Flora Health — Partner Security Assessment 2026

Partner security assessment

Flora Health embeds market access infrastructure into EHR clinical workflows, which means Flora and its partners handle protected health information and prescriber data on behalf of health systems and pharmaceutical brands. This assessment is how Flora reviews the partners who touch that data.

Your answers shape how Flora works with you — they are not a test to pass. A partial response with honest gaps is more useful than a complete one that overstates your controls.

Time needed

15–25minutes, in one sitting or several

Questions

—fewer if sections do not apply to you

Your progress

Savedautomatically as you type

Worth having to hand

Your information security policy, and your SDLC policy if you build software
Any current attestation — SOC 2, HITRUST, ISO 27001 — with its report date
Your most recent vulnerability scan and penetration test summary
Cyber liability insurance details: carrier, limit, policy period
Your subprocessor list, and the status of any BAA or DPA with Flora

You can answer without these and send them afterwards — the form asks you to name each document rather than upload it.

Prepared for

Your organization

Response due

See the covering email

Questions

Reply to the email that sent you this link

Nothing is sent to Flora until you submit at the end.

Annual partner security assessment

Flora Health embeds market access infrastructure into EHR clinical workflows, so Flora and its partners handle protected health information and prescriber data on behalf of health systems and pharmaceutical brands. Flora reviews every partner that stores, processes, or can access that data at least once a year.

Start with Section A. Later questions appear or disappear based on those answers, so parts of this form may not apply to you at all. Nothing is submitted from this page: when you are finished, use Download responses and email the file back, along with any documents requested.

Return to: Ricky Morival, IT and Operations Manager, Flora Health
Due: See the covering email
Questions marked: * are required

Flora treats your responses as confidential and shares them only with personnel and clients who need them for security review. If a document requires a mutual NDA before release, say so in your reply rather than attaching it here. A partial response with honest gaps is more useful than a complete one that overstates your controls.

Thank you — your assessment is with Flora

Your response was received and recorded. Please keep the reference below; quote it in any correspondence about this assessment.

—

What happens next

Flora reviews your response and the documents you named, and assigns a risk tier based on the data and access involved in our work together.

If anything needs clarifying, your Flora contact will come back to you with specific questions rather than asking you to complete the form again.

Where gaps are identified, Flora will agree remediation items and target dates with you. Gaps are normal; leaving them undisclosed is the problem.

This assessment is repeated annually, or sooner if the nature of our work together changes.

One thing left

If you named documents in your answers, send them using the upload link in the email that brought you here, or reply to your Flora contact with them attached. Your assessment is not complete until those arrive.

A record of exactly what you submitted.

Flora treats your responses as confidential and shares them only with personnel and clients who need them for security review purposes.