Compliance · how-to
Does Your Answering Service Need a HIPAA Business Associate Agreement?
If your answering service touches patient appointment data, a HIPAA business associate agreement isn't optional. Here's exactly what to check and require.
A dental office in the Midwest agreed to an AI receptionist demo. The vendor was enthusiastic, the demo sounded great, and the practice went live within a week. Six months later, a patient complained that an after-hours confirmation call had left a voicemail that included the patient’s name, provider, and appointment type on a shared family phone. The practice’s attorney asked one question: “Did you get a BAA from the vendor before go-live?”
They had not. The vendor’s standard signup flow didn’t mention one. The practice owned the exposure entirely.
This is not a rare situation. It is the common one. Most answering service decisions — AI or human — get made on price and features. The compliance step is an afterthought, right up until it isn’t.
This guide gives you the practical checklist before you go live.
Who Actually Needs a BAA
Start here, because not every business that uses a phone answering service needs a HIPAA business associate agreement. The requirement applies to covered entities and their business associates.
Covered entities under HIPAA include:
- Healthcare providers who transmit health information electronically (physician offices, dental practices, med spas performing medical procedures, physical therapy clinics, mental health providers)
- Health plans
- Healthcare clearinghouses
If you run a dental office, a med spa with IV therapy or injectables, or a mental health practice, you are almost certainly a covered entity. If you run an HVAC company, you are not — stop here, the BAA requirement does not apply to you. (For your compliance questions around call follow-up, see our guide on TCPA Basics for Local Service Businesses: What Your Missed-Call Follow-Up System Must Get Right.)
A Business Associate is any outside vendor or person who:
- Creates, receives, maintains, or transmits protected health information (PHI) on your behalf, and
- Is not a member of your workforce
An answering service — human or AI — that picks up your phones and books appointments almost always qualifies. When a caller says “I need to schedule a root canal” and gives their name, that is PHI the moment your answering service logs or routes it. The vendor is handling it on your behalf. That makes them a business associate.
The rule has been this clear since the 2013 Omnibus Rule extended direct liability to business associates. You can read the full regulatory landscape in our HIPAA, TCPA & Call Compliance for Service Businesses pillar guide.
What Counts as Protected Health Information in a Phone Call
PHI is not just medical records. In the context of a phone answering service, PHI is created the moment you have:
- A name linked to a health care appointment or service — “John Smith calling for his 3 p.m. with Dr. Patel”
- A name linked to a condition or symptom — “I need to come in for my back pain follow-up”
- Contact information combined with a provider relationship — even if no diagnosis is discussed
What is not PHI in a call context:
- A caller asking for your office hours with no name provided
- A general inquiry about what services you offer
- A vendor call with no patient information involved
The gray zone catches a lot of practices. A caller who says “this is Maria, can I reschedule?” and you look up her file internally — the call itself may not have contained much, but if the answering service logged the name and the callback reason, that log is PHI.
If your answering service records calls, transcribes voicemails, or stores any call metadata tied to patient identity, a BAA is required.
What a BAA Must Actually Contain
The HIPAA Security Rule specifies what a valid BAA must address. A document that just says “we take privacy seriously” is not a BAA. A compliant agreement must include:
Required elements:
- Description of the permitted uses and disclosures of PHI by the business associate
- Requirement that the BA not use or disclose PHI beyond what the agreement permits
- Requirement to use appropriate safeguards (and, under the Omnibus Rule, to comply with the Security Rule’s technical safeguard requirements)
- Obligation to report any breach or security incident to you
- Requirement to ensure any subcontractors (sub-BAs) are also covered by their own BAA
- Obligation to return or destroy PHI at contract termination
- Authorization for HHS to audit the business associate
Common gaps to watch for:
- BAAs that cover “data” generically but never define PHI or ePHI
- No mention of subcontractors (an AI vendor using a third-party transcription service, for example)
- No breach notification timeline — HIPAA requires notification within 60 days of discovery; your BAA should reflect this
- A BAA effective date that is after your go-live date — the agreement must be in place before PHI is shared
If a vendor sends you a three-paragraph “privacy addendum” and calls it a BAA, have your attorney review it before assuming you’re covered.
How to Verify Your AI Receptionist Vendor is Actually Compliant
The sales process for AI phone tools has moved fast. Many vendors make claims in their marketing that their legal documentation does not support. Here is the verification sequence:
Step 1: Ask for the BAA before the demo ends
Don’t wait until you’re ready to sign. Ask during the evaluation: “Do you offer a signed HIPAA BAA?” Vendors who are genuinely HIPAA-ready will have a standard BAA in their contract process. Vendors who stall or redirect to their marketing materials are telling you something.
Step 2: Request their security documentation
A BAA is the legal layer. The technical layer matters equally. Ask for:
- Evidence of encryption at rest and in transit (AES-256 and TLS 1.2+ are the baselines)
- Access control documentation — who at the vendor can access call recordings or transcripts?
- Audit log capability — can you pull a log of who accessed what?
- Their breach notification process and average response time
Step 3: Ask about subprocessors
If the AI vendor uses a third-party voice transcription service, a cloud storage provider, or a routing platform, those are potential sub-BAs. Under the Omnibus Rule, your vendor must have signed BAAs with their own subcontractors. Ask for a list of subprocessors and confirm BAA coverage extends to them.
Step 4: Confirm the BAA is signed by an authorized representative
A BAA is not effective if it is clicked through during a software signup flow by whoever happens to be setting up the account. It needs to be executed by someone at your practice who has authority to bind the organization, and by someone at the vendor with equivalent authority.
Step 5: Date-check before go-live
Pull the executed BAA. Confirm the effective date is on or before the date patient calls will be handled by the service. If you piloted the system for two weeks before signing paperwork, that two-week window is potentially unprotected.
For a head-to-head look at how AI and human services compare on these compliance requirements, see our AI Receptionist vs. Human Answering Service for Medical Practices: Compliance Comparison.
The Honest Objection: “This Seems Like a Lot for Just Answering Phones”
It is more work than signing up for a consumer phone app. That’s the point.
Human answering services have been navigating BAA requirements for years. The HIPAA-compliant ones know the drill: standard BAA in the contract, staff trained on PHI handling, call recordings stored with access controls. The ones that do not do this are cheaper — and the price difference is exactly the compliance gap you’re absorbing.
AI answering services are newer to this. Some vendors have done the work — security audits, SOC 2 certification, proper BAA language. Others are consumer-grade tools pitched at medical practices without the backend to support it. The distinction matters enormously, because an AI system that transcribes voicemails to a general inbox or stores call recordings in a non-encrypted consumer cloud is a breach waiting to happen.
Dental offices and med spas face this question in especially sharp form, since they operate at the intersection of consumer-facing scheduling and regulated health data. We cover the specifics in detail in HIPAA Compliance and AI Phone Receptionists: What Dental Offices and Med Spas Must Know.
For law firms evaluating AI receptionists, the obligation is different — attorney-client privilege rather than HIPAA — but the due-diligence pattern is similar. See Law Firm Intake Confidentiality and AI Receptionists: Attorney-Client Privilege on the First Call.
Your Pre-Go-Live Checklist
Before your answering service handles a single patient call:
- [ ] Confirm your practice qualifies as a HIPAA covered entity
- [ ] Confirm the answering service will receive, store, or route PHI (appointment data, patient names, callbacks with health context)
- [ ] Obtain a fully executed BAA with an effective date on or before go-live
- [ ] Verify the BAA contains all required elements (permitted uses, safeguards, breach notification, subcontractor coverage, return/destruction at termination)
- [ ] Request security documentation: encryption standards, access controls, audit logging, breach response timeline
- [ ] Confirm BAA coverage extends to all subprocessors used by the vendor
- [ ] Store the signed BAA where you can produce it in an audit — HHS expects you to maintain these for six years
If any item on this list cannot be completed because the vendor won’t provide the information, that is your answer about whether the vendor is the right fit for a covered entity.
Next Step
If you are evaluating an AI receptionist for a medical or dental practice, ask for the BAA first — before the demo, before the trial, before the first test call. A vendor that is genuinely HIPAA-ready will have the documentation ready. One that isn’t will give you a runaround that tells you everything you need to know.
FLUXATH’s AI Voice Receptionist is built for practices that cannot afford a compliance gap. If you want to see how the BAA process works in practice, call our demo line at +1 (858) 358-7270 or book a walkthrough at book.fluxath.com.