Talk to us about a compliant deployment
Start a free trial to explore, and request a BAA before you take live patient calls.
Built by Zuzis LLC for healthcare
When an answering service is a business associate, what its BAA has to say, the safeguards to ask about, and what changes when the answering service is AI. Sourced to HHS and the regulation itself.
The short answer
An answering service that takes patient messages for a practice is a business associate under HIPAA, so it must sign a Business Associate Agreement before handling patient calls and apply the Security Rule's administrative, physical and technical safeguards to what it keeps. It must also sign BAAs with its own subcontractors that touch the data (45 CFR 160.103; HHS Security Rule summary). No government body certifies products as HIPAA compliant (HHS).
That holds whether live operators, an AI answering service, or a hosted voicemail box picks up. The rest of this page goes through each part, ends with a vendor checklist, and explains how Lydoh, a medical answering service, handles it.
Last reviewed October 18, 2026. General information, not legal advice.
Step 1
HIPAA defines a business associate as a person or company that, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information" for a regulated function, other than as a member of its workforce (45 CFR 160.103). An answering service that takes messages from a practice's patients receives and keeps that information on the practice's behalf.
HHS's own list of business associate examples includes an "independent medical transcriptionist," a cloud service provider that stores electronic PHI, and a "third-party vendor Artificial Intelligence (AI) chatbot" that provides services such as "medical reminders, and appointment scheduling" (HHS business associate guidance).
The exception people sometimes reach for is the conduit exception, for carriers like the postal service. HHS limits it to "entities that only provide transmission services," and says entities that access PHI "on a regular or frequent basis to perform a service on behalf of a covered entity are not conduits" (HHS). A vendor that stores PHI is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key" (HHS cloud guidance).
Business associates are also directly liable, not just contractually. HHS lists failures to comply with the Security Rule, impermissible uses and disclosures, failing to limit PHI to the minimum necessary, and failing to sign BAAs with subcontractors among the violations they answer for themselves (HHS direct liability fact sheet).
Step 2
The required terms are set out in 45 CFR 164.504(e)(2). Read any answering service's BAA against this list:
For electronic PHI the BAA must also require the service to comply with the Security Rule and report any security incident it becomes aware of (45 CFR 164.314(a)(2)(i)). If the practice knows of a pattern of activity that materially breaches the BAA, it has to take reasonable steps to cure it and, if that fails, end the contract where feasible (164.504(e)(1)(ii)).
Step 3
Under the HITECH Act, the Security Rule's administrative, physical and technical safeguards apply to business associates "in the same manner" as to covered entities, and the rule is designed to be "flexible, scalable, and technology neutral" (HHS). These questions map to its standards.
Required versus addressable. Risk analysis, risk management and regular review of "audit logs, access reports, and security incident tracking reports" are required (45 CFR 164.308(a)(1)), as are unique user IDs and audit controls (45 CFR 164.312). Encryption is "addressable," which does not mean optional: the service must assess it, implement it if reasonable and appropriate, and otherwise document why and use an equivalent alternative (45 CFR 164.306(d)).
Retention. HIPAA requires Security Rule policies and documentation to be kept for six years (45 CFR 164.316(b)(2)), but that is paperwork, not patient messages. HHS says a business associate is generally not required to keep electronic PHI after it stops providing services, and the BAA must require return or destruction at termination where feasible (HHS). Ask how long the service keeps messages and transcripts, and what happens to them when you leave.
Reading the claims
HHS's Office for Civil Rights says it "does not endorse, certify, or recommend specific technology or products" (HHS). So a vendor's "HIPAA certified" badge is not an official status. What a vendor can honestly offer is a signed BAA, a description of its safeguards, and any independent audit reports it actually has.
Compliance is also shared. The practice is a covered entity with its own duty to keep administrative, technical and physical safeguards for PHI in any form, spoken and paper included (45 CFR 164.530(c)). A vendor's BAA covers the vendor's part, not the whole practice.
AI answering services
An AI answering service is a business associate for the same reason a human one is, and HHS names an AI chatbot that does appointment scheduling as an example (HHS). What's different is the chain behind it. A call to an AI answering service typically passes through a telephony carrier, a speech-to-text engine, a language model and a database. Each company in that chain that creates, receives, maintains or transmits the PHI on the service's behalf is a subcontractor, and a subcontractor is a business associate too (45 CFR 160.103). The service may let a subcontractor handle PHI only with written satisfactory assurances (45 CFR 164.502(e)), and HHS says it "must establish a BAA with its subcontractor before disclosing PHI" (HHS).
Transcripts deserve the same care as charts. HIPAA's definition of health information covers information "oral or recorded in any form or medium," and PHI includes it when kept in electronic media (45 CFR 160.103). A transcript in which a patient gives a name and a reason for calling a practice is identifiable health information.
Questions to add for an AI vendor:
After the call
HIPAA doesn't forbid leaving a message or sending a text, but it expects restraint. HHS says providers may leave messages on a patient's answering machine, but "should take care to limit the amount of information disclosed," for example leaving only the practice's name and number (HHS FAQ 198). For e-mail, HHS says the Privacy Rule "does not prohibit the use of unencrypted e-mail" for treatment-related communications when safeguards such as "limiting the amount or type of information disclosed" are applied (HHS FAQ 570). The same reasoning is the sensible reading for SMS, which is ordinary, not end-to-end encrypted, messaging.
Voicemail that a caller leaves is a different problem: callers say whatever they like, so a hosted voicemail box can end up holding more health detail than any answering service would ask for. If a vendor stores those messages, it is keeping PHI, not just transmitting it (HHS). See how Lydoh's patient texting keeps health details out of texts.
Side by side
| Question | Human answering service | AI answering service | Voicemail |
|---|---|---|---|
| Is the vendor a business associate? | Yes, when it receives or keeps patient messages for the practice. | Yes, on the same definition. HHS names an AI chatbot that schedules appointments as an example. | An answering machine in the office involves no vendor. A hosted voicemail service that stores messages keeps PHI; HHS says storage takes a vendor outside the conduit exception. |
| Who else needs a BAA? | Any software or hosting vendor that stores the service's messages. | Each subcontractor that handles call data: telephony that stores it, speech-to-text, the AI model, hosting. | The voicemail host's own subcontractors that store the audio. |
| What the Security Rule covers | Messages kept electronically. Paper notes still fall under the practice's Privacy Rule safeguards. | Transcripts, summaries and call logs, which are all electronic. | Stored audio files and any transcriptions of them. |
| How much PHI is captured | What the operator writes down, guided by the practice's script. | What the assistant is set up to ask for, plus the transcript of what the caller says. | Whatever the caller chooses to say, unprompted. |
Sources: 45 CFR 160.103, HHS business associate guidance, HHS cloud guidance, HHS Security Rule summary, 45 CFR 164.530(c).
How Lydoh handles it
Lydoh was built by Zuzis LLC for healthcare practices, including dental and chiropractic offices.
FAQ
Three things. The service is a business associate of the practice, because it receives and keeps patient information on the practice's behalf, so it signs a Business Associate Agreement (BAA) before taking patient calls. It applies the HIPAA Security Rule's administrative, physical and technical safeguards to the electronic messages, transcripts and call logs it keeps. And it signs BAAs with its own subcontractors that touch that information. HHS does not certify products, so no service can show a government HIPAA certificate.
Yes, in the usual case. HIPAA defines a business associate as a person or company that creates, receives, maintains or transmits protected health information on behalf of a covered entity. An answering service that takes patient messages for a practice does exactly that. The narrow conduit exception covers transmission-only services like the postal service; HHS says entities that access PHI on a regular basis to perform a service are not conduits.
No. HHS's Office for Civil Rights says it does not endorse, certify, or recommend specific technology or products. A vendor can sign a BAA, describe its safeguards and share third-party audit reports if it has them, but "HIPAA certified" is not an official status. Lydoh does not claim it.
Yes. HIPAA is about how protected health information is handled, not whether a person or software answers. HHS lists a third-party AI chatbot that handles appointment scheduling and medical reminders as an example of a business associate. The AI service signs a BAA with the practice, and every subcontractor that handles the call data, such as speech-to-text, the AI model and hosting, is itself a business associate that needs a BAA with the AI service.
They can be. HIPAA's definition of health information covers information that is oral or recorded in any form, and PHI includes individually identifiable health information kept in electronic media or any other form. A transcript or voicemail in which a patient gives a name and a reason for calling a practice is identifiable health information, so it needs the same safeguards as any other patient record.
Encryption is an "addressable" Security Rule specification, not an optional one. The service must assess whether encryption is reasonable and appropriate, implement it if so, and if not, document why and use an equivalent alternative. In practice, ask any vendor how data is protected in transit and at rest, and get the answer in writing.
Under 45 CFR 164.504(e), the BAA must set the permitted uses and disclosures, bar other uses, require appropriate safeguards and Security Rule compliance, require reporting of improper disclosures and breaches, flow the same terms down to subcontractors, support patient access, amendment and accounting requests, open records to HHS, require return or destruction of PHI at the end of the contract where feasible, and let the practice terminate for a material violation.
A chiropractic or dental office that transmits health information electronically in connection with a HIPAA-covered transaction is a covered entity, and the same business associate rules apply to its answering service as to a medical practice. Lydoh has pages for chiropractic and dental answering, and a BAA is available for eligible practices.
HIPAA permits it with reasonable safeguards. HHS says practices may leave messages on a patient's answering machine but should limit what they disclose, for example leaving only the practice's name and number, and that unencrypted e-mail is not prohibited when the amount or type of information is limited. Lydoh's patient texts never name a medication, test, symptom or visit reason.
Yes. For customers that are covered entities, Lydoh acts as a business associate and will sign a Business Associate Agreement. Request one before you take live patient calls.
Never. Lydoh is a scheduling and information assistant. It answers only from your approved content, directs emergencies to 911, and transfers or escalates anything needing clinical judgment to your staff.
Keep reading
Start a free trial to explore, and request a BAA before you take live patient calls.