HIPAA compliant answering service: what the label can and cannot mean, human or AI

A HIPAA compliant answering service is one that signs a business associate agreement with your practice and protects patient information everywhere a call leaves it: the conversation, the message, the page to the on call clinician, any recording, any transcript and any voicemail. That applies equally to a human answering service and an AI one.

The phrase itself carries less weight than it sounds. HHS does not certify answering services, so HIPAA compliant on a website is the vendor's own description, not a credential. It also cannot make your practice compliant, because half of the risk sits in how your team uses the service. This post goes through what to check, place by place, and where human and AI services differ.

If you want the broader version for AI phone vendors, our posts on whether AI phone software is HIPAA compliant and the HIPAA checklist for AI voice vendors cover the general rules. This one is about the answering service specifically.

What makes an answering service HIPAA compliant?

Five things, and you want evidence of each rather than a yes on a sales call.

1. A signed business associate agreement before any patient call reaches them, covering their subcontractors too
2. Security Rule safeguards on the systems that hold messages and recordings: access controls, encryption, audit logs, and a documented risk analysis
3. Workforce training and policies, for every person who hears or reads patient information, including remote agents
4. Minimum necessary handling: collecting what the call needs and passing on only what the recipient needs
5. A breach process: how they detect an incident, how fast they tell you, and what they hand over

What is a HIPAA BAA, and why does an answering service need one?

A business associate agreement is the contract HIPAA requires between a covered entity, such as your practice, and a vendor that creates, receives, maintains or transmits protected health information on its behalf. It commits the vendor to safeguard the information, use it only for the agreed purposes, report breaches and pass the same obligations to its own subcontractors. HHS publishes sample provisions if you want to see what one should contain.

People sometimes ask why the phone company does not sign one and the answering service does. HHS treats a carrier that only transmits a call, with no routine access to its content and no storage, as a conduit rather than a business associate. An answering service takes messages and stores them, so it is a business associate. The same line applies to AI: HHS guidance on audio telehealth gives the example that a vendor storing recordings or transcripts in its cloud is a business associate, and its cloud computing guidance says storing information, even encrypted, is enough.

Where patient information goes on an answering service call

Walk through one call from ring to deletion. Every row below is a place a HIPAA problem can start.

Is voicemail HIPAA compliant?

Yes, in both directions, with sensible limits. For messages left for patients, HHS says the Privacy Rule does not prohibit leaving one on an answering machine, as long as the practice limits what it says, for example to its name, a callback number and what is needed to confirm an appointment, and honors a patient's reasonable request to be contacted somewhere else. Our voicemail scripts post has wording you can use.

The answering service question is the inbound side, and it rarely comes up in a sales call. Many human services fall back to a voicemail box when every agent is busy, and that box fills with patient messages. Those messages are stored PHI. Whoever hosts the box is a business associate, a mailbox password shared across a team defeats the access controls, and voicemail transcriptions emailed to a staff inbox put PHI somewhere nobody reviewed. Ask three things: when does overflow go to voicemail, who can open the box, and where do the transcriptions go.

Is SMS HIPAA compliant?

HIPAA does not ban text messages, but standard SMS is not encrypted in a way you control and messages sit on phones you do not manage. That makes plain SMS a poor channel for PHI, and it matters most in the one place answering services use it constantly: paging the on call clinician.

Two workable patterns. Send the on call clinician a minimal page that says a message is waiting, and have them read it in a secure app or portal covered by a BAA. Or use a secure messaging app as the page itself. For texts to patients, HHS guidance on email is the closest analogue: electronic communication is permitted with reasonable safeguards, and providers can tell patients the risks of unencrypted messages and let them choose. Keep patient texts to logistics, such as appointment times, rather than clinical detail.

Call recording and transcripts

A recording of a patient call is PHI, and so is the transcript of an AI call. Both need the same protection as the chart, a defined retention period and a clear answer about who can listen or read. Ask how long the service keeps them by default, whether you can shorten that, and whether they are deleted or returned when the contract ends.

Consent to record is a separate question from HIPAA. Federal law allows recording when one party consents, but some states require everyone on the call to agree, so most practices announce recording in the greeting. The phone system post covers the consent rules in more detail.

Human or AI: the risks are different

Both need a BAA and both can be run well or badly. The risks just sit in different places.

• Human services: many people hear and read your patients' information, some working from home. Ask about training records, how remote agents are supervised, whether notes are ever written on paper, and how quickly access is removed when an agent leaves
• AI services: fewer people, more systems. Ask which subprocessors handle speech and language processing, whether each is under a BAA, whether patient data is used to train models, and how long audio and transcripts are kept
• Both: ask how the caller is identified before anything is shared. Giving appointment details to the wrong person on the phone is a disclosure, whoever answers

What HIPAA compliant cannot mean

• That the service is certified. There is no federal HIPAA certification for answering services
• That your practice is compliant. Your own policies, how staff use the messages, and what you text or email are still yours
• That there will be no breach. Compliance means reasonable safeguards and a response plan, not zero risk
• That every subcontractor is covered, unless the BAA and the vendor's own agreements say so

Where MedPhone fits

MedPhone is an AI phone agent rather than a message taking service: routine calls are completed in the EHR during the call, and clinical, urgent or unusual calls transfer to your staff under rules you set. On the six places above: we sign a BAA before any patient call; stored audio, transcripts and call data are encrypted with AES 256, and connections use TLS 1.3; patient data is not used to train models; every action lands in an audit log the practice can review; and call summaries go to the chart, not to a text message. We do not do clinical triage, so your on call path for urgent calls stays in place.

How MedPhone handles HIPAA, in detail

Questions people ask

What is a HIPAA compliant medical answering service?

It is an answering service that signs a business associate agreement with your practice and protects patient information wherever a call ends up, including messages, pages to the on call clinician, recordings and voicemail. There is no official certification, so ask for the BAA and evidence of the safeguards rather than relying on the label.

What is a HIPAA BAA?

A business associate agreement is the contract HIPAA requires between a covered entity and a vendor that handles protected health information on its behalf. It commits the vendor to safeguard the information, limit how it is used, report breaches and bind its subcontractors to the same terms.

Is voicemail HIPAA compliant?

Yes, with limits. HIPAA allows leaving messages for patients if you keep the content minimal and honor requests to be contacted elsewhere. An inbound voicemail box holding patient messages is stored PHI, so it needs access controls and a BAA with whoever hosts it.

Is a HIPAA compliant phone service the same as a HIPAA compliant answering service?

No. A phone service that only carries calls is usually treated by HHS as a conduit and may not need a BAA, while an answering service that takes, stores or sends messages is a business associate. If your phone service also records calls or stores voicemail and transcripts, it needs a BAA too.

Is SMS HIPAA compliant?

HIPAA does not ban texting, but standard SMS is a weak channel for PHI because it is not encrypted in a way you control. Use a secure app covered by a BAA for clinical detail, keep patient texts to logistics, and tell patients the risks if they ask for unencrypted messages.

Is a HIPAA compliant AI receptionist different from a human answering service?

The rules are the same and both need a BAA, but the risks differ. A human service has more people handling PHI, while an AI service has more systems, so ask about subprocessors, model training, and how long audio and transcripts are kept.