What data and agreements are in scope?
Business Associate Agreement support for healthcare workflows that process patient access and engagement data.
Security
Security review starts with the workflow.
Wattson Health supports healthcare launch reviews with BAA support, encryption, role-based access patterns, audit history, consent-aware workflows, and staff escalation policies.
Book a security reviewProcurement questions
- 1What patient and workflow data is collected?
- 2Which actions are automated or staff-confirmed?
- 3Which systems, roles, and retention rules apply?
Responsibility matrix
Clear ownership before launch.
| Area | Wattson provides | Customer configures |
|---|---|---|
| BAA and permitted use | BAA support for healthcare workflows that process patient access data | Covered workflow scope and contracting path |
| Encryption | Encryption in transit and at rest for systems that process workflow data | Connected systems and transmission path |
| Role-based access | Staff and administrator access patterns for operational workflows | Users, roles, and least-privilege policy |
| Audit history | Activity history for workflow events, handoffs, and security review | Review ownership and retention expectations |
| Consent and recording | Workflow configuration for SMS, email, voice consent, and call recording behavior | State-specific language, recording settings, and routing rules |
| Human review | Staff handoffs with context when automation is not the right path | Escalation criteria, confidence thresholds, and queue owners |
| Retention and deletion | Implementation review for the data each launched workflow needs to retain | Retention policy, deletion requirements, and legal hold rules |
| Subprocessors and vendors | Vendor review support and launch controls for connected workflow services | Customer-required vendor review inputs |
| Incident response | Security investigation support through workflow logs and operational history | Notification contacts and internal response path |
Verified controls
The questions a security review needs to answer.
How is workflow data protected?
Encryption in transit and at rest for systems that process patient request, scheduling, intake, and follow-up data.
Who can access the workflow?
Role-based access patterns for staff users, administrators, and workflow configuration surfaces.
What is logged and reviewed?
Activity history and operational logs for workflow review, security investigation, and vendor review.
How is consent configured?
Customer-controlled consent language, call recording settings, outreach rules, and routing behavior.
When does staff review take over?
Escalation policies and staff handoffs for workflows that need review before action is completed.
- Business Associate Agreement
- Data flow and access review
- Consent and recording configuration
- Escalation and incident contacts