Proposed lead: Iliana Peters, with the healthcare buyer’s privacy and security officers.
Why it matters: HHS explains that a cloud provider creating, receiving, maintaining or transmitting electronic protected health information on behalf of a regulated entity can be a business associate—even where it stores encrypted information without the key. HHS also requires the customer to understand the environment and conduct its own risk analysis. (hhs.gov)
Question to put to the expert:
For dental scheduling or patient access, how do we establish who receives protected health information and which safeguards apply across the whole voice-agent service?
A strong answer should cover:
Map telephony, speech processing, models, application services, logs, analytics, support access and integrations. For each component, identify its role, data received, permitted use, retention, deletion process and contractual coverage.
Address training use explicitly, including debugging and quality-review copies. Explain access controls, incident responsibilities and what happens when a subprocessor changes.
Evidence to request: A deployment-specific data-flow diagram, agreements, subprocessor list, settings evidence and documented risk assessment.
Follow-up: Which processing path remains unapproved even though the lead supplier has signed a business associate agreement?
Boundary: This is an administrative procurement question, not permission for an agent to provide clinical advice.
Expert quote: [Reserved for an approved interview quotation.]