A public-health team rejects a free consumer chatbot for clinic triage because it lacks BAA and PHI safeguards. What tool-selection judgment is tested?

Public-health clinic triage routinely involves symptoms, demographics, and care pathways that can constitute protected health information (PHI). Selecting an AI tool for that workflow is therefore a compliance and privacy decision, not merely a convenience or cost decision. The correct judgment is to choose triage AI that meets civic privacy and contractual needs—most notably Business Associate Agreement (BAA) coverage where HIPAA applies, clear PHI handling controls, logging, retention limits, and an authorized processing environment. A free consumer chatbot typically processes prompts under consumer terms, may use inputs for training, and rarely offers a BAA; rejecting it for clinic triage is sound municipal tool selection. Selecting AI triage tools that accept signed vendor HIPAA checklist as BAA and PHI safeguards fails conceptually: a self-completed checklist is vendor self-attestation, not a signed Business Associate Agreement, and it creates no enforceable PHI handling, breach-notification, access, logging, and retention obligations with the vendor actually creating or receiving PHI in that flow. Selecting AI triage tools that treat SOC 2 Type II attestation as meeting BAA and PHI safeguards fails because a SOC 2 report audits general controls at a point in time and is not a substitute for a BAA, PHI-specific handling requirements, or authorization for triage use. Selecting AI triage tools that apply cloud provider BAA to chatbot triage flows for PHI safeguards fails because a cloud provider BAA covers only the underlying infrastructure and does not extend to the chatbot vendor actually creating or receiving PHI, which still requires its own signed BAA, correct configuration, access controls, logging, and approval before it can lawfully handle PHI. Exam caveat: not every municipal chatbot needs a BAA—only workflows that create or receive PHI (or otherwise trigger applicable health-privacy rules) do. The tested skill is matching tool controls to data sensitivity, not blanket rejection of all consumer AI. Operational check: before any clinic pilot, confirm BAA status in writing, map where prompts and outputs are stored, verify staff cannot paste identifiers into unapproved tools, and document an approved alternative for triage assistance that counsel and privacy officers have cleared.