HIPAA compliant medical answering service: what it takes, and where we stand

Why a medical answering service needs a BAA

HIPAA applies to "covered entities," and, since the 2013 update to the rules, directly to the companies that work for them with patient information. The US Department of Health and Human Services (HHS) lists doctors, clinics, psychologists, dentists, chiropractors, nursing homes and pharmacies among them, when they send information electronically for standard transactions such as insurance claims.

A company that creates, receives, keeps or sends protected health information on a practice’s behalf is a "business associate," and it needs a BAA with the practice. A phone service hears patients’ names and numbers, what visit they want and what they need from the doctor, and it keeps messages, recordings and transcripts. That’s protected health information, so the service is a business associate.

AI doesn’t change the rule. In its guidance on business associates, HHS lists a third-party AI chatbot that handles appointment scheduling for a provider’s patients as an example of a business associate. An AI receptionist on your phone line is in the same position.

There’s an exception for companies that only carry information from one place to another, like the postal service. It doesn’t fit an answering service: a service that records, transcribes and summarizes your calls is doing more than carrying them.

What a business associate agreement covers

According to HHS, the agreement has to describe what the business associate may and must do with protected health information, and commit it not to use or share that information except as the agreement allows or the law requires. The full list of elements is in the HIPAA Privacy Rule, and HHS publishes sample business associate agreement provisions.

Two points matter most for a phone service:

• Subcontractors sign too. A business associate must have its own BAA with any subcontractor before passing it patient information. For an answering service, that usually means the companies behind the voice technology, the phone lines and the storage.
• A badge isn’t an agreement. A logo or a line on a website that says "HIPAA compliant" isn’t the BAA. The signed agreement is what you ask for.

Where we stand today

• No BAA is signed. We haven’t signed BAAs with any practice, and the technology companies our service runs on would need to sign them with us too. That isn’t in place yet.
• So we don’t claim compliance. No page of this site says we’re HIPAA compliant, and none will until the agreements are signed.
• We don’t set up practices that need a BAA. Medical, dental, chiropractic, therapy and other covered practices join a waitlist instead. Not sure if yours is covered? See the question about it below.
• Ask us any time. If your practice is waiting, we’ll tell you exactly where things stand. When the agreements are signed, this page will say so and explain what they cover.

What you can and can’t do in the meantime

What to ask any medical answering service

Before you forward a single patient call, ask:

1. Will you sign a BAA before the first call, and can we read it first?
2. Which companies handle our calls, for voice, phone lines, transcription and storage, and do you have a BAA with each one?
3. Where are recordings, transcripts and messages kept, and for how long?
4. Who can listen to or read our calls, on your side and on your subcontractors’ side?
5. How and when will you tell us if patient information is exposed?
6. What happens to our data when we stop using the service?
7. Does the AI, or the operator, ever give medical advice or judge symptoms? Ours never does.

A good provider answers all seven in writing. If one of them gets a vague answer, keep asking.

Sources: the HHS pages linked above, checked in October 2026, and the 2013 update to the HIPAA rules (the Omnibus Rule). We’ll update this page when anything changes, starting with our own agreements.