- Scenarios where alternatives are better
- Large multi-hospital networks seeking a single standardized international EMR with broad third-party marketplaces and extensive global references
- Organizations requiring publicly available, independently verifiable security attestations (for example, SOC 2 Type II reports or published penetration test summaries). The vendor may provide such documents under NDA, but they were not publicly available in the reviewed materials.
- Use cases that require a publicly documented developer portal, API marketplace, or extensive third-party app ecosystem; no public developer portal or repository was identified in the reviewed materials.
- Budget/contracting items to verify
- Clarify the definition of the billing unit and obtain worked examples of monthly costs based on the buyer’s organizational structure.
- Confirm what is included in base support versus what is considered expanded scope or billable professional services; establish SLAs and outage handling provisions in writing.
- Current limitations acknowledged by the vendor
- Contractual terms state that the vendor does not guarantee uninterrupted or error-free operation; this is a standard SaaS disclaimer but should be mapped to operational SLA requirements.
- Feature roadmap
- The vendor publishes news items indicating ongoing product changes and release activity, but a detailed feature roadmap with dates and prioritized deliverables was not available in the reviewed materials.
- Scale limitations
- No public documentation was found describing explicit scale limits or performance guarantees tied to customer size or transaction volumes.
- Security/compliance gaps
- While the vendor asserts ISO 27001 certification, broader security artifacts (SOC 2, penetration test summaries, data residency commitments) were not found in public materials and should be requested during procurement.
- Website integrity concern
- During the review, several pages on the vendor’s public website contained unrelated or anomalous content that appears inconsistent with the company’s primary product focus. This could indicate a content management issue, site compromise, or miscategorized blog content. Procurement teams should request an explanation and evidence of remediation and confirm that production service security and governance are managed separately from any public-facing web content concerns.