What to Ask an AI Vendor Before It Touches Patient Data

Before an AI vendor touches patient data, ask whether it will sign a business associate agreement, whether your patients' data will train its AI, which subcontractors will handle the data, how fast it will report a breach, how access is logged, and how you get your data back. Under HIPAA, any vendor that creates, receives, maintains, or transmits patient information for your practice is a business associate, including an AI receptionist that hears patients' calls.

This is a practical checklist, not legal advice. Have your attorney review any business associate agreement before you sign it.

Does the vendor count as a business associate?

Almost certainly, if it handles patient information. HIPAA's definition covers anyone who creates, receives, maintains, or transmits protected health information on a practice's behalf, and it extends to their subcontractors. Two points from HHS settle most arguments:

• Storage counts, even encrypted. HHS's cloud guidance says a provider that maintains encrypted patient data is a business associate even if it does not hold the decryption key.
• The conduit exception is narrow. It covers transmission-only services, such as couriers and their electronic equivalents, not vendors that store or process data.

The same guidance says a practice that uses a cloud service for patient data without a business associate agreement is in violation of the HIPAA rules. So the first question is simple: will you sign one?

What should the business associate agreement say?

The regulation sets the minimum. The agreement must commit the vendor to:

1. Use the data only as the contract permits or the law requires.
2. Report any use or disclosure the contract does not allow, including breaches.
3. Bind its subcontractors to the same restrictions.
4. Return or destroy the data when the contract ends, if feasible, and keep protecting whatever it cannot return.

A vendor that will not sign, or wants to sign only its own one-sided version without discussion, has answered the question for you.

Will your patients' data train its AI?

Ask this in writing. A business associate may use patient information only as its agreement permits or the law requires, and HHS says a business associate may de-identify data on a practice's behalf only if the agreement authorizes it. So the answer should be in the contract, not in a sales call.

Ask the follow-ups too:

• Is any of our data used to train or improve models, yours or your AI providers'?
• How long are call recordings and transcripts kept, and can we set that period?
• Is de-identified data used for anything, and by which method? HIPAA's Safe Harbor list of identifiers includes voice prints, which matters for call recordings.

Who else will touch the data?

Most AI systems are built from several services: a phone carrier, speech-to-text, an AI model, a database, and hosting. Ask for the list. Each subcontractor that handles your patients' data must agree to the same restrictions as the vendor, so ask the vendor to confirm those agreements exist for every service on the list.

How fast will it report a breach?

The regulation sets the outer limit: a business associate must notify you no later than 60 calendar days after discovering a breach, and sooner if there is no reason to wait. Many practices negotiate a shorter window in the agreement. Ask also how the vendor reports security incidents that are not breaches, and who at your practice receives the notice.

How is access controlled and logged?

The Security Rule's technical safeguards require unique user identification and audit controls that record activity in systems holding patient data. Encryption is addressable, which HHS explains does not mean optional: it must be assessed and implemented if reasonable and appropriate. Ask:

• Does every person and system have its own login, with multifactor authentication?
• Can we see an audit log of who accessed what?
• Is data encrypted in transit and at rest?
• What does the system write into the chart, and can staff see it? See what should happen after an AI receptionist hangs up.
• Does the AI see only what it needs? HIPAA's minimum necessary standard asks for reasonable efforts to limit data to the purpose. A scheduling agent may not need the full chart, which is part of what an AI receptionist can do inside your EHR.

What does "HIPAA certified" mean?

Officially, nothing. HHS says it does not recognize private HIPAA certifications, and they do not relieve your practice of its own obligations. Ask for evidence of a risk analysis instead. HHS's Office for Civil Rights has a whole enforcement initiative around missing risk analyses, with at least 14 actions as of June 2026, including one against a software company.

What happens when you leave?

Ask how you get your data back, in what format, and how fast, and how the vendor will certify that it destroyed what it kept. HHS has also said a business associate may not block a practice's access to its own patient data, for example in a payment dispute.

Are the rules about to change?

Some are moving. HHS proposed a major update to the Security Rule in January 2025, and the 2026 regulatory agenda now lists it as a long-term action, with a final rule projected for July 2027. A nondiscrimination rule for patient care decision support tools, 45 CFR 92.210, has applied since May 1, 2025 to tools that support clinical decisions. And apps outside HIPAA fall under the FTC's Health Breach Notification Rule.

These are the questions to put to any vendor, Cream Digital included, before an AI system touches patient data. The same discipline applies to deciding which work the AI should hand to a person, covered in human-in-the-loop handoffs. See how Cream Digital approaches back office operations and front desk operations.