A voice AI vendor hears names, dates of birth, diagnoses, and insurance details on nearly every home health call. That makes vendor review a real compliance task, not a checkbox on a sales form.
Here are the questions to ask before any protected health information goes through a new system. This is operational guidance, not legal advice, so involve your privacy officer or counsel.
Start with the Business Associate Agreement
Under HIPAA, a vendor that creates, receives, maintains, or transmits protected health information on your behalf is generally a business associate, and you need a written agreement before sharing PHI (45 CFR 164.502(e) and 164.504(e)).
The narrow conduit exception is for services that only transmit data, like a phone carrier. A voice AI vendor that transcribes and stores calls does not fit that description.
- Will you sign a BAA before go-live?
- Do your subprocessors sign one with you?
- Can you give us a list of those subprocessors?
- How and when do you notify us of a breach?
Ask where the data goes
- What is stored: audio, transcripts, summaries, or all three?
- Where is it stored, and is it encrypted in transit and at rest?
- How long is it kept, and can we set the retention period?
- Who at the vendor can access it, and is that access logged?
- Is our data used to train models, and can we confirm that in writing?
- What happens to our data when the contract ends?
Get the answers in the agreement or security documentation, not only on a call.
Read security reports, not badges
No government body issues a "HIPAA certified" stamp, so be careful with that phrase. Ask for evidence you can review.
- A current SOC 2 Type II report, and its scope and period
- Results or a summary of recent penetration testing
- Their written HIPAA policies and security risk assessment process
- Access controls, including single sign-on and audit logs
Type II matters because it tests controls over time. A Type I report looks at a single date.
Do not skip workflow risk
Most real incidents involve ordinary workflow failures. Confirm how the system verifies a caller before sharing anything, what it does when it cannot match a patient, and how it handles a caller asking about another person.
Ask vendors to show a failed verification on a test call. How a system behaves when it should say no tells you more than a security page.
Your own team also has obligations. Update your risk analysis to include the new vendor, train staff on what changed, and limit access to minimum necessary. KareOps.AI documents its posture on the compliance page, and book a demo to walk through BAA terms with us.
Frequently asked questions
Does a voice AI vendor need to sign a BAA?
Generally yes, if it creates, receives, maintains, or transmits protected health information for your agency. Have your privacy officer or counsel confirm for your situation.
Is there such a thing as HIPAA certification?
There is no official government HIPAA certification for vendors. Look for a signed BAA, a SOC 2 Type II report, and documented security practices.
What is the difference between SOC 2 Type I and Type II?
Type I reviews how controls are designed at one point in time. Type II tests whether they operated effectively over a period, which is stronger evidence.
Bring your compliance questions
Book a 30-minute demo and bring your privacy officer. We will walk through the BAA and security posture.
Book Demo