best practices for vetting VPATs and HEVACs, how to contact vendors, license language, contract review