Pre-call context · anything you want to remember going in
1. Open ~60 seconds
"Thanks for the time today. Before I dive in, I want to set expectations on how I'd like to run this. You raised two things last conversation, the API timeouts and the HIPAA work. I want to treat those as two separate conversations because they're solving two different problems. Let's knock out the timeout piece first since it's more tactical, and then spend the bulk of our time on the HIPAA side, which is the bigger conversation. Sound good?"
Wait for them to agree. Don't move on until they nod.
2. API timeout discovery ~10 min
Get tactical and concrete. They've been living with this pain. Let them describe it.
"Let's start with the timeouts. Walk me through what's actually happening. When you say timeout, what do your users see? Error page, spinning loader, specific error message?"
You're trying to figure out if this is an actual Cloudflare 524 (origin too slow) or something else.
"Do you know which endpoint specifically? Like, is it one slow report endpoint, or scattered across the app?"
"What's the workload behind that endpoint? Is it pulling a big report, running an ML model, processing a file, what's actually slow about it?"
"How long does the operation actually take on your servers? If you ran it locally without Cloudflare in the way, how many seconds?"
This is the key question. Their answer puts the problem in one of three buckets.
Once you have the number, categorize:
Under 100 seconds: Not actually a Cloudflare timeout. Something else is going on. Dig further.
100 to 600 seconds: Bumping Proxy Read Timeout solves it. Easy fix.
More than 600 seconds: Real architectural problem. Extending the timeout buys time but isn't the right long-term answer.
3. Position the timeout fix ~3 min
"Here's how this works on our side. The default proxy read timeout is 100 seconds. That's locked on Free, Pro, and Business. On Enterprise, we can extend it. Up to about a hundred minutes if you really need it. So if your slow endpoint takes two or three minutes, we can solve that with a configuration change."
If their number is huge (5+ minutes), be honest
"Now, if it's taking longer than that, I'd want to push back a little. Not on whether we can do it, we can, but on whether it's the right design. There are a few patterns that might serve you better. Streaming the response so the connection stays active. Or making it asynchronous, where the API kicks off the job and returns immediately, and the client polls for results. Either of those would be more resilient than a really long synchronous timeout. I'm not saying don't do it, I'm saying we should talk through the options together before we commit."
This is the honest SA move. The customer respects it.
Their reaction to the timeout positioning
Bridge into HIPAA
"OK, that gives me enough to put a real recommendation together on the timeout side. Let's switch gears to the bigger conversation, which is HIPAA. This is the one I want to spend real time on, because it shapes everything else, including how we'd solve the timeout if that endpoint is in the PHI path."
4. HIPAA discovery ~15-20 min · the meat of the call
You're not selling here. You're listening. Your job is to understand their compliance situation.
Opener question
"On the HIPAA side. Walk me through where you are in your compliance program right now. Are you preparing for your first audit, already audited and tightening things up, or somewhere in between?"
Then shut up and listen for 2-3 minutes. Let them talk. Take notes here.
Their compliance situation
Follow-up questions · ask in the natural flow of their answer, not in a checklist
"Is PHI flowing through Cloudflare today, or is this for something you're about to deploy?"
"What's driving the timeline? Audit date, customer requirement, board commitment?"
"Do you already have BAAs in place with your other vendors? AWS, your EHR, your database, anyone in the data path?"
"Who owns HIPAA compliance on your side? Compliance officer, security team, both?"
"What specifically touches PHI in your architecture? Is it patient portal traffic, an API serving an EHR, internal apps your staff uses, or all three?"
This is where you earn your keep as an SA. The customer might not have thought about it that way. Helping them draw the data flow is genuinely valuable.
5. Position Cloudflare ~3 min
Once you have a clear picture of their situation. Don't rush to this. Make sure they've finished talking.
"OK, so based on what you're telling me, here's how I'd frame the Cloudflare piece. We can sign a BAA with you, but that requires Enterprise. It's not a sales tactic, it's a hard line on our side. Free, Pro, Business, none of those tiers can put a BAA in place. So if you're routing PHI through us, Enterprise isn't really optional for you, it's the baseline."
Pause. Let that land.
"The good news is, most of what you'd want to use for protecting PHI is in scope for our BAA. The full Zero Trust stack, the WAF, the CDN, DNS, our Workers platform. There's a list we publish of HIPAA-eligible services. I'll send that over after the call so your compliance team has it on file."
"What I'd want to do next on this side is walk through your specific data flow. Where PHI enters Cloudflare, where it leaves, what gets logged, where the logs go. That's the conversation where I can really help you make sure the architecture is compliant, not just contractually covered."
Their reaction to the BAA / Enterprise framing
6. Tie HIPAA and timeout together ~1 min
Only if the slow endpoint touches PHI (which is likely).
"One thing worth flagging. If the endpoint that's timing out is also one that handles PHI, then these two problems are actually the same conversation. We need to make sure however we solve the timeout, whether it's extending the read timeout or rearchitecting to streaming, still keeps the PHI flow inside the BAA-covered path. That's not a complication, it's just part of the same design exercise. I'll think through both together when I put recommendations together."
This is the moment where you're being a real SA, not a salesperson. They'll feel that.
Does the slow endpoint touch PHI?
7. Close and set next steps ~3 min
"OK, here's what I'd suggest for next steps. I want to put together a short architecture document that covers two things. One, the PHI flow through Cloudflare and what gets covered by the BAA. Two, a specific recommendation on the timeout endpoint, with options. Can I get back to you in [a few days / a week] with that?"
"In the meantime, I'm going to loop in our account team on the Enterprise conversation and BAA process so they can start on the contract side in parallel. That way when you're ready, you're not waiting on paperwork."
"What questions do you have for me right now?"
Their questions and your commitments
★ Post-call summary
Fill this in within the hour while it's fresh. Use it to write your follow-up email.