Compliance & Security

Six artifacts to request from a voice AI vendor, and the answers that should end the evaluation

Before a voice AI vendor touches a patient call, put them through the review you would give any business associate. The artifacts to collect — BAA, SOC 2 Type II report, penetration test results, data residency policy — and the responses that disqualify a vendor.

Request the BAA first: a vendor that will not sign a Business Associate Agreement cannot handle patient information for you, and there is nothing further to evaluate
Ask for the current SOC 2 Type II report itself, not a summary page or a badge on a website
Ask for the most recent penetration test results and when the next one is scheduled
Get the data residency policy in writing — where patient data is stored, and confirmation it sits in HIPAA-compliant US facilities
Ask how call audio is encrypted in transit and at rest, and confirm patient audio is never held in plaintext
Ask what the audit logs record and whether your IT team can review them — before you need them in an inspection

How it pays back

A short list of artifacts beats a long security conversation

BAA, SOC 2 Type II report, penetration test results, data residency policy. Vendors who hand these over on request have done the work. Vendors who need three weeks to assemble them are telling you something about how recently it was done.

Procurement moves faster when the evidence arrives first

Compliance review stalls on back-and-forth over encryption specifics and storage locations. A vendor that provides HIPAA documentation, BAAs and certifications upfront shortens your review instead of consuming it.

You are buying a liability position, not only a phone system

The BAA sets out who is responsible when patient data is exposed, the breach notification timeframes, your right to audit their controls, and your right to terminate if a breach came from vendor negligence. Read it as closely as the pricing.

Gaps found before signing are the cheap ones

The same questions asked after deployment become a remediation project with a live phone line attached. Asking about encryption, access logging and breach procedure during evaluation costs one meeting.

End-to-end encryption

All calls encrypted from phone to cloud; patient audio never stored in plaintext

HIPAA-certified data centers

Patient data stored in HIPAA-compliant US facilities

Business Associate Agreement

Vendor signs BAA and assumes liability for patient data handling and security

Audit trail and access logs

All staff access to call recordings and patient data logged and auditable

Frequently asked questions

What documents should I ask a voice AI vendor for before signing?

A signed Business Associate Agreement, the current SOC 2 Type II report, recent penetration test results, a written data residency policy, and a description of how call audio is encrypted in transit and at rest. Reputable vendors provide these on request rather than assembling them after you ask.

What does it mean if a vendor will not sign a Business Associate Agreement?

It ends the evaluation. If a vendor accesses, stores or transmits any patient information, HIPAA requires the agreement. The BAA is what sets out their obligations to protect PHI, the consequences of a breach, and your right to audit their controls — without it, you are carrying all of that alone.

A vendor's website says 'HIPAA compliant'. What evidence should I ask for?

Ask for the artifacts rather than the claim: the SOC 2 Type II report, penetration test results, the encryption standards used in transit and at rest, the data residency policy, and a sample of the audit log output. A vendor that cannot produce recent audits is making a marketing statement, not a security one.

What should I look for in the breach notification terms of the BAA?

Who notifies whom and within what timeframe, who carries remediation costs, what the vendor owes you in evidence and support during a response, and your right to terminate if the breach followed from their negligence. These terms are the part of the contract you will care about most on the worst day.

How recent should the SOC 2 Type II report and penetration testing be?

Reputable vendors run annual SOC 2 Type II audits and regular penetration testing. Ask for the latest report and the date of the last test. An audit several years old describes a system that no longer exists.

What should stop an evaluation outright?

Refusing to sign a BAA. Being unable to say where patient data is physically stored. Having no recent independent audit. Being unable to show what the audit logs capture. Any one of these means you cannot document your own compliance position, whatever the product does on a call.