What to ask an AI vendor before it touches patient data

13 questions for any AI vendor about agreements, data, what the AI may do, security and rollout, worded for your region's law. Modulon's own answers are beside each one.

What you get

  • 13 questions in 4 groups
  • What a good answer includes, for each one
  • A printable copy for your next vendor call

Your region

The questions follow HIPAA and state privacy law. Modulon signs a Business Associate Agreement with clinics here.

The questions

Agreements and data

  1. Will you sign a Business Associate Agreement before handling any patient data?

    Modulon: Yes. We sign a Business Associate Agreement with every clinic before any patient information is shared. Read the policy

  2. Where will our patients' data be stored?

    Modulon: In United States. Patient data does not leave the region, except as your data protection terms allow. Read the policy

  3. Which other companies handle our data?

    Modulon: Our subprocessors page lists every provider in each region and what each one does. Read the policy

The AI

  1. Do you or your model providers train AI on our patients' data?

    Modulon: No. Our model providers keep none of the data they process and don't use it to train models, and neither do we. Read the policy

  2. Can the AI do something our rules don't allow?

    Modulon: No. Your rules are checked in software before every action, and anything outside them goes to your staff. Read the policy

  3. Can anything clinical reach a patient without a clinician?

    Modulon: Never. A clinician approves results, refills and any clinical message before a patient sees it. Read the policy

  4. Will patients know they're dealing with an AI?

    Modulon: Yes. Calls and first texts say they come from an automated assistant, and patients can ask for a person at any time. Read the policy

  5. Is every action the AI takes recorded?

    Modulon: Yes. Every action is recorded with the rule that allowed it, and your staff can see and correct it. Read the policy

Security

  1. How is our data encrypted?

    Modulon: With TLS 1.2 or higher in transit and AES-256 at rest. Keys are held in a managed key service, never with the data. Read the policy

  2. Who on your team can see our data?

    Modulon: A small number of engineers, for a limited time, with multi-factor authentication. Every access is recorded. Read the policy

  3. What happens to our data if we leave?

    Modulon: You can export it for 30 days after you leave. It is deleted within 60 days of the agreement ending, and from backups within 90. Read the policy

Rollout

  1. Can we see what it would do before it does anything?

    Modulon: Yes. Each new task runs in watch-only mode first, and you turn it on once you've seen the drafts. Read the policy

  2. Does it work inside our record system?

    Modulon: Yes. Modulon works inside the system that holds your patient records. Read the policy

See what a good answer includes

Enter your email and every question shows what to listen for in a vendor's answer, ready to print for your next call.

We use these details to follow up about Modulon, as our Privacy Policy describes.

Frequently asked questions

Something else? Ask us directly.