Review areaBAA status
QuestionsWill the vendor sign a BAA for this workflow? What services are covered, and what data is excluded?
OwnerOwner or privacy lead
AI vendor review packet
AI vendor review: BAA questions before patient data reaches a tool
Turn the vendor demo into a launch decision packet: the workflow, data involved, BAA status, model-training answer, retention rule, access boundary, gaps, owner, and review date before patient data reaches the tool.
Best for: Dental owners, privacy leads, operations leaders, office managers, and group-practice teams reviewing AI vendors.
Asset promise: Practice-owned workflow asset. Use this resource to create one reviewed script, checklist, SOP, packet, scorecard, or decision map the practice can save and reuse.
Build a vendor launch decision packetSee all resources
Sensitive patient, payer, claim, balance, screenshot, and schedule context belongs in approved practice-owned workflows. Use Smarter Practice AI for practice-owned workflows, then let the right team member finish the output before it is used.
Start with the launch decision, not the sales demo
A vendor can look useful in a demo while the real decision depends on the workflow, the patient or practice data involved, who can access it, how long it is retained, whether it is used for model training, and who owns launch readiness inside the practice.
- Name the exact workflow and business result before judging vendor fit.
- List the patient, payer, schedule, image, audio, message, or practice data involved.
- Decide whether PHI will be created, received, maintained, or transmitted.
- Save the launch decision, gaps, owner, and review date as a practice-owned packet.
Questions to ask before PHI touches the tool
Review areaModel training
QuestionsWill prompts, uploads, messages, audio, transcripts, or outputs be used to train or improve models? Can that use be disabled?
OwnerOwner or privacy lead
Review areaRetention and deletion
QuestionsHow long is data retained? Can the practice delete it? What happens to backups, logs, and derived outputs?
OwnerOwner, IT, or vendor manager
Review areaAccess and audit
QuestionsWho inside the vendor can access data? Are audit logs available? Can roles be limited by user or location?
OwnerOwner or operations lead
Review areaSubcontractors
QuestionsWhich subprocessors or subcontractors may receive data? Are they covered under the vendor's agreement?
OwnerOwner or privacy lead
BAA review checklist
- Do not upload patient data during evaluation unless the workflow is already approved.
- Document the exact data types the vendor will receive.
- Confirm BAA status before PHI enters the tool.
- Review model training, retention, deletion, subcontractors, audit logs, and access controls.
- Assign the output owner before the workflow launches.
- Save the approval decision, review date, and owner in the practice's AI asset log.
Source note: HHS business associate guidance HHS cloud service and BAA guidance FTC AI privacy and confidentiality guidance
Vendor meeting script
Owner or manager opening
We are evaluating this tool for a dental workflow that may involve patient, payer, schedule, message, audio, image, or billing information. Before we use real data, we need to confirm BAA coverage, data use, retention, deletion, model training, subcontractors, access controls, audit logs, and how outputs are reviewed by our team.
Follow-up if the vendor says data is anonymized
Please explain exactly what data is removed, what data remains, whether de-identification is contractual or technical, and whether any prompt, upload, output, transcript, log, or metadata can still be linked to our practice or patients.