Picture the following scenario. It’s 9 p.m., and a patient calls your office about a new symptom. The patient gives the office their name, date of birth, and a callback number. A message is taken. Now, where does the message go next, and who else is able to view it?
For medical practices, that isn’t a minor question. It’s central to understanding what makes an answering service HIPAA compliant.
Why Answering Services Handle Patient Information
When an answering service handles calls for medical offices, they may hear and record protected health information (PHI). Including a patient’s name, the reason for the call, symptoms, medication questions, and contact details. Even a simple request to have a doctor call them back regarding test results or medication is information patients expect to be handled securely.
That’s exactly why an answering service for a medical practice requires a different level of care than one for a landscaping company. Patient information is highly confidential so the stakes and expectations are much higher.
Understanding HIPAA Regulations
The U.S. The Department of Health and Human Services (HHS) states that when a covered entity, such as a medical practice, entrusts another company to handle PHI on its behalf, that company is labeled a “business associate.” HHS guidance states the medical practice must have a written contract and a business associate agreement in place with the third party company. Per HHS’s Business Associate Contract, the agreement must:
- Establish the permitted and required uses and disclosures of PHI.
- Require the business associate to use appropriate safeguards to prevent unauthorized use and/or disclosure.
- Require the business associate to report any use or disclosure not permitted under the contract, including breaches.
Ultimately, both the agreement and practices behind the phone line matter. This article provides general information, not legal advice. You should consult your compliance officer or attorney when making final decisions.
7 Questions to Ask An Answering Service
Use these questions when comparing providers:
- Will you sign a business associate agreement?
This should be the first question asked. If the answer is unclear, that is a red flag.
- Who answers our calls?
Are our calls answered by live, trained agents or an automated system? Knowing who handles the information is essential.
- How are your staff trained on patient privacy?
Ask how often training takes place and what it covers?
- How do messages get to our practice?
Ask what secure methods are used and whether any information is sent by regular text or email?
- Who can access our patient's information on your end?
Access should be limited to staff who need the information to do their job.
- How do you handle a call that is urgent?
A good provider follows your practices' instructions for escalation rather than making decisions on its own.
- Can we customize our greetings and call scripts?
Your callers should hear your practice’s name and follow your preferred process, not a generic script.
Why Live Answering Matters
Patients don’t call after hours because it’s convenient. They call because they have a question, need or concern. A live agent can pick up concern in a caller’s voice, ask the right follow-up questions, and obtain accurate information the first time. Patients also value the opportunity to speak with a live person. In a 2026 OnePoll survey of 6,000 people across the US, UK and Canada, commissioned by AnswerConnect, 85% stated they would prefer to speak to a real person rather than AI when contacting a business. When a patient is sharing confidential information, having a real person on the other line matters even more.
Getting Started
You don’t need to change everything all at once. Start by documenting what happens today when a patient calls after hours: who answers, what information is collected, and how that information gets to your team. Then compare this current process with the seven questions above. Any gaps will be apparent, along with areas where an outside partner can help.
Let’s Talk About Your After Hours Coverage
At Southern Voices Inc., live human agents answer 24/7/365, never voicemail and never bots. We provide HIPAA compliant medical offices, with greetings and scripts customized for your practice. If you’d like to talk through what coverage could look like for your office, we’d be glad to help.
Visit southernvoices.com or call 800-677-7406.
Frequently Asked Questions
What is a HIPAA compliant answering service?
A HIPAA complaint answering service handles calls and patient information in a way that meets applicable HIPAA requirements. For a medical practice that includes appropriate safeguards for protected health information (PHI), limits on who can access that information, and appropriate agreements between the practice and the answering service.
Does an answering service need a Business Associate Agreement?
If the answering service is a business associate because it handles PHI on behalf of the medical practice, the practice generally needs a Business Associate Agreement (BAA) with that service. The agreement establishes how PHI may be used and disclosed and requires appropriate safeguards.
Can answering services send patient information via email or text?
It depends on how the information is transmitted and the safeguards in place. Medical practices should ask exactly how messages are delivered and whether patient information is sent through ordinary, unsecured text messages or email. The goal is to understand how PHI is protected from unauthorized access or disclosure.
What information can an answering service collect from patients?
An answering service may collect information needed to handle the call and follow the practice’s instructions, such as the patients’ name, contact information, reason for calling, and details needed for a callback. The practice should establish clear guidelines for what agents should collect and what they should not.
How does a medical practice know if an answering service is handling PHI securely?
Ask the provider about its Business Associate Agreement, employee privacy training, access controls, message delivery methods, security practices, and procedures for handling unauthorized disclosures or breaches. A provider should be able to clearly explain how patient information is protected throughout the call handling process.
Recent Comments