Skip to main content
clinicchat.ai

Explainers on chatbots, AI, and HIPAA for clinics, cited to HHS, FDA, and FTC. No product or community here. Held by AdvancedCare USA Inc.

Questions to ask an AI chatbot vendor

Use this list before signing with any chatbot or AI vendor for a clinic. Each question maps to a HIPAA requirement or an FDA or FTC rule explained elsewhere on this site.

Last reviewed against the HHS, FDA, FTC, and eCFR pages linked on this page on .

Privacy and contracts

  • Will you sign a business associate agreement?Required before PHI is shared.
  • Which subcontractors (hosting, AI model providers) will see the data, and do they sign BAAs?
  • Is our data used to train or improve your models?And can we opt out in the contract?
  • Where is data stored, and how long are transcripts kept?
  • How do we get our data back, or have it destroyed, when we leave?

Security

  • How is data encrypted in transit and at rest?
  • How is staff access controlled and logged?
  • How fast will you tell us about a security incident?We need time to meet our own breach-notification deadline.

Safety and scope

  • What does the bot do with emergency language?It should route to 911 or 988 immediately.
  • Does it give medical advice or suggest diagnoses?If so, how has it been assessed under FDA’s rules?
  • Does it tell patients they are talking to software, and how do they reach a person?

Common questions

Is a vendor’s “HIPAA-compliant” badge enough?
No. HHS does not certify products. Ask for the BAA and the specific safeguards, and include the tool in your own risk analysis.

Sources

  1. Business Associates (FAQs and guidance) (opens in a new tab) — HHS Office for Civil Rights
  2. Guidance on HIPAA & Cloud Computing (opens in a new tab) — HHS Office for Civil Rights
  3. Summary of the HIPAA Security Rule (opens in a new tab) — HHS Office for Civil Rights
  4. Clinical Decision Support Software (guidance) (opens in a new tab) — U.S. Food and Drug Administration
  5. Guidance Regarding Methods for De-identification of PHI (opens in a new tab) — HHS Office for Civil Rights

Questions about this domain

Questions about clinicchat.ai or something explained here. There is no product, community, or demo to request, and we do not promise a response timeline. Do not send patient information through this form.

Get in touch

Or email [email protected]

Last reviewed against the HHS, FDA, FTC, and eCFR pages linked on this page on .

Every rule described here is linked to the agency that publishes it. If one has changed, tell us.

AI Chatbots for Healthcare: Questions to Ask a Vendor