How to Evaluate an AI Vendor in Behavioral Health: The Questions to Ask Before You Sign

Vendor demos are built to make you say yes. The voice is warm. The transcript is clean. The dashboard is beautiful. Nobody demos the 3am call where someone says they took a handful of pills.

This guide is the list of questions to ask before you sign. Print it. Bring it to the demo. Get the answers in writing.

A note on this site: we're funded by flat-fee sponsorships from vendors. Sponsors don't get to change this guide, and they don't get a pass on these questions. See our sponsor policy.

Start with the job

Before you look at any product, write one paragraph: what job you want done, what information the tool would touch, and who on your team will own it. "Answer after-hours admissions calls, collect name, phone, and insurance, and hand off to the on-call rep. Owned by our admissions director."

If you can't write that paragraph, you're not ready to buy. And if a vendor can't tell you how their product does that specific job, keep looking.

Privacy and contracts

Will you sign a BAA for the exact product and plan we'd use? Get the agreement itself, not a sentence on a website. HHS publishes sample BAA provisions you can compare against.

Who are your subcontractors? Phone carrier, transcription, cloud host, AI model provider, analytics. Every one that handles PHI should be bound by the same terms. HHS's cloud computing guidance says even a cloud provider storing only encrypted data is a business associate.

Is our data used to train or improve your models? If yes, how is it de-identified, and can we opt out? Get the answer in the contract.

Where is data stored, and for how long? Recordings, transcripts, notes, logs. What's the default retention, and can we change it?

What happens when we cancel? Return or destruction of data, including at subcontractors, and how you'll confirm it.

How do you handle 42 CFR Part 2? If you're a federally assisted SUD program, ask how the product captures consent, respects its scope, and prevents redisclosure. The HHS Part 2 fact sheet summarizes the 2024 changes. Have your counsel judge the answer.

What security documentation can you share? Independent audit reports, a summary of their security program, penetration test results under NDA. There's no government stamp that makes a product "HIPAA compliant." Claims are claims until you see the paper.

What happens on our website? If the tool installs a chat widget or form, does it add any third-party tracking? HHS has guidance on online tracking technologies, part of which a court vacated in 2024, as HHS notes on that page.

Safety

Show me your crisis handoff. Live. Say a crisis phrase during the demo and watch what happens. How fast does a human get on the line? What happens if nobody answers? Does it give 911 and 988?

Can we edit the crisis phrase list and the escalation rules? You know your population better than they do.

How do you stop the agent from giving clinical advice? Ask it whether someone needs detox. Ask about a medication. Ask whether therapy will help. It should decline and route to a person.

Does it tell people it's automated? Up front, in plain words.

What happens when you update the model? Do we get notice? Can we test before it goes live for us? Models change behavior after updates.

Accuracy

Where do answers come from? A knowledge base we control, or the model's general knowledge? You want the first. Ask how they keep the agent from making things up.

Can we see every conversation? Transcripts, summaries, and a way to flag bad ones. If you can't review it, you can't own it.

What are your error rates, and how did you measure them? If a vendor gives you a number, ask for the method. A self-published benchmark is marketing until you see how it was built.

Can we run a pilot with our own test cases? Write 30 test conversations from real situations (with no real patient details). Run them. Score them. Keep the results.

Pricing and the referral line

How is pricing calculated? Per seat, per minute, per conversation, flat monthly. Those are software prices.

Does any price vary with leads, referrals, admissions, or placements? In addiction treatment and recovery housing, this is the question that matters most. The federal Eliminating Kickbacks in Recovery Act, 18 U.S.C. § 220, covers remuneration for referrals to recovery homes, clinical treatment facilities, and laboratories, and its employee and contractor exception specifically excludes pay that varies with the number of individuals referred. If a vendor's price moves with admits, take it to counsel.

Does your product ever route callers to other organizations? If yes, who decides where, and does anyone pay for that routing?

Fit

Does it work with our EHR or CRM? Exactly how, and who maintains the connection?

Who on your team understands behavioral health? Ask for a name. Ask what they did before.

Who are your customers like us? Talk to two of them without the vendor on the call.

What's your exit plan if you go out of business or get acquired? Small AI companies come and go. Your data shouldn't go with them.

Where the privacy line sits

Safe with de-identified or aggregate data. Demos with fake data. Pilots on fictional test conversations. Reporting dashboards that show counts and trends only.

Needs a BAA. Any production use where the vendor touches patient, client, or resident information. Plus Part 2 review if it applies.

Don't automate, regardless of vendor promises. Crisis response, clinical decisions, coverage promises, and anything where money moves with referrals.

Scoring it

Make a simple sheet. One row per question. Score each vendor 0 (no answer or bad answer), 1 (partial), or 2 (clear answer in writing). Any 0 on the BAA, crisis handoff, or referral pricing questions disqualifies them, no matter how good the rest looks.

Then read the PHI and BAA primer if you haven't, and plan your rollout with the staff training guide. For admissions specifically, see AI agents for treatment center admissions.

Last thing

The best vendor answer you'll hear is "I don't know, let me find out and send it in writing." The worst is a confident answer that turns out to be wrong. Buy from people who know the difference.