TL;DR
Start with the job the agency must complete, then ask for the least sensitive evidence that can answer it. Public-page reviews, AI-answer checks and many website tests can begin with public facts and synthetic examples. A request for patient exports, recordings or unrestricted account data needs a separate explanation and qualified review; it is not automatically part of visibility work.
Ask what decision each file will support
“Send us everything so we can understand the practice” is an incomplete onboarding request. It leaves the office to guess what to include, often before anyone has established the purpose or the destination.
Replace that request with a task: find a wrong location fact, test an appointment-request link, identify missing administrative answers, or interpret a defined aggregate result. Then ask what evidence would let the agency complete that task.
For example, testing whether a public button reaches the correct scheduler does not require a spreadsheet of everyone who used it. Understanding which administrative questions belong on a service page does not automatically require recordings of patient calls. The distinction is between understanding the business process and receiving the personal records produced by it.
The NIST Privacy Framework, Version 1.0 includes data minimization and selective collection or disclosure among its privacy-management outcomes. The smaller evidence pack below is an original operational method informed by that principle. Using public facts, staff-authored categories or synthetic examples is a proposed way to satisfy a task with less exposure; it is not a NIST certification or a determination of healthcare privacy compliance.
Replace a broad request with sufficient evidence
For work limited to public service pages, a request-route test and an AI-answer baseline, review each requested file against the agreed task. The worksheet below proposes substitutes for broad requests such as patient inquiries, call recordings, a scheduling export and “all relevant website access.” It is an original planning tool, not a report of a client engagement.
| Agency's stated task | Requested material | Proposed lower-exposure evidence | What remains outside the conclusion |
|---|---|---|---|
| Verify service and office facts | Patient appointment export | Approved service-by-office fact sheet and public URLs | Does not establish patient-level attendance or demand |
| Identify unclear administrative answers | Recent call recordings | Staff-written question categories with no patient stories or quotations | Does not measure how often every question occurs |
| Test request-route wording | Live scheduling records | Approved test instructions and a synthetic test in a controlled setup | Does not prove every real submission succeeds |
| Establish an AI-answer baseline | List of patients who mentioned AI | Saved public test questions, dated answers and cited pages | Measures the defined observations, not patient acquisition |
| Understand page-level search patterns | Unrestricted analytics export | A specifically scoped report reviewed for sensitive fields | Does not supply cross-person identity or full attribution |
This replacement is useful because each substitute preserves a clear task. It also records what the substitute cannot prove. The agency can accept the evidence, explain a remaining gap or propose a separately reviewed task. It should not quietly turn a synthetic test into a claim about actual patients.
Staff-written examples should be created from the administrative process, not copied from a patient record with the name removed. Ask staff to describe categories such as “which office offers the service,” rather than reproduce a distinctive story.
Give the pack an explicit delivery note
A handoff note to adapt after the practice has checked the actual pack could read:
This pack supports review of the named public pages, the appointment-request explanation and the agreed public AI questions. It contains the approved office/service sheet, public URLs, synthetic test instructions and a staff-authored list of administrative question categories. It contains no patient export or call recordings. Use it for the agreed review. Return a specific task-and-field request if an additional item is necessary; do not interpret the missing patient data as evidence of no activity.
That note establishes the analytical boundary. It should travel with the files so another person at the agency does not assume the pack is a complete practice dataset.
Keep account permissions in the access-handoff process. Giving a collaborator a system role and exporting that system's contents are separate decisions. One does not automatically authorize the other.
Inspect the artifact, not just its label
A document called “public screenshots” can still include a logged-in sidebar, a private tab or a person's details. A URL can contain a query parameter that should not be forwarded. Ask the practice's designated reviewer to inspect the actual files, exports and links before they leave the approved environment.
Do not call a file anonymous merely because names were removed. In the U.S. HIPAA context, the de-identification provisions in 45 CFR §164.514(a)–(b) describe methods that consider more than names, including whether remaining information could identify someone. Have a qualified reviewer assess any proposed aggregation or de-identification. There is no universal safe row count proposed here.
For U.S. practices, qualified reviewers should determine applicable healthcare and other privacy obligations. UK, Australian and Canadian engagements require their own jurisdiction-specific assessment, including the actual recipients and locations of processing. The U.S. provision and the NIST framework do not settle those questions.
Resolve the agency's handling before transfer
For each approved nonpublic item, obtain a written answer to four questions: who receives it, what systems process it, whether AI services or subcontractors receive it, and how long it is retained or when it is removed. Have the responsible practice reviewer assess the actual arrangement and permitted purpose before transfer. A generic “secure” or “healthcare ready” label is not that review.
Use the practice's approved transfer method. Keep a record of the exact items released and the agreed purpose. If the agency later wants to connect records to marketing outcomes, treat that as a new analytical and data-use decision, with the necessary review before expanding the pack.
Finish onboarding without inventing certainty
When the agency confirms that the reviewed pack supports the agreed task, begin the public-content and synthetic-route work within that scope. Leave patient-level outcome analysis outside it. The agency can report missing facts, observed AI answers and test results with those limits intact.
A good onboarding request makes the work easier to verify. Every item has a reason, a reviewer and a defined use. When the same task can be completed without bringing sensitive records into the engagement, make that smaller evidence pack the concrete starting proposal.
Frequently asked questions
Does removing names make an export safe to share?
Not by itself. Other fields and combinations can identify people. Have the designated reviewer assess the actual artifact and permitted use.
What if the agency says the smaller evidence pack is insufficient?
Ask it to identify the unresolved task and the specific additional fields needed. Review that request before broadening the transfer or the engagement’s purpose.