Who signs the BAA?
Name the covered entity and the business associate. A vendor that will not sign a BAA is not a medical front-office vendor.
What is in scope?
Calls, chat, SMS, transcripts, queue items, and EMR writes are different surfaces. Ask which of them the BAA covers, and which subcontractors sit under it.
Is PHI used to train models?
Ask for a specific answer: practice data is used for training, or it is not. Adjectives are not an answer.
Call-recording consent
If the line is recorded, who speaks the consent sentence, on which calls, and in which states? Ask to hear the first utterance.
Chat and SMS consent
Website chat and text are not the same as a phone greeting. Ask how the practice captures consent before a message is sent.
What a person still has to release
A BAA does not replace a release gate. Ask what leaves the building without a named person approving the exact content.