One-Time Exercise

A due diligence exercise performed once at contract signing does not tell a health system anything about a vendor’s current risk posture years later. Continuous monitoring, even informally, is what turns a vendor relationship from an assumption into something actually managed.

Building Vendor Risk Management Before a Regulator Asks You To

The practical response for a health system is to build the same internal capability a regulated financial entity is required to build: a continuously updated view of which vendors are genuinely critical, how concentrated that reliance is, and what evidence exists of ongoing oversight, done because it protects the health system, not because a regulation demands it.

How a Data Control Plane Supports Continuous Vendor Risk Evidence

Demonstrating control over vendor risk depends on being able to show, continuously, what data moves through which vendors and channels, who accessed it, and under what conditions, rather than relying on a vendor’s own assurances or a due diligence exercise performed once.

The Kiteworks Data Control Plane applies data-aware, zero-trust controls to every action across every channel, capturing a continuous, tamper-proof, unthrottled audit log that feeds directly into SIEM tooling, giving health systems evidence of their own vendor oversight independent of any external designation regime. Single-tenant architecture and customer-owned encryption keys further mean a health system’s control over its most sensitive exchanges does not depend on any third party’s oversight status.

Health systems that want to see how continuous evidence supports their own vendor risk management can schedule a custom demo.