How to Vet a Healthcare AI Vendor: BAA, Trust Center and Audit Trail

TL;DR

• A business associate agreement (BAA) is the contract compliance rests on, not a badge.
• Ask when the BAA is signed, because "available on enterprise plans" is a different answer.
• System and Organization Controls (SOC) 2 Type II tests controls over time; Type I is a snapshot of one day.
• Ask whether the vendor enforces BAAs with its own subprocessors, not just with you.
• An audit trail has to show who saw what and when, and be exportable.
• Ask in writing whether your data trains models, and treat silence as an answer.

Vetting a healthcare artificial intelligence (AI) vendor means asking for four artifacts: a signed BAA, a current SOC 2 report, a documented audit trail, and a written statement on model training. A vendor that cannot produce all four is telling you something useful.

Does the Vendor Sign a BAA, and When?

Under the Health Insurance Portability and Accountability Act (HIPAA), any vendor handling protected health information on your behalf is a business associate and needs a signed BAA before it touches patient data. Not after the pilot, and not at renewal.

The wording of the answer matters more than the yes. "We can provide a BAA" often means on request, on certain plans, or after legal review. Medsender states the stronger version on its security page: "Every Medsender account includes a signed Business Associate Agreement from day one — no additional cost."

Ask three follow-ups. Is it included on the plan you are actually buying? Does it cover the AI features specifically, or only the transport layer? And is signing it a condition of the trial, or something that happens once procurement gets involved?

What Should a Trust Center Actually Contain?

A useful trust center provides access to substantive security documentation, not only certification badges. At minimum it should carry the SOC 2 report, current system status, subprocessor list and security documentation, and it should be reachable without a sales conversation.

Medsender publishes one at trust.medsender.com carrying status, SOC reports and additional compliance documentation. The test to apply to any vendor's equivalent is whether you can get the actual report from it, under a non-disclosure agreement if necessary, or only a page describing that a report exists.

A badge on a homepage is a design element. A downloadable, dated report from a named auditor is evidence. If the only artifact on offer is the badge, you are being asked to take compliance on trust.

SOC 2 Type I or Type II, and Why It Matters

Type I describes whether controls were designed appropriately at a single point in time. Type II tests whether those controls actually operated over a period, usually six to twelve months. For a vendor handling patient records continuously, the second is the relevant one.

Medsender states SOC 2 Type II certification with "Controls tested continuously by an independent auditor", and makes both Type II and Type I reports available through its trust center. It also states that compliance controls are "monitored in real time through Vanta, not just reviewed annually".

Ask for the report's observation period and its date. A Type II report covering a window that ended two years ago describes a company that no longer exists in any meaningful sense.

Does the Vendor Enforce BAAs Downstream?

Downstream enforcement is the question most buyers skip, and it is where risk usually sits. Your vendor's subprocessors, the cloud host, the transcription service, the model provider, all touch the same data, and your BAA with the vendor does not automatically bind them.

Medsender states that the BAA is "enforced across every vendor and subprocessor". Ask any vendor for the same commitment in writing, and ask for the subprocessor list alongside it. If a vendor cannot provide a current subprocessor list, buyers have limited ability to verify how downstream obligations are enforced.

Pay particular attention to where the model itself runs. An AI feature built on a third-party model means that provider is in scope, and the answer to whether they have signed a BAA is not optional.

What Does the Audit Trail Have to Show?

Three things: who accessed which record, when, and what changed as a result. An audit trail that logs only system events rather than record-level access will not answer the question an investigator asks after an incident.

Check that it is exportable and that retention is stated. A trail you can view in a dashboard but cannot export is of limited use to your compliance officer, and one with undocumented retention may not cover the period you eventually need.

Ask specifically what the AI's own actions look like in the log. If the system files a document or updates a chart, that action should be attributable and reviewable in the same way a staff member's would be.

How Should Encryption Be Described?

Specifically, and for both states. Data in transit and data at rest are separate problems with separate answers, and a vendor describing only one has answered half the question.

Medsender states 256-bit Secure Sockets Layer (SSL) encryption for all data in transit and 2048-bit private key encryption for stored documents, with the accompanying claim that "Patient data is never transmitted or stored in an unencrypted state."

Beyond the numbers, ask about access controls, because encryption does not address who inside the vendor can read your data. Role-based permissions, session timeouts, centralised user management and single sign-on support are the practical controls worth confirming.

The Question Most Vendors Do Not Answer Unprompted

Whether your patient data is used to train or improve the vendor's models. It is rarely addressed on a security page, including on pages that cover everything else thoroughly, so silence should not be read as a no.

Ask for it in writing, and ask it in three parts: is customer data used for training, is it used for evaluation or quality review, and is anything retained by a third-party model provider.

Deciding Whether a Vendor Clears the Bar

Vendor security review turns into an unbounded exercise unless you fix in advance what would actually disqualify someone.

• A signed BAA before any protected health information moves is not negotiable, and a vendor who will only sign at contract signature has answered the question.
• SOC 2 Type II under a current report, with the observation window stated, carries weight that Type I does not, because Type I describes a design and Type II describes how it held.
• Downstream enforcement matters as much as the vendor's own posture, since subcontractors touching the data without BAAs of their own make the top-level agreement partly decorative.
• An answer in writing on model training, evaluation and third-party retention, because this is the one question that silence does not settle.

Two patterns recur across trust centers. Encryption is described in the most detail and differentiates the least, since almost everyone does the same thing and says it at length. And the pages that read as most thorough are often the ones that never mention what happens to customer data after it leaves the product, which is why a complete-looking page is not the same as a complete answer.

Decide your disqualifiers before the first call, and put them in the same email to every vendor. The ones who answer plainly and the ones who route you to a salesperson have told you something useful either way.

FAQs

What Makes a Healthcare AI Vendor HIPAA Compliant?

A signed BAA, appropriate safeguards, and controls that are actually operating not documented. No technical capability substitutes for the contract. Ask when the BAA is signed, whether it covers the AI features specifically, and whether the vendor enforces equivalent agreements with its own subprocessors.

Is a HIPAA Badge on a Website Worth Anything?

Very little on its own, because HIPAA has no certifying body issuing badges. What carries weight is a signed BAA and an independent audit report you can actually read. Treat a badge as a claim to verify, not as evidence, and ask for the underlying document.

Should We Ask for SOC 2 Type I or Type II?

Type II, and check its observation period. Type I confirms controls were designed properly on one day; Type II confirms they operated over six to twelve months. Medsender states Type II certification with controls tested continuously by an independent auditor, and makes both reports available through its trust center.

What Should Be in the Audit Trail?

Record-level access showing who saw what and when, plus what changed. It should be exportable, with stated retention, and the AI's own actions should be attributable in the same way a staff member's are. A dashboard you cannot export from will not satisfy a compliance review.

Do We Need a BAA With the AI Model Provider Too?

If they process patient data, yes, though usually it is your vendor's responsibility to hold it. Ask for the subprocessor list and written confirmation that BAAs are enforced downstream. Medsender states the BAA is enforced across every vendor and subprocessor, which is the commitment worth requesting from anyone.

Does the Vendor Train Models on Our Patient Data?

Ask in writing, because most security pages do not address it either way and silence is not a denial. Split the question into training, evaluation or quality review, and retention by any third-party model provider. Get the answer into the contract instead of into an email from a sales engineer.