HIPAA-compliant answering
HIPAA-compliant answering is call handling for US healthcare providers in which the answering provider operates as a business associate under HIPAA. That means a signed business associate agreement and safeguards for any protected health information callers disclose.
Also called: HIPAA answering service, medical answering service, healthcare call answering
A medical practice, clinic or pharmacy that hands its phones to an outside service is sharing patient information with that service: a caller’s name, condition, appointment and medication are all protected health information (PHI). Under HIPAA, an outside organization that handles PHI on a covered entity’s behalf is a business associate and must sign a business associate agreement (BAA) setting out its obligations.
"HIPAA-compliant" in a service’s marketing usually means it will sign a BAA and has put administrative, physical and technical safeguards around PHI: access controls, encryption of recordings and messages, staff training, and secure delivery of messages rather than plain SMS or email. There is no government certification for HIPAA compliance; the phrase describes a provider’s posture and contractual commitments.
Whether any particular arrangement satisfies HIPAA is a question for the covered entity and its advisers. The practical checklist for a buyer is the BAA, how messages containing PHI are transmitted and stored, and how long recordings and transcripts are retained.