no patient data<\/strong>; scope is documented; escalation path if PHI is accidentally introduced.<\/td>\n| Vague \u201cyes we\u2019re HIPAA\u201d marketing language without defining data scope; inability to describe what data is stored.<\/td>\n<\/tr>\n | \n| Are you a covered entity or business associate in this use case?<\/td>\n | Vendor explains role based on workflow boundaries and contracts; procurement confirms with counsel; no PHI in recruiting-only scope.<\/td>\n | Overconfident blanket statements; refusal to describe data flows.<\/td>\n<\/tr>\n |
\n| What data fields are stored?<\/td>\n | Clear list of fields; purpose limitation (recruiting outreach); retention and deletion policy.<\/td>\n | \u201cWe store whatever users upload\u201d with no controls; no retention policy.<\/td>\n<\/tr>\n |
\n| How do you handle opt-outs and stop requests?<\/td>\n | Central suppression list; immediate enforcement across users; documented workflow for \u201cstop\u201d requests.<\/td>\n | Opt-outs handled per-user only; delays; no audit trail.<\/td>\n<\/tr>\n |
\n| How do you reduce spam\/harassment risk?<\/td>\n | Respectful language patterns; frequency caps; identity disclosure; easy exit; escalation for complaints.<\/td>\n | Encouraging repeated contact after a clear \u201cstop\u201d; no frequency controls.<\/td>\n<\/tr>\n |
\n| How do you prove outreach quality?<\/td>\n | Metrics tracked with standard definitions (connect\/answer\/deliverability\/bounce\/reply) and reviewed regularly.<\/td>\n | No measurement; only vanity metrics like \u201cemails sent.\u201d<\/td>\n<\/tr>\n |
\n| What\u2019s the differentiator for reaching clinicians?<\/td>\n | Operationally: better routing and prioritization (e.g., Heartbeat.ai has ranked mobile numbers by answer probability<\/strong>).<\/td>\nClaims of guaranteed reach or implied harassment enablement.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<\/span>Weighted Checklist:<\/span><\/h2>\nUse this as a scoring sheet during vendor review. Total 100 points.<\/p>\n \n- (25) Data scope clarity:<\/strong> Written statement of provider contact data vs PHI; explicit no patient data<\/strong> boundary; documented handling if PHI is accidentally introduced.<\/li>\n
- (20) Opt-out & suppression:<\/strong> Central suppression list; applies across channels; immediate enforcement; exportable audit log.<\/li>\n
- (15) Outreach governance:<\/strong> Frequency caps; role-based access; campaign approvals; complaint handling.<\/li>\n
- (15) Measurement & reporting:<\/strong> Connect Rate, Answer Rate, Deliverability Rate, Bounce Rate, Reply Rate tracked with denominators and trend lines.<\/li>\n
- (10) Source transparency:<\/strong> Data provenance; refresh cadence; correction process.<\/li>\n
- (10) Security basics:<\/strong> Access controls, logging, and incident response contacts.<\/li>\n
- (5) Documentation quality:<\/strong> Clear acceptable-use policy and reviewer-ready answers.<\/li>\n<\/ul>\n
Passing guidance: if a tool scores low on suppression\/opt-out, it will create downstream risk regardless of whether HIPAA applies.<\/p>\n <\/span>Outreach Templates:<\/span><\/h2>\nVisual note:<\/strong> Use these as a respectful language examples callout. They are designed to reduce complaints and make \u201cstop\u201d handling unambiguous.<\/p>\n<\/span>Email template (first touch)<\/span><\/h3>\nSubject:<\/strong> Quick question about your next role<\/p>\nBody:<\/strong> Hi Dr. [Last Name] \u2014 I recruit physicians in [Specialty\/Service Line]. Are you open to hearing about a [Role Type] opportunity in [Location\/Health System]? If not, reply \u201cno\u201d and I won\u2019t follow up.<\/p>\n<\/span>Text template (only where appropriate for your program)<\/span><\/h3>\nHi Dr. [Last Name] \u2014 this is [Name] recruiting for [Org]. Are you open to a quick call about a [Role] in [Location]? Reply STOP to opt out.<\/p>\n <\/span>Voicemail template<\/span><\/h3>\nHi Dr. [Last Name], this is [Name] with [Org]. I\u2019m calling about a [Role] opportunity in [Location]. If you\u2019re not interested, no problem\u2014tell me and I\u2019ll close the loop. My number is [Callback].<\/p>\n <\/span>\u201cStop request handling\u201d mini-flow (uniqueness hook)<\/span><\/h3>\n | |
![\"54164\"](\"http:\/\/hc.heartbeat.ai\/wp-content\/webp-express\/webp-images\/uploads\/2026\/02\/not-hipaa-no-patient-data-3aa05bdd.png.webp\")
<\/p>\n