Local Validation of Vendor AI: A Checklist for Health Systems

Why local validation matters

Vendor models, including those supplied by EHR developers, are trained and tested on someone else’s patients. A widely deployed sepsis model scored a hospitalization-level AUC of 0.63 when one health system validated it on its own data (Wong A et al., JAMA Intern Med 2021).

Hospital surveys show local evaluation is common but not universal. A Health Affairs study of the 2023 AHA IT Supplement reported that 65% of US hospitals used predictive models, 79% of those used models from their EHR developer, 61% of users evaluated models for accuracy on their own data, and only 44% evaluated them for bias (“Current Use And Evaluation Of Artificial Intelligence And Predictive Models In US Hospitals,” Health Affairs, doi:10.1377/hlthaff.2024.00842). An ONC data brief reports that in 2024, 82% of hospitals evaluated predictive AI for accuracy, 74% for bias, and 79% did post-implementation monitoring (ASTP/ONC data brief, Hospital Trends in Predictive AI, 2023–2024). Both are self-reported survey figures.

A local validation checklist

1. Get the vendor's documentation. For certified health IT, ONC's HTI-1 rule requires source attributes for decision support interventions, including information about development and validation data (HTI-1 final rule (Federal Register, Jan 9, 2024); 45 CFR 170.315). Rules in this area change; re-check the current criteria.
2. Define the local population and outcome the way your clinicians would, before running anything.
3. Run a silent (shadow) evaluation on recent local data: discrimination, calibration, and performance at the threshold you plan to use.
4. Break results out by subgroup (age, sex, race and ethnicity, site, unit).
5. Measure alert burden and workflow fit: alerts per patient-day and positive predictive value at the threshold.
6. Report the result against a reporting guideline such as Collins GS et al. TRIPOD+AI. BMJ 2024;385:e078378. doi:10.1136/bmj-2023-078378.
7. Monitor after go-live and set triggers for re-validation; frameworks such as Wells BJ et al., FAIR-AI, npj Digit Med 2025;8:514 and NIST AI RMF 1.0 (NIST AI 100-1) describe governance and review. ONC SAFER Guides cover broader EHR safety practice.

This is not legal or regulatory advice; consult qualified counsel.

What it means for vendors

• Expect buyers to ask for validation data descriptions, subgroup results and a plan to support a local silent evaluation.
• Offer a calibration and threshold-setting step as part of onboarding.
• Make monitoring outputs easy to export.

Go deeper

• Clinical prediction model validation
• Health AI validation claims: 8 red flags
• Selling to health systems: vendor security review

Sources (accessed October 27, 2026)

1. “Current Use And Evaluation Of Artificial Intelligence And Predictive Models In US Hospitals,” Health Affairs, doi:10.1377/hlthaff.2024.00842
2. Wells BJ et al., FAIR-AI, npj Digit Med 2025;8:514
3. ASTP/ONC data brief, Hospital Trends in Predictive AI, 2023–2024
4. HTI-1 final rule (Federal Register, Jan 9, 2024)
5. 45 CFR 170.315
6. Collins GS et al. TRIPOD+AI. BMJ 2024;385:e078378. doi:10.1136/bmj-2023-078378 (cited by standard reference)
7. NIST AI RMF 1.0 (NIST AI 100-1)
8. ONC SAFER Guides
9. Wong A et al., JAMA Intern Med 2021

Related resources

• Healthcare AI consulting
• EHR integration
• Clinical study design