Healthcare data protection-aware coverage framework.

Eligibility review

Before offering BAA coverage, Vovance Inc. and the customer should review:

• —The customer’s status as a covered entity or business associate
• —The exact Rumbe features that will process PHI
• —Enabled AI model providers and their contractual eligibility
• —Hosting, storage, email, analytics, and support subprocessors
• —Whether voice, attachments, exports, or BYOL are included
• —Retention and deletion requirements
• —Incident-response responsibilities
• —Minimum-necessary access and workforce authorization
• —Prohibited or unsupported use cases

Permitted uses and disclosures

The executed BAA should limit PHI use and disclosure to providing and securing the contracted service, carrying out proper management and administration, and meeting legal obligations.

Safeguards

Relevant Rumbe safeguards may include:

• —PII/PHI-aware data classification
• —PHI access logs for reads, updates, and exports
• —Role-based access and tenant isolation
• —Encryption of sensitive fields and provider secrets
• —Neural redaction of recognized sensitive patterns
• —AI transaction traceability
• —Secure authentication and SSO
• —Human review and escalation
• —Secure widget and knowledge retrieval controls

Subcontractors

Any subcontractor that creates, receives, maintains, or transmits PHI on behalf of Vovance Inc. must be evaluated and bound by required obligations. Not every general-purpose AI provider or plan may be eligible for PHI processing.

Incident and breach obligations

The BAA should define security incident reporting, breach assessment cooperation, timing, required information, mitigation, documentation, and responsibility for notifications. Terms must be aligned with law and the underlying service agreement.

Access, amendment, and accounting

Where applicable to the service, Vovance Inc. should provide assistance enabling the customer to meet obligations involving access, amendment, and accounting of disclosures.

Termination and PHI handling

The executed BAA should define PHI return or destruction at termination, backup limitations, legal exceptions, and continuing protections for retained PHI.

Customer responsibilities

The customer remains responsible for risk analysis, policies, workforce training, minimum-necessary configuration, lawful use, patient notices, identity verification, and reviewing AI-assisted outcomes.