Is MedPhone HIPAA compliant? Yes. Here is the proof.
MedPhone signs a Business Associate Agreement. All PHI is encrypted at rest and in transit. Every call is logged for audit. The full data flow is on this page.
The short compliance answer.
Yes, MedPhone AI is HIPAA compliant. That statement rests on specific commitments, each documented below.
- 1
BAA signed before deployment.
- 2
PHI encrypted at rest (AES 256) and in transit (TLS 1.3).
- 3
Access logged, audited, and reviewable per practice.
If a vendor cannot show you these in writing, they are not HIPAA compliant. Ask for it, always.
BAA available before your first call goes live.
MedPhone signs a Business Associate Agreement with every practice before the first live call. Our standard BAA meets the requirements of 45 CFR 164.504(e).
The BAA covers
- Permitted uses and disclosures of PHI
- Safeguards for PHI in MedPhone systems
- Breach notification obligations
- Subcontractor requirements. Any downstream vendor with PHI access signs a matching BAA with MedPhone
- Termination and return of PHI
Where PHI goes and where it does not.
- 1
Voice interaction
Patient calls the practice number. Voice audio is streamed over an encrypted connection to the MedPhone voice layer. No PHI is stored in unencrypted form at any point.
- 2
Transcription and intent detection
Voice is transcribed and analyzed for intent inside MedPhone's HIPAA compliant environment. Neither the raw audio nor the transcript is shared with any non compliant service.
- 3
EHR lookup and write back
MedPhone communicates with your EHR through official API endpoints over TLS 1.3. Only the specific data required for the call, meaning patient identity, appointment slot, or medication, is exchanged.
- 4
Call summary logged
A summary of the call is written to the patient chart in your EHR.
- 5
Access log
Every action taken during the call is written to an audit log. Practice administrators can review logs on demand.
Encryption at rest and in transit.
At rest
AES 256 encryption on all stored PHI including audio, transcripts, and call metadata.
In transit
TLS 1.3 on all connections between the caller, MedPhone, and the EHR. Certificates issued by publicly trusted CAs and monitored for expiration.
In processing
PHI is decrypted only inside the HIPAA compliant processing environment. It is never decrypted outside that boundary.
Every action, logged and reviewable.
- Every inbound call, with timestamp and caller identifier
- Every EHR API call MedPhone makes, including endpoint and payload metadata
- Every appointment created, modified, or cancelled
- Every refill request submitted
- Every transfer to human staff, with reason code
- Every admin access to MedPhone systems
Audit logs are retained for six years, matching the documentation retention period HIPAA sets in 45 CFR 164.316(b)(2)(i). Practice administrators access logs through the MedPhone dashboard, and full log export is available on request.
Where MedPhone runs, and who else is involved.
Hosted on AWS
MedPhone runs on Amazon Web Services infrastructure in the United States. AWS data centers are independently audited and hold SOC 2 certification. Encryption keys are managed through AWS KMS.
Every vendor under a BAA
MedPhone executes a Business Associate Agreement with every vendor that can access PHI, including voice carriage and speech processing providers. Any downstream vendor with PHI access signs a matching BAA.
Named list on request
Compliance officers reviewing MedPhone can request the full subprocessor list, with the role each vendor plays and its BAA status, alongside the data flow diagram and BAA template.
If something goes wrong.
If MedPhone discovers a breach affecting your PHI, we notify you without unreasonable delay and no later than 60 days after discovery, as required of a business associate under 45 CFR 164.410. Notification covers what happened, which PHI was involved, what we have done about it, and what we recommend you do.
HIPAA compliance FAQ
What compliance officers ask during vendor review.
Still have questions?
Can't find the answer you're looking for? Reach out to our team and we'll get back to you shortly.
Yes. MedPhone signs a Business Associate Agreement before your first live call. Request the template from this page.
Yes. Any voice recording that identifies a patient and relates to their health, treatment, or payment is PHI. MedPhone treats all voice data as PHI from the moment the call is answered.
No. Your practice's PHI is never used to train models. This is written into the BAA.
Yes. Full log export is available through the MedPhone dashboard on request, covering every call, EHR action, and admin access.
On Amazon Web Services infrastructure in the United States, which is independently audited and SOC 2 certified. Encryption keys are managed through AWS KMS. PHI is never stored on general purpose or non compliant services.
MedPhone notifies you without unreasonable delay and no later than 60 days after discovering a breach affecting your PHI, as required of a business associate under 45 CFR 164.410. Notification covers what happened, which PHI was involved, and what has been done about it.
MedPhone executes a Business Associate Agreement with every vendor that can access PHI, covering hosting, voice carriage and speech processing. Compliance officers can request the named subprocessor list with each vendor role and BAA status.
On termination MedPhone returns or destroys PHI per the BAA. Retention exceptions apply only where required by law.
Ready to review the BAA and full compliance package?
We send the BAA template, subprocessor list, data flow diagram, and current audit summary to compliance officers on request. No demo required.
Or email info@medphone.ai.