Below are nine questions for any voice AI vendor that will hear or look up PHI, with what a good answer looks like and how EHVAhealth answers each. Your privacy officer should be able to check these off rather than interpret marketing language.
1. When do you sign the BAA?
Before any access is granted or any data moves. EHVAhealth signs the business associate agreement during discovery, and in most cases will sign yours rather than its own, redlining only terms that are operationally impossible.
2. Is data encrypted in transit and at rest?
It should be on every integration and for everything retained. EHVAhealth uses modern transport encryption on every integration and encrypted storage for retained data.
3. Who can access our data?
Look for role-based, individually attributed access with no shared accounts and no standing production access. That is how EHVAhealth operates.
4. What data do you actually need?
The minimum necessary. EHVAhealth requests the narrowest data set that answers the call, and documents every integration: what field moves, where it goes, and why it is needed.
5. Are calls recorded, and for how long?
Retention should be yours to set. EHVAhealth configures recording and transcript retention with you, including the option to keep no audio at all, and deletes on the schedule you specify.
6. Is our PHI used to train models?
The answer should be no. EHVAhealth uses your data to handle your calls under your BAA. Any exception would require your explicit written agreement, and EHVAhealth does not ask for one.
7. Who else touches the data?
Every downstream processor should be under a BAA and disclosed to you. EHVAhealth discloses subprocessors, with no surprise fourth parties.
8. What happens if something goes wrong?
There should be a documented incident response plan with notification timelines that meet or beat your BAA terms, plus logging of access and administrative actions with alerting on anomalies. EHVAhealth has both.
9. Can our auditors review your controls?
Yes should be the answer. EHVAhealth supports security reviews, questionnaires, and reasonable audit rights. Its controls are mapped to the HITRUST CSF, and the mapping is shared under NDA along with the full security documentation package before onboarding starts.
One more thing for outbound calls
Calling members raises obligations that have nothing to do with HIPAA: consent for each attempt, federal and state calling windows, do-not-call suppression, and caller ID attestation. Ask about those separately. See EHVAhealth's full compliance posture.