The BAA Is the Floor, Not the Ceiling
A signed Business Associate Agreement establishes legal obligations. It does not describe architecture, and two vendors with identical BAAs can have materially different security postures. For AI documentation specifically, the interesting questions sit below the contract layer: where audio lives, how long it lives there, who can reach it, what happens at inference time, and whether anything about your encounters persists into a model. Compliance officers who stop at the BAA are checking the box that is easiest to check.
Encryption in Transit and at Rest, Specifically
Ask for protocol and key length rather than adjectives. Transport should be TLS 1.2 or above; storage should use AES-256 or equivalent. 'Bank-level encryption' is marketing language that describes nothing. Also ask what is encrypted — audio, generated text, and metadata are three separate artefacts, and it is possible to protect one carefully while another sits in a less rigorous store. Our documentation covers all three, and the specifics are available for review.
Access Control Is Where Most Risk Actually Lives
Breaches more often follow over-broad internal access than cryptographic failure. The questions that matter: which roles can open a patient record, is access scoped to the accounts a person is assigned to, is it time-limited, and is it revoked automatically when someone changes role or leaves. Role-restricted access assigned per account — rather than blanket staff access to all client data — is the standard to insist on. Our compliance architecture details how this is enforced.
Audit Logging Should Be Yours to Inspect
Logs that exist only for the vendor's benefit are of limited value during your own audit. Ask whether you can obtain access logs for your records on request, what events are captured, and whether logs are immutable. A vendor that can produce a record of every access to your data is demonstrating a control; one that describes logging in general terms is describing an intention.
Subprocessors and Where Inference Happens
This is the question most specific to AI vendors and the one most often skipped. If model inference runs through a third-party API, that provider becomes part of your compliance chain and should be named, covered by appropriate agreements, and disclosed. Ask directly: is inference performed on infrastructure you control, or is our audio leaving your environment? Both answers can be acceptable; only one of them can be silently assumed, and the assumption is usually wrong.
Model Training and Data Retention
Two commitments worth getting in writing. First, that PHI is processed to produce your documentation and not used to train general models, with an explicit opt-out if any training use exists. Second, retention periods for audio and generated text, and the deletion process at contract end. Vague answers here are the most consequential vagueness in the entire evaluation, because the harm — your patients' encounters embedded in a model — is irreversible.
A Short Technical Diligence List
Encryption protocol and key length for audio, text, and metadata. Access model and revocation process. Audit log availability to you. Named subprocessors and inference location. Training-use commitment and opt-out. Retention and deletion terms. Breach notification timeline. Seven items, all answerable in writing by a serious vendor. Request our security packet — it is the same one we provide to hospital compliance teams.