Short answer: Yes, a medical answering service needs to sign a Business Associate Agreement (BAA) with your practice. It takes, stores and delivers messages that contain patient information, so under HIPAA it is a business associate, not a pass-through like the phone company.
This guide explains what a BAA covers, why the HIPAA “conduit” exception doesn’t apply to answering services, and the questions to ask any vendor before patient calls go to them. It is general information, not legal advice. Your compliance officer or attorney should review your agreement.
Why an answering service is a business associate
HIPAA’s Privacy Rule defines a business associate as a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity (45 CFR 160.103). When a patient calls after hours and a representative writes down a name, date of birth, symptoms and a callback number, that message is protected health information. The answering service receives it, stores it and delivers it to your on-call provider.
Some vendors point to the “conduit” exception. HHS says that exception is limited to transmission-only services, such as the postal service or an internet provider, where access to the information is only transient. A service that stores the information is a business associate even if it never reads it. An answering service does more than store: its people listen to the patient and write the message.
What a Business Associate Agreement covers
- Permitted uses. The vendor may use patient information only to perform the service for you.
- Safeguards. It must protect the information with administrative, physical and technical safeguards.
- Breach reporting. It must tell you about a breach of unsecured patient information, so you can meet your own notification duties.
- Subcontractors. Any vendor it uses that touches the information, such as a call platform or messaging app, must agree to the same restrictions.
- Access and amendment. It must help you respond when a patient asks to see or correct their information.
- End of contract. It must return or destroy the information when the relationship ends, where feasible.
“HIPAA compliant” is not a certification
HHS does not certify vendors as HIPAA compliant, and no official seal exists. A website badge tells you nothing about how a specific vendor handles your patients’ information. What you can check is whether the vendor signs your BAA, how messages reach your providers, and who else touches the data.
Ten questions to ask an answering service
- Will you sign our Business Associate Agreement, or only yours?
- Will the BAA be signed before you answer our first call?
- How do messages reach our on-call provider: plain text message, email, phone call, or an encrypted app?
- If you offer encrypted messaging, what does it cost and who pays per device?
- What call platform and messaging vendors do you use, and do they sign agreements with you?
- How long do you keep call recordings and messages, and how are they deleted?
- Who can see our messages: all staff, or only representatives on our account?
- How are representatives trained on patient privacy, and how often?
- Where do representatives work? In a call center, at home, or both?
- How will you tell us about a breach, and how fast?
Plain text messages are the usual weak spot
Many practices have their answering service text patient messages to the on-call doctor’s personal phone. Standard SMS isn’t encrypted end to end and stays on the phone indefinitely. An encrypted messaging app keeps patient details out of the phone’s regular texts and lets the provider reply securely.
How CallNET handles it
- We sign your Business Associate Agreement. Send us your organization’s BAA and we sign it and return it before we answer your first call.
- Patient messages can go through miSecure encrypted two-way messaging, an add-on: $9 per device per month for 1 to 3 devices, $7 for 4 to 7, and $5 for 8 or more.
- Every call is answered live by a trained representative in the United States, 24 hours a day, following your on-call protocol.
See how we answer for medical practices, dental offices, hospices and home health agencies.
Questions people ask
Does an answering service need to sign a BAA?
Yes, if it takes calls for a HIPAA covered entity such as a medical practice. It receives, stores and transmits patient information on the practice’s behalf, which makes it a business associate.
Does the HIPAA conduit exception apply to answering services?
No. HHS limits the conduit exception to transmission-only services with transient access, such as the postal service or an internet provider. An answering service takes and stores patient messages.
Is there an official HIPAA certification for answering services?
No. HHS does not certify vendors. Ask whether the vendor signs your BAA, how messages are delivered, and which subcontractors touch the information.
Can an answering service text patient messages to the doctor?
It can, but standard text messages aren’t encrypted end to end and stay on the phone. An encrypted messaging app, such as miSecure, is the safer option for patient details.
Will CallNET sign our BAA?
Yes. CallNET is HIPAA-compliant. Send us your organization’s Business Associate Agreement and we sign it and return it before we answer your first call.