HIPAA posture, in writing.
Any vendor handling protected health information needs a Business Associate Agreement (BAA) signed before patient data hits their systems. Ask: do you sign BAAs today? At what tier? What happens to call audio and transcripts under the BAA? If the vendor can't produce a BAA template on request, walk.
