What makes a medical answering service HIPAA compliant?

Your front desk may take a patient message, send it to a provider and call or text the patient back later. If another company handles any part of that conversation, you need to know who can see the patient information, where it goes and what happens to it along the way.

Hello Patient builds AI agents for healthcare. The agents can answer patient calls and handle messages for the work your practice gives them. By call and text, they find the patient's record in your EHR after an identity check and book, reschedule and cancel visits inside the scheduling rules your practice sets. This page covers the business associate agreement (BAA), patient information, messages, text-backs and other compliance questions to review before you sign.

This is not legal advice.

What should a medical answering service's BAA cover?

Your BAA should say what the answering service can do with patient information, how it protects that information, what it has to report and what rules apply to qualifying subcontractors. Signing a BAA does not, by itself, prove that the service follows every applicable requirement. HHS: business associate agreement provisions

Read the agreement against the service you're buying. If one company takes the message, another stores it and another relays it, ask the vendor to walk you through each step. Ask which company handles each part, what the agreement allows it to do and who is responsible when your practice has a question.

What patient information may a medical answering service take on a call?

It may take the information it needs for the permitted task. A date of birth and reason for calling can be appropriate, but there is no field list that makes every call compliant.

Where the minimum-necessary rule applies, the service must limit what it uses, shares or requests to what it needs for that purpose. That limit does not apply when the service shares information with the patient. It also does not apply when the service shares information with a healthcare provider for treatment. A healthcare provider's request for treatment information is also exempt from this limit. HHS: minimum necessary

Take a routine appointment request. Ask why the service needs each field and which staff roles can see it. Then compare that with a message going to a treating provider. The purpose may be different, but appropriate safeguards still apply. HHS: treatment, payment and healthcare operations

Where does patient information go after the answering-service call?

The message passes through the vendor's tools, its storage and the people who receive it. Ask the vendor to trace it from the moment the service receives it until your practice gets it. Protected health information (PHI) held electronically needs the applicable administrative, physical and technical safeguards while the service handles it. HHS: Security Rule

Start with the message your practice receives and work backward. Ask where it was stored, who could open it and whether another company handled it. If the service uses a separate recording service, include that company in the review. Ask whether calls are recorded and how long the information is kept.

A subcontractor that creates, receives, maintains or transmits PHI for the business associate generally has its own business associate obligations. The answering service must put the required subcontractor agreement in place. HHS: business associates

Are voicemails and text-backs from a medical answering service HIPAA compliant?

They can be, but it depends on what is sent, where it goes and how it is handled. If a patient leaves a voicemail, review how the service receives and stores it and who can access it. The applicable safeguards for electronic protected health information still apply. HHS: Security Rule

If the service leaves a voicemail for the patient, HHS permits voicemail with privacy safeguards and limited information, such as callback details. Your practice must also honor a patient's reasonable request to be contacted another way, or at another number or address. Review the voicemail script the vendor plans to use. HHS: messages for patients

For a text-back, check the content, destination, privacy safeguards and the permission that applies to that text. A BAA or an incoming call does not give blanket permission for automated follow-up. The FCC has a narrow exemption for healthcare messages that are free to the person who receives them. It has conditions, and it does not cover billing or financial messages. HHS: safeguards · FCC: paragraphs 146–148

For broader context, see our HIPAA guide for AI receptionists.

Do live medical answering operators and AI agents follow the same HIPAA rules?

An outside service doing qualifying work with PHI is generally a business associate whether a person or an AI agent handles the conversation. Qualifying business associates have direct duties under HIPAA as well as duties in their agreements. An employee answering calls for the service is not automatically a separate subcontractor. HHS: business associates

The access and technical setup can still look different for a human answering service and an AI system, so review the actual setup.

Hello Patient is HIPAA-compliant and SOC 2 Type 2 certified. We provide a BAA on every account, and every interaction is logged. You can hear an agent or ask for a free demo agent. Ask us to walk through how patient information would be handled for the setup you're considering. Our medical answering-service guide explains the service mechanics.

How should a medical answering service pass a message to the on-call provider after hours?

The service can pass the message when the recipient, the purpose and the way it handles the message all fit the work your practice has authorized. A treating provider does not automatically become a business associate just because the provider receives information for treatment. HHS: business associates · HHS: treatment disclosures

Take a message meant for your on-call provider. Ask who receives it first, which service sends it to the provider and who is responsible for that part of the arrangement.

After-hours booking is different from relaying a provider message. At Carbon Health, Hello Patient's AI agent answered after-hours calls and texted patients booking links. Read the Carbon Health case study.

What should a practice ask an answering service vendor about compliance before signing?

Ask the vendor to walk through one real conversation your practice wants the service to handle. Then follow the information from the patient to the final action.

• What information does the service collect, and for what task?
• Who can access it, including separate companies and overseas teams?
• Where is the message stored, and who receives it?
• What do the agreement and service documentation say about incident reporting?
• Which requested actions can this setup actually perform?

For Hello Patient, the agent works in your EHR by call and text: after an identity check, it finds the patient's record and existing appointments, creates the record for a new patient, books, reschedules and cancels visits, and leaves a note on the appointment with what the patient said. Your practice sets the identity check and the scheduling rules the agent works inside. On web chat, the agent answers questions and books visits; record lookups and appointment changes run by call and text, after the identity check.

Find out whether Hello Patient fits your practice. Book a call and bring a patient conversation you want to see handled, such as an appointment request after closing. Ask for a free demo agent that answers the way your practice would.

Frequently asked questions

Does a medical answering service need to sign a BAA with the practice?

Generally, yes, when the service does qualifying work with protected health information for a HIPAA-covered practice. Hello Patient provides a BAA on every account. The required written agreement needs to be in place before that work begins. It covers permitted uses, disclosures and other required duties, while the service also has direct obligations under applicable HIPAA rules. Check that the agreement covers the company providing the service and the work your practice has authorized. A signed BAA is part of the relationship, but it does not prove complete compliance. HHS: business associates · HHS: contract provisions

Can a HIPAA compliant answering service take a patient's date of birth and reason for calling?

Yes, when those details fit the permitted task. Ask Hello Patient what each field in the proposed setup is for and who can access it. There is no universal list of fields that makes a call compliant. Where it applies, the minimum-necessary rule limits the information used, shared or requested to what the task needs. Appropriate safeguards still apply. Ask what information the service needs to complete the job you are giving it, then make sure its access matches that purpose. HHS: minimum necessary

Is it HIPAA compliant for a medical answering service to text a patient back?

It can be, depending on the message, destination, safeguards and permission for that text. For Hello Patient, review the texts the proposed agent would send and the permission each one relies on. HHS: Security Rule A BAA or incoming call does not give blanket permission for automated follow-up, and the FCC's healthcare exemption is limited. Instead of accepting one answer for every patient text, ask the vendor which permission or exemption applies to each kind of text-back your practice plans to send. FCC: paragraphs 146–148

Do a medical answering service's subcontractors and offshore operators need their own BAA?

It depends on the role each company or person has. You would check Hello Patient the same way. An operator in the answering service's own workforce is not automatically a separate subcontractor. A qualifying subcontractor that handles protected health information for the business associate generally needs an agreement with that business associate. HHS: business associates HHS also permits overseas storage of electronic protected health information when the applicable agreement and other HIPAA conditions are met. The location, and whether privacy and security protections can be enforced there, still matter to the risk analysis. This guidance covers storage and does not approve a particular offshore operator arrangement. HHS: overseas storage

Can a HIPAA compliant answering service read a patient's appointment time or balance back to the caller?

Yes, when the person asking is allowed to hear it, the reason is permitted and the required checks are done. The Hello Patient agent checks the caller's phone number and date of birth, then finds the patient's record and appointments in your EHR. Where HIPAA requires it, your practice must verify the person's identity and authority when either is unknown. HIPAA has exceptions for certain disclosures to family, friends or others the patient identifies, under its conditions. HHS: verification, 164.514(h) · HHS: Privacy Rule On web chat, the agent answers questions and books visits; record lookups run by call and text, after the identity check.

What should a HIPAA compliant answering service contract say about breach notification?

The contract should say what gets reported, who contacts your practice and when that notice happens. For Hello Patient or any other vendor, review the breach terms in the agreement the vendor offers. Security incidents and breaches are different. HHS: contract provisions For a qualifying breach of unsecured protected health information, a business associate must notify the practice without unreasonable delay and no later than 60 days after discovery. Sixty days is the outer limit, not permission to wait. Your contract may require earlier notice. HHS: breach notification

Does HIPAA apply to an answering service that only takes messages for a doctors office?

It can. When you review Hello Patient or another answering service, look at message-taking as well as record access. A patient's identity plus health information in the message can still be protected health information. For a HIPAA-covered practice, an outside service doing qualifying work with that information is generally a business associate. Ask what patients may say in a message, where the message goes and who can read it. Saying that a service "only takes messages" does not answer those questions. HHS: business associates