Every chatbot vendor selling into healthcare will tell you they are HIPAA compliant. The phrase is unregulated, no one audits it, and it is printed on the pricing pages of products that will not sign a Business Associate Agreement at any price.
A few terms first, because the rest of this depends on them. HIPAA is the Health Insurance Portability and Accountability Act, the US law governing how patient information is handled, and PHI, or protected health information, is any health detail traceable back to a person.
A business associate, often shortened to BA, is an outside vendor that handles PHI on your behalf. A BAA, or Business Associate Agreement, is the contract that permits it. HHS, the Department of Health and Human Services, writes the guidance and enforces the rules.
What follows is a twelve-question screen you can send to any vendor as written. SiteGPT's own answers sit under each one, including the weak ones.
iShort answer
Twelve questions, grouped into contract, data, product, and incident, that separate a chatbot vendor who can support a HIPAA deployment from one who has written "HIPAA compliant" on a page. Three answers should end the evaluation: refusing to sign a BAA while still marketing to healthcare, being unable to name the subprocessors that touch conversation data, and claiming nothing changes in a covered workspace. SiteGPT answers all twelve below, including no EU data residency, BAA on the Enterprise plan only, and no automated PHI detection anywhere in the product.
Four bands, three questions each. Work them in order; the contract questions decide whether the rest are worth asking.
The contract (Q1-Q3)
Will they sign, on which plan, does the coverage flow down to every subprocessor including the AI model provider, and can you see the SOC 2 Type II report and subprocessor list.
The data (Q4-Q6)
Which countries the conversations are stored and processed in, how long content is retained and whether that is a contract term, and whether anything is used to train models.
The product (Q7-Q9)
Whether leads are governed differently from transcripts, which features a covered workspace disables, and where a conversation goes when it is escalated to a human.
The exit and the incident (Q10-Q12)
What happens to PHI at cancellation, how many days until a breach is reported and counted from what, and who inside the vendor can reach your workspace.
Key takeaways
| The question that settles it fastest | What you are actually testing |
|---|---|
| Will you sign a BAA, and on which plan? | Whether the marketing claim survives contact with procurement. Plan gating surfaces here or three weeks later. |
| Name every subprocessor that can touch PHI. | Whether the vendor knows its own chain. Flow-down makes the AI provider and the host part of the covered set. |
| Which regions store and process the data? | Country names, not adjectives. This is where residency requirements are met or missed. |
| Is retention a contract term or a settings toggle? | Whether an administrator can quietly change what you signed for. |
| What is disabled in a covered workspace? | Whether a real HIPAA mode exists. 'Nothing changes' means it does not. |
| Which SiteGPT plan? | The Enterprise plan, at custom pricing. Not Starter, Growth, or Scale. |
How should you use this vendor checklist?
Send it before the demo. Vendors who cannot answer Q1 and Q2 will consume three weeks of evaluation time before that becomes clear, and the answers to those two are a single email away. Q1 comes first because, under HHS guidance on business associates, you may share PHI with a vendor only once a written agreement is in place.
Ask for written answers. A sales engineer saying "yes, we're fully compliant" on a call gives your privacy officer nothing to file.
Judge answers by how specific they are. The useful signal is whether the answer contains a number, a country, a named company, or a clause reference. Answers made of adjectives are ones the vendor has not had to defend before.
What should you ask about the contract? (Q1-Q3)
These three establish whether there is anything to evaluate. A vendor that stumbles on any of them has a marketing claim and no real compliance program.
Q1. Will you sign a BAA, and on which plan?
HIPAA lets you disclose PHI to a business associate only once you have written assurances in a signed agreement. A vendor who will not sign cannot be used with patient data, however good the product is. The plan question is the follow-up most teams forget, and it is where budget assumptions break.
A good answer names the plan and the price model. A weak answer is "yes, we support HIPAA" with no plan named.
SiteGPT's answer. Yes, on the Enterprise plan only, at custom pricing. BAAs are not available on Starter, Growth, or Scale, and a self-serve HIPAA tier is planned rather than available. The standard agreement is published in full at sitegpt.ai/legal/baa, so counsel can read the text before anyone books a call. It is open to change: retention windows, breach notice timelines, notice contacts, and scoping are commonly adjusted during onboarding.
Q2. Does the BAA cover every subprocessor that can touch PHI, including the LLM provider?
A chatbot is never one company. There is a hosting provider underneath it, a vector database beside it, and an AI model provider generating the answers. HIPAA covers them through flow-down. A business associate must hold a BAA with any subcontractor before disclosing PHI to it, and every downstream subcontractor is a business associate in its own right.
A good answer names companies. You are not signing those contracts yourself, so what you need is written confirmation that the chain is complete and a list you can check it against.
SiteGPT's answer. Every vendor in the PHI chain operates under its own BAA, and SiteGPT countersigns only once that coverage is in place. The full list is published at sitegpt.ai/legal/subprocessors rather than supplied on request, so you can verify the AI layer yourself instead of taking a summary of it.
Q3. Can we see the SOC 2 Type II report and the current subprocessor list?
SOC 2 Type II tests whether controls operated over a period of time. A Type I report checks them on a single day, so auditors ask for Type II. Pair it with the subprocessor list: one tells you the controls work, and the other tells you who is inside them.
A good answer produces both. A Type I report offered in place of a Type II, or a subprocessor list available "under NDA after signature", are both answers worth noting.
SiteGPT's answer. A SOC 2 Type II examination covering the security, availability, and confidentiality trust service criteria was completed with zero exceptions noted across all tested controls. The report is available through the trust portal at trust.sitegpt.ai, and the subprocessor list is public.
What should you ask about the data? (Q4-Q6)
These three tell you what the vendor is committing to.
Q4. Where is conversation data stored and processed? Name the regions.
Regions decide cross-border transfer analysis. For organizations with state-level or EU requirements on top of HIPAA, they decide whether the vendor is usable at all. "Secure cloud infrastructure" names no region, so it does not answer the question.
A good answer is a list of countries. Ask separately about storage and processing, because inference often happens somewhere the database does not.
SiteGPT's answer is the weakest one here. There is no regional hosting option and no data residency commitment.
The published subprocessor list names no EU-based subprocessor. Convex and Pinecone run in the United States on AWS. OpenAI, Cohere, Context.dev, Portkey, PostHog, DataFast, Google, Dub, Bento, AutoSend and Slack are listed as United States, and Cloudflare as Global. Paddle, in the United Kingdom, handles payments as an independent controller rather than as a subprocessor.
If your requirement is EU-only storage and processing, SiteGPT does not meet it today, and you should confirm that against the list rather than against this paragraph. Transfers of EU and UK data rely on the European Commission's Standard Contractual Clauses (SCCs), and SiteGPT has appointed Article 27 representatives in the EU and the UK. When residency is required rather than preferred is a separate question, answered in does your chatbot need EU data residency.
Q5. What is the default retention for conversation content, and can we change it?
HIPAA does not set a retention period for conversation content, so the vendor's default applies until you negotiate it. The second half of the question reveals more. A number written into the order form and a number an administrator can change in settings are different guarantees.
A good answer gives both the default and the mechanism.
SiteGPT's answer. Conversation content is redacted seven days after a conversation's last activity by default. The window is configurable on the order form, so it is a contract term rather than a dashboard toggle. Redaction replaces the message text while preserving conversation counts and analytics aggregates, so reporting survives the deletion.
Q6. Is customer data ever used to train or fine-tune models?
This is the question with the widest gap between policy and enforcement. The vendor may not train on your data while the AI provider behind it retains prompts for abuse monitoring, and both statements can be made truthfully at once.
A good answer covers the whole chain and says what enforces it. Ask what is technical and what is contractual.
SiteGPT's answer. Conversations, training data, and customer interactions are never used to train or fine-tune any AI model, and this is a commitment in the BAA rather than only a policy page. It is backed at the AI layer by zero-data-retention endpoints, including with OpenAI. The public subprocessor list names them.
0
EU-based subprocessors on SiteGPT's published list, and zero exceptions noted in the SOC 2 Type II examination. Both figures come from pages any buyer can check.
Source: SiteGPT subprocessor list and security pageWhat should you ask about the product? (Q7-Q9)
Buyers usually skip product questions, and that is where evaluations go wrong after signature.
Q7. Are leads and captured contacts treated differently from conversations?
Retention policies get written for transcripts. Lead records sit in a different table, holding the name, email, and "what brings you in today" answer the widget captured. They often outlive every retention rule the contract describes.
A good answer acknowledges the distinction rather than being surprised by it.
SiteGPT's answer. Yes, and they are governed differently on purpose. Conversation content is redacted on the retention window. Leads persist until you delete them, because a lead is a deliberate contact submission rather than an incidental transcript. That puts the deletion decision with your organization, which can export leads to CSV and delete them from the dashboard against its own retention obligations. It also means a lead table is somewhere patient data can accumulate quietly, so it belongs in your periodic review.
Q8. Which product features are disabled in a covered workspace?
Every real HIPAA configuration is narrower than the standard product, because the standard product is optimized for convenience and a covered one is optimized for a known data path. A vendor who says nothing changes is describing a product where PHI can reach anywhere.
A good answer is a specific list, paired with the alternative for each removal.
SiteGPT's answer. Cloud drive sources (Notion, Google Drive, Dropbox, OneDrive, Box, GitHub) are off, and chat integrations (Zendesk, Slack, Crisp) are off. Sources already connected to an account are switched off when HIPAA is enabled, and lead form templates are hidden so fields must be chosen deliberately. Content instead arrives by upload, paste, or a crawl of your own site, and chats run in SiteGPT's own widget. The "Responses are AI-generated" disclosure stays pinned even with white-label branding.
Q9. How does human escalation work when a transcript contains PHI?
Escalation means moving a conversation somewhere a person will read it, and that destination is usually a different product. If the handoff target sits outside the covered chain, the compliant chatbot has become a delivery mechanism for an uncovered disclosure.
A good answer names where the transcript lands and confirms that location is covered.
SiteGPT's answer. Chat history review, human takeover, and chat modes work normally in a covered workspace. The handoff happens inside SiteGPT, because forwarding into Zendesk, Slack, or Crisp is off by default. The workflow is narrower than the standard product's on purpose. It keeps the transcript inside the covered boundary instead of extending that boundary to another vendor.
What should you ask about breaches and exit? (Q10-Q12)
These three cover a breach and the end of the contract. Vendor websites rarely answer them.
Q10. What happens to PHI when we cancel?
Return or destruction of PHI at termination is a required BAA element under 45 CFR 164.504(e), so every vendor's contract will contain the clause. Ask for the mechanism and the timeline behind it.
A good answer describes who does what, and by when.
SiteGPT's answer. Return or destruction of PHI at termination is committed in the BAA. Day to day, your organization can independently delete individual conversations, trained content, leads, or the entire chatbot from the dashboard, so the exit does not depend on filing a request and waiting.
Q11. How fast do you report a breach, and to whom?
You owe individual notice without unreasonable delay and no later than 60 days after discovery, and if more than 500 residents of a state are affected, media outlets and the Secretary of HHS as well. A vendor clock that consumes most of your window is a contract problem. "Promptly" gives you no number to plan around.
A good answer is a number of days, counted from a defined event.
SiteGPT's answer. Within five business days of discovery, plus security incident reporting, both written into the BAA. Breach notice timelines are among the provisions commonly adjusted during onboarding, so if five days does not leave your team enough room, that is a negotiation rather than a dead end.
Q12. Who inside your company can access our workspace, and is that access logged?
External controls get documented because buyers ask about them. Internal access is the control most likely to be undocumented publicly and most likely to be examined in an audit or after an incident.
A good answer separates customer-side permissions from vendor-side access, and states whether vendor access is logged and reviewable.
SiteGPT's answer has two halves. On your side, role-based permissions control which team members can reach chatbot settings, training data, and conversation history. On SiteGPT's side, the specifics of internal access and its logging are not detailed on the public security page. Those controls are within the scope of the SOC 2 Type II examination, so request the report through trust.sitegpt.ai. Get this question answered in writing during onboarding, because this page does not settle it.
Which vendor answers should end the evaluation?
Three answers end an evaluation on their own. The rest of the list gives comparison signals.
| Scenario | Best pick | Why |
|---|---|---|
| "We don't sign BAAs, but we're HIPAA compliant." | Walk away | The two halves contradict each other. Without a BAA you cannot lawfully disclose PHI to that vendor, so the compliance claim describes a configuration you are not permitted to use. |
| "We can't share which subprocessors touch conversation data." | Walk away | Flow-down requires the vendor to have a BAA with every subcontractor handling PHI. A vendor who will not name the chain is telling you it cannot demonstrate the chain is covered. |
| "Nothing changes in HIPAA mode, all features work the same." | Walk away | A covered configuration constrains where PHI can travel, which always removes something. This answer means either no covered mode exists or nobody has mapped the data paths. |
Two more answers are yellow rather than red. "Retention is configurable in settings" means the guarantee lives where an administrator can change it, so ask for the number in the order form. And "we're SOC 2 certified" without a Type II report attached is worth one follow-up, because Type I and Type II are different examinations and the shorthand hides which one was done.
The full question set, to copy
Send this as-is. It is written to be answerable in a single reply.
Before we can proceed to a BAA, we need written answers to the following.
CONTRACT
1. Will you sign a BAA, and on which plan or tier?
2. Does your BAA cover every subprocessor that can touch PHI,
including the LLM/AI model provider? Please name them.
3. Can you provide your SOC 2 Type II report and current
subprocessor list?
DATA
4. In which countries is conversation data stored, and in which
is it processed? Please answer both separately.
5. What is the default retention period for conversation content?
Is that a contract term or an in-product setting?
6. Is customer data ever used to train or fine-tune models, by you
or by any AI provider you use? What enforces that technically?
PRODUCT
7. Are leads and captured contacts subject to the same retention
rules as conversation transcripts? If not, what governs them?
8. Which product features or integrations are disabled or altered
in a HIPAA-enabled workspace?
9. When a conversation is escalated to a human, where does the
transcript go, and is that destination inside the BAA scope?
EXIT AND INCIDENT
10. What is the process and timeline for return or destruction of
PHI when we terminate?
11. Within how many days of discovery do you report a breach, and
to whom? Is that counted in business days or calendar days?
12. Which of your personnel can access our workspace and its data,
under what circumstances, and is that access logged and
reviewable by us?
Where does SiteGPT fall short on this list?
SiteGPT's weakest answers are on data residency, plan gating, PHI detection, and internal access logging.
Pros
- The BAA is published in full at sitegpt.ai/legal/baa, readable by counsel before any sales conversation
- It is open to change: retention windows, breach timelines, notice contacts, and scoping are commonly adjusted at onboarding
- Breach reporting within five business days of discovery, a number rather than 'promptly'
- Subcontractor flow-down, with SiteGPT countersigning only once the full PHI vendor chain is covered
- PHI never used to train AI models, backed by zero-data-retention endpoints at the AI layer
- SOC 2 Type II completed with zero exceptions, and a public subprocessor list you can check without asking
- Conversation retention is a contract term on the order form, not a toggle an administrator can change
Cons
- No EU data residency and no regional hosting option. The subprocessor list names zero EU-based subprocessors
- The BAA is Enterprise plan only, at custom pricing. Starter, Growth, and Scale do not include it
- A self-serve HIPAA tier is planned and is not available today
- Cloud drive sources and chat integrations are off by default in a covered workspace, and switch on only for vendors you hold your own BAA with
- Sources already connected to an account are switched off when HIPAA is enabled
- Nothing scans customer-supplied content for PHI. Keeping training content, bot instructions, and lead fields clean is your review step
- Internal access controls and their logging are not detailed publicly. That answer comes from the SOC 2 report and onboarding
You can verify every strength above without talking to anyone. Every weakness is something a vendor could have left unsaid. Run the same test on other vendors' answers.
Best forUS healthcare compliance and procurement teams running a structured vendor evaluation before a chatbot handles any patient data.
SiteGPT's own answers to most of these questions are collected on the compliance hub, including the parts it does not claim.
If you are earlier than vendor selection and still establishing whether a BAA is required at all, start with do you need a BAA for your website chatbot. For the full requirements picture, including safeguards and the tradeoffs of a covered workspace, see what makes a chatbot HIPAA compliant. If your knowledge base is the open question, keeping PHI out of your chatbot's training data covers that specifically.
Health plans and insurers screening vendors can start from HIPAA compliant chatbots for health insurance member service, which compares five platforms and the plan each BAA requires. SiteGPT's own program status lives at the HIPAA program page and the day-to-day behavior of a covered account at the HIPAA workspace documentation.
Frequently asked questions
What should you ask a chatbot vendor before signing a HIPAA BAA? Work through four areas rather than a single list. The contract: will they sign a BAA, on which plan, does it cover every subprocessor including the AI model provider, and can you see the SOC 2 Type II report. The data: where it is stored and processed, how long conversation content is retained, and whether anything is used to train models. The product: how leads differ from conversations, which features are disabled in a covered workspace, and how human escalation handles a transcript containing PHI. The incident and exit: what happens to PHI at cancellation, how fast a breach is reported, and who inside the vendor can access your workspace.
Does a HIPAA BAA need to cover the AI model provider? Yes, though not through a contract you sign yourself. HIPAA handles this through flow-down: a business associate must have a BAA with any subcontractor before disclosing PHI to it, and every downstream subcontractor is a business associate in its own right. So the AI model provider is your chatbot vendor's responsibility to cover, and your job is to confirm in writing that the chain is complete. Ask for the subprocessor list and check that the AI providers on it are named.
What answers should disqualify a chatbot vendor? Three. First, refusing to sign a BAA at all while still marketing to healthcare, because the marketing claim and the contract position cannot both be true. Second, being unable to name the subprocessors that can touch conversation data, since a vendor who cannot list the chain cannot have covered it. Third, claiming that nothing changes in a HIPAA workspace, because every honest covered configuration is narrower than the standard product and a vendor who says otherwise has either not built one or is not describing it accurately.
Does SiteGPT offer EU data residency for chatbot conversations? No. The published subprocessor list names no EU-based subprocessor: Convex and Pinecone run in the United States on AWS. OpenAI, Cohere, Context.dev, Portkey, PostHog, DataFast, Google, Dub, Bento, AutoSend and Slack are listed as United States, and Cloudflare as Global. Paddle, in the United Kingdom, handles payments as an independent controller rather than as a subprocessor. There is no regional hosting option and no residency commitment, so a requirement for EU-only storage and processing is not one SiteGPT meets today. Transfers of EU and UK data rely on the European Commission's Standard Contractual Clauses (SCCs), and SiteGPT has appointed Article 27 representatives in the EU and the UK. Teams with that requirement should confirm it against the subprocessor list themselves rather than take any vendor's summary of it.
How long does SiteGPT keep chatbot conversations under HIPAA? Conversation content is redacted seven days after a conversation's last activity by default, and the window is configurable on the order form, which makes it a contract term rather than a dashboard setting. Redaction replaces the message text while preserving conversation counts and analytics aggregates. Leads are treated separately: they persist until deleted, because they are deliberate contact submissions, and organizations manage that deletion themselves against their own retention obligations.
Which features are disabled in a HIPAA-enabled SiteGPT workspace? Cloud drive sources such as Notion, Google Drive, Dropbox, OneDrive, Box, and GitHub are off, as are chat integrations such as Zendesk, Slack, and Crisp. Sources already connected to an account are switched off when HIPAA is enabled, and lead form templates are hidden so fields have to be chosen deliberately. These are defaults rather than prohibitions: a specific source can be enabled for a vendor you hold your own BAA with. Content otherwise arrives by upload, paste, or a crawl of your own site, and chats run in SiteGPT's own widget.
Which SiteGPT plan includes a HIPAA BAA? The Enterprise plan only, at custom pricing. BAAs are not available on Starter, Growth, or Scale, and a self-serve HIPAA tier is planned rather than available. The standard BAA is published in full at sitegpt.ai/legal/baa so counsel can review the text before any sales conversation, and it is a standard document rather than a fixed one: retention windows, breach notice timelines, notice contacts, and scoping are commonly adjusted during onboarding.
Does SiteGPT scan for PHI in training content? No, and no vendor should be assumed to. Nothing scans customer-supplied content for patient data, so keeping it out of training content, bot instructions, and lead fields is your own review step. This matters because training content is what the bot retrieves from, which means anyone who can chat with the bot can reach it indirectly. If patient data does reach a lead record it is recoverable rather than catastrophic, since leads are never deleted on a schedule and can be found and removed.
Sources
- HHS guidance on business associates for the business associate definition, the written agreement requirement, and subcontractor flow-down, read 8 August 2026
- HHS Breach Notification Rule for the 60-day individual notice deadline and media notice above 500 residents of a state
- SiteGPT HIPAA program page for plan gating and program status, verified 8 August 2026
- SiteGPT standard BAA for the five business day breach reporting commitment, flow-down, return or destruction at termination, and the model training commitment, verified 8 August 2026
- SiteGPT subprocessor list for every subprocessor and its stated location, Paddle's status as an independent controller, and the zero-data-retention endpoints, verified 27 September 2026
- SiteGPT security page for the SOC 2 Type II result, encryption, role-based permissions, and the trust portal, verified 8 August 2026
- SiteGPT HIPAA workspace documentation for the seven day redaction default, lead handling, disabled sources and integrations, and escalation behavior, verified 8 August 2026