Any vendor handling patient calls is a business associate and must sign a BAA. That is table stakes. The harder questions concern what happens during the call itself.
Ask how identity is verified before any protected information is discussed, and what happens when verification fails. A defensible design attempts verification a fixed number of times, then transfers to staff rather than guessing.
Ask whether PHI is ever spoken back to the caller. Reading a medication list or prior visit detail aloud to an unverified caller is an avoidable disclosure. The agent should be able to act on information without reciting it.
Then cover the plumbing: where recordings and transcripts are stored, retention periods, subprocessor list, encryption in transit and at rest, and whether your call data is used to train shared models. Get the answers in writing before go-live, not during a breach review.
