Most HIPAA AI vendor conversations go wrong in the first ten minutes — not because the vendor is lying, but because the practice doesn't know what to ask. A vendor can pass a casual due-diligence call and still leave PHI in places it shouldn't be. This is the checklist we'd run on ourselves before signing.
The non-negotiable first three
- Will they sign a BAA? If no, the conversation ends. A BAA is table stakes for any vendor that will touch PHI.
- Can they describe exactly where PHI flows? Not "we're HIPAA-compliant." A specific answer: the call lands here, the transcript is stored here, the automation reads from here, the retention is X days, the access controls look like Y.
- Do they train models on your data? The answer should be no, and it should be contractually enforced in the BAA.
The architectural questions
- Where does the model physically run? Public inference, dedicated tenancy, or on-premise?
- What's the network boundary? Which components sit inside a HIPAA-covered environment?
- What's the retention policy on transcripts, intake records, and any other PHI-bearing artifact?
- What's the access-control model on their side? Who at the vendor can see your data?
- What logging and audit trail is available to you if an audit asks?
The operational questions
- What's the breach-notification process? How fast do they have to tell you if something goes wrong? Ideally 24-72 hours.
- What's the subcontractor flow-down in the BAA? Do their subcontractors inherit the BAA terms?
- Have they had a breach? What happened? How did they respond?
- Are they SOC 2 Type II certified? HITRUST? Independent audit reports available?
The red flags
- Vague answers about where data lives.
- Reluctance to share the BAA template before a term sheet.
- Marketing claims about being "HIPAA-certified" (there's no such thing).
- No clear answer on training data.
- Pressure to sign before due diligence is complete.
What a healthy answer looks like
For our healthcare engagements, our answer is: we sign a BAA, we deploy inside your cloud tenancy or a dedicated tenant, we never train on your data (contractually), retention is configurable and defaults to the minimum the workflow requires, access is role-based and logged, breach notification is 24 hours or faster, and we can produce audit trails on demand.
For the full architectural posture see HIPAA-aware AI for small healthcare practices and HIPAA BAAs for AI vendors: what to look for. If you're evaluating multiple vendors, scope a conversation and we'll help you compare apples to apples.