Practices comparing answering services usually ask whether the provider is HIPAA compliant. It is the right question, but on its own it is not sufficient, because compliance is something a provider asserts and a Business Associate Agreement is something they sign.
Yes, in most cases, if your practice is a HIPAA covered entity. An answering service that takes, keeps or passes on patient information for your practice generally meets HIPAA's definition of a business associate, and HIPAA requires the assurances you get from a business associate to be documented in a written contract or agreement: the business associate agreement, or BAA. Here is what that means in practice.
This is general information about how the arrangement usually works, not legal advice. Confirm the specifics with your own counsel or compliance officer before you sign anything.
What makes an answering service a business associate
Under the HIPAA rules, a business associate is a person who, on behalf of a covered entity and other than as a member of its workforce, "creates, receives, maintains, or transmits protected health information" for a regulated function or activity, or provides certain services that involve disclosing protected health information to them (definition in 45 CFR 160.103). An answering service that takes patient calls, records messages and delivers them to your staff generally fits that description.
It is worth noticing how little it takes. Protected health information is not only diagnoses and test results. A message recording that a named patient called about a specific appointment, or that a particular person is seeking treatment from your practice at all, is information about that individual's care. Operators handle that from the first call onward.
A covered entity may let a business associate create, receive, maintain or transmit protected health information on its behalf only if it obtains "satisfactory assurance" that the business associate will appropriately safeguard it, and those assurances must be documented in a written contract or other written agreement (45 CFR 164.502(e)). So the question is rarely whether a BAA is needed. It is whether the provider will sign one, and what sits behind it.
What the agreement covers
The required contents are set out in 45 CFR 164.504(e). Among other things, the agreement must:
- Establish the permitted and required uses and disclosures of the information by the service.
- Require the service not to use or further disclose the information other than as the contract permits or requires, or as required by law.
- Require appropriate safeguards, including compliance with the HIPAA Security Rule for electronic information where it applies.
- Require the service to report any use or disclosure not provided for by the contract, including breaches of unsecured protected health information.
- Require the service to make sure any subcontractors that handle the information agree to the same restrictions and conditions.
- Provide for return or destruction of the information when the contract ends, where feasible.
- Authorize you to terminate the contract if the service violates a material term.
The agreement also covers making information available for patients' access, amendment and accounting requests, and making the service's records available to the Department of Health and Human Services. The value is less in the document existing than in what it forces both parties to have decided in advance. This page summarizes the regulation; your counsel should review the agreement itself.
Questions to ask before you sign
A provider set up for medical work will answer all of these specifically. Vagueness on any of them is the finding, not an inconvenience.
About the agreement itself
- 1Will you sign a BAA, and can we see it before committing?
- 2Will you sign ours, or do you require your own form?
- 3Who at your organization is responsible for compliance, and how do we reach them?
About what actually happens to the information
- 1Where are messages stored, and for how long?
- 2Who can access them, and how is that access removed when someone leaves?
- 3How are operators trained on handling patient information, and how often is it refreshed?
- 4Are calls recorded? If so, where do the recordings live and who can hear them?
- 5Do any subcontractors touch our messages at any point?
- 6How would we be told about a breach, and within what timeframe?
The storage and access questions are the ones that reveal most. A provider that can describe retention periods and access controls without checking has thought about this; one that answers only in adjectives has not.
Compliance is training and process, not a badge
A logo on a website is not a compliance program. What actually protects patient information is mundane and operational: how operators are trained, how systems control access, how long records are kept, what happens when staff change, and how message delivery works.
Message delivery deserves particular attention, because it is where information leaves the provider's systems and enters yours. Ask how urgent messages reach your on-call clinician and whether that route is appropriate for the information it carries. A protocol designed only for speed can end up sending detail somewhere it should not go.
Our guide to HIPAA-compliant answering services covers the operational side in more detail.
Where this applies beyond a doctor's office
Practices sometimes assume this only concerns physicians. In reality the same considerations arise anywhere patient information reaches an operator — dental practices, mental health and therapy practices, home health and hospice providers, clinics, and research centers screening candidates for a study.
Trial recruitment is a case worth flagging, because callers are not yet your patients and people assume the rules are looser. Screening calls collect health information from members of the public, which is precisely when confidentiality deserves the most attention — see cutting clinical trial costs by outsourcing recruitment calls.
One boundary that belongs in the protocol
Separate from the agreement, make sure the clinical line is written down. An operator classifies urgency against rules a clinician wrote and routes the call accordingly. An operator never interprets symptoms and never advises a patient on what to do.
That boundary protects patients, staff, and the operator, and any provider vague about it is describing a service no practice should use — whatever paperwork they are willing to sign.
What a "HIPAA compliant" claim does and does not tell you
When a provider describes itself as HIPAA compliant, it is usually making a self-assessment — which may be entirely accurate, but is not the same as an external verification. Be wary of anyone who says they are "HIPAA certified" without explaining who certified what.
That is not a reason for cynicism; it is a reason to ask what sits underneath the claim. A provider genuinely set up for medical work will welcome the questions, because answering them is how they differentiate from a general message-taking service that has added a line to its website.
The practical test is specificity. Ask how long messages are retained and you should get a period, not a reassurance. Ask who can access them and you should get a description of roles, not the word "authorized".
Common mistakes practices make
- Assuming a BAA is in place because compliance was discussed. The agreement is a document; confirm it exists and that you have a copy.
- Signing without reading the breach notification terms, which are the clauses you will care about most if they are ever needed.
- Overlooking message delivery. Information is at its most exposed as it travels from the service to your team, and the route is often chosen for speed alone.
- Forgetting to revisit it. Staff change, systems change, and an agreement signed years ago may not describe how either party now works.
- Treating recorded calls as separate from the rest. A recording of a patient call is a record of a patient interaction.
None of these is exotic. They are the ordinary consequences of treating compliance as a procurement checkbox rather than an operating arrangement.
Answering365's plans include HIPAA-compliant handling of calls and messages for medical answering services. If a BAA is part of your requirements, raise it at the start of the conversation, along with the storage, access and recording questions above.
Next step: see how Answering365 handles calls for healthcare practices on our medical answering service page. For the general vetting checklist, read the questions to ask an answering service before you sign, or start from the buyer's guide.
Ask us about a BAA or call Answering365 at 888-588-9800.
