A Process for Vetting New Suppliers

May 19, 2020

3 minute read

The COVID-19 pandemic has led to unique procurement challenges that require vetting new suppliers fast. Hospitals are negotiating shortages in product categories ranging from PPE to ventilators and bronchoscopes. There is also competition from other hospitals, and from local, state and federal authorities trying to secure similar products.

To overcome these challenges, more hospitals are working with new suppliers. However, it’s not always clear which suppliers are legitimate -- particularly as manufacturers from other industries begin producing medical equipment for the first time. As a result, hospitals must be able to quickly assess whether a vendor is trustworthy.

To help hospitals vet new suppliers, we’ve created a checklist with linked resources. Not every step will be relevant for each supplier. For example, a supplier may not be registered with the FDA and still be legitimate. But on the whole, the checklist provides structure that can be adapted for the needs of individual hospitals and health systems.

We expect to see supply chain disruptions through 2021, given the time required for new manufacturers to receive required approvals and begin production, and for current manufacturers to meaningfully increase their production capacity. As a result, it will remain important to have a process for vetting new suppliers.

New Supplier Checklist

1. Is the supplier registered with the FDA?

  • Call and email the listed U.S. Agent to ensure the registration is legitimate. Ask for verification of their registration ID. Per the FDA, “Owners or operators of places of business that are involved in the production and distribution of medical devices intended for use in the United States are required to register annually with the FDA.”
  • 2. Is the supplier NIOSH approved?

  • NIOSH, the National Institute for Occupational Safety and Health, is part of the CDC dedicated to worker safety. They maintain a list of approved respirators.
  • 3. Look up the supplier’s website owner on ICANN. Do the owner and website look legitimate?

  • Has the website existed for as long as the company claims to have been in business? Does the website look legitimate? Can the registrant listed confirm that the supplier is legitimate? If her contact information is protected by the WHOIS contact privacy service, utilize their outreach tool.
  • 4. Does AHRMM or the AHA have information on this supplier?

    5. Ask for references from suppliers.

  • Has the supplier worked with other hospitals or do they have existing public contracts (e.g. Veterans Affairs or GSA Advantage contracts)?
  • 6. Ask for referrals to new suppliers from industry colleagues.

    7. Look up the supplier's Form 5500. Verify the supplier's TIN by logging in with your IRS account credentials.

  • The Form 5500 provides public information on employers' benefit plans for employees.
  • 8. Does the supplier claim to be registered in the System for Award Management? Look up their entity registration.

  • Any entity interested in doing business with the US government must register in the System for Award Management.
  • 9. Verify the supplier’s products using the GUDID.

  • Ask the supplier to provide unique device identifiers (UDI-DIs) and corresponding GUDID records for their products and search their UDI-DI in AccessGUDID. After selecting an item, send an email to the listed "Customer Contact" to confirm that the outreach is legitimate.
  • 10. Consider spreading key orders out over multiple vendors.

  • Diversify risk by sourcing a critical item from multiple vendors rather than relying on an untested vendor for a single large puchase.
  • If you are interested in being able to do all of these supplier validations in one place, let us know. To assist hospitals with vetting new suppliers during the pandemic, we also published a list of COVID-critical supplies and suppliers.