Every automation needs access to something: an inbox, an ERP, a pharmacy system, a portal. Before you connect anything, run through this checklist.
1. Access
- Give each automation its own account, not a shared staff login.
- Grant only the permissions it needs, and nothing more.
- Know how to switch it off quickly.
2. Credentials
- Store passwords and API keys in a secure vault or your own environment, not in scripts or spreadsheets.
- Rotate credentials when people leave or vendors change.
3. Data flow
- Map where data goes: which systems, which cloud services, which AI models.
- For sensitive data, such as patient information, keep it inside your own systems wherever possible.
- Check that any AI service you use does not train on your data.
4. Logging and monitoring
- Every action the automation takes should be logged.
- Failures should raise an alert, not fail silently.
5. Ownership
- You should own the automation, its documentation and its credentials.
- Someone on your team should know what it does and how to pause it.
We document all of this before go-live on every project. If you want a second opinion on an existing automation, get in touch.