Last updated: September 12, 2026
What follows summarizes federal regulation and normal practice in this market. Your own counsel decides what applies to your contracts.
What a HIPAA compliant answering service means
No federal agency certifies an answering service as HIPAA compliant. A service answering calls for a medical practice generally acts as a business associate under a signed agreement, and what counts is how it handles protected information day to day. Ask for the agreement, the access controls, and the retention terms in writing.
An answering service sits in a position almost nobody else in this market occupies. A practice is one covered entity with one set of obligations. A service answering for thirty practices is a business associate thirty times over, under thirty agreements, with thirty sets of account instructions in the same console.
One operator crosses all of it in a shift. She takes a dermatology call at 9:14, a plumbing dispatch at 9:15, and an orthopedic group's on-call escalation at 9:17, and two of those three carry obligations from a signed agreement. That is the real compliance surface: a person switching context every forty five seconds, working from whichever account script the board hands her next.
Most of the market answers the compliance question with a badge instead. No federal body certifies a service or a piece of software as HIPAA compliant, and HHS has said it neither endorses nor recognizes private certifications here. Reading a vendor's compliance page first is a reasonable instinct, since a service that has thought about this usually says something specific on it. The page still cannot stand in for the agreement, which is where the legal weight sits.
The business associate relationship
45 CFR 160.103 defines a business associate as a person who, on behalf of a covered entity, creates, receives, maintains, or transmits protected health information for a function the rule regulates. Claims processing, data analysis, utilization review, quality assurance, and practice management are named in the text. A service taking patient calls in a practice's business name, and writing the message that practice acts on at 6 a.m., lands inside that without much argument.
The agreement is what the rule asks for next. Under 45 CFR 164.502(e)(1)(i) a covered entity may disclose protected health information to a business associate once it "obtains satisfactory assurance that the business associate will appropriately safeguard the information," and 164.502(e)(2) requires that assurance to be documented in a written contract meeting 164.504(e). That section sets what the contract carries: use limited to what it permits, appropriate safeguards, reporting of any use or disclosure it does not provide for including breaches of unsecured protected health information, subcontractors bound to the same conditions, and return or destruction of the information at termination where feasible.
Read the first of those terms again with a board of thirty accounts in mind. Permitted uses come from each contract separately, so the dermatology group's agreement decides what your floor may do with a dermatology caller's information, and the orthopedic group's agreement settles the same question on its own terms. Two accounts, two answers, one operator, and a supervisor who has to know which is which at 2 a.m.
Say you answer for 14 medical accounts inside a book of 90, and those 14 send 1,100 calls a month between them. Hold the audio a year and the medical slice alone is roughly 13,200 recordings governed by 14 different agreements, each with its own permitted uses and termination clause. They sit in one archive with the HVAC and the law firm calls, because no phone platform ships a filing cabinet shaped like your contracts.
Anybody you hand that audio to sits downstream of you, since 45 CFR 164.502(e)(1)(ii) extends the same requirement to a subcontractor of a business associate.
What to ask a service before you sign
Six questions, in the words a practice manager would use. The mirror version, the questions a service asks its own recording and scoring vendors, sits on HIPAA and call recording.
- Will you sign a business associate agreement, and who at your company signs it?
- Which of your people can open a message on our account, and under what role?
- How long do you keep messages and recordings, and what does deletion actually remove?
- Which subcontractors touch our calls, and where does the audio sit?
- How quickly do you notify us of a use or disclosure your contract does not permit?
- What happens to our recordings when we leave you?
A service that has answered these before answers them in about a minute, which is a fair signal by itself.
Where the recordings live
You want a named environment rather than a shrug about the cloud. Recordings pooled in shared storage with other services' calls carry a different risk from a silo, and the gap grows once a year of history piles up in there.
Buyers skip the path the audio takes while it is being worked on. Transcription and scoring move the file somewhere, and most products in this category call a public model API to do it, which puts a caller's name and the reason she phoned a doctor into a third party system under that provider's terms. Ask which vendors sit in that path and whether each one signed. Ours is where call audio is processed.
Who inside the service can hear a call
45 CFR 164.502(b)(1) puts the minimum necessary standard on the business associate as well as the practice, in the same sentence. So the answer you want covers roles rather than headcount: who holds a supervisor login, whether it reaches every account or only the ones they own, and whether an admin role got handed to nine people because reading the permissions page took too long.
Access logging belongs in the same conversation and is genuinely hard for a buyer to verify from the outside. Put the answer in the agreement rather than taking it off a sales call.
What operators should be able to show you
A policy tells you that operators verify identity before discussing anything clinical. A scored call tells you whether it happened on the 38 calls your practice sent last Tuesday, with a timestamp you can open.
Medical accounts ask the hardest questions during procurement, and a service answering with its own scored calls, graded against the script that practice approved, is in a different conversation than a brochure starts. The criteria live in the answering service scorecard, where identity verification and the callback number read back digit by digit both carry weight. A practice mid evaluation wants the rest of the checklist too, which is how to evaluate an answering service.
Scoring runs per account, so the dermatology group sees its own calls against its own instructions rather than a floor average blended with plumbing dispatches.
How a service handles a call where identity was not established
A caller phones at 9:40 p.m. about her mother's test results and gives a name the account script does not recognize. That account's instructions say take a message with a callback number and dispatch nothing to the on-call physician unless the caller is the patient herself.
What happens next splits two ways. The operator follows that and writes the message, or she fills an uncomfortable silence, reads back a detail sitting in the account's file, and turns a triage question into a disclosure. Option two takes four seconds and sounds helpful while it is happening.
On a scorecard it is a critical fail rather than a point deduction, so it reaches a supervisor the same day instead of a monthly average. Which is also the limit of the instrument: the criterion checks whether the operator followed that account's identity instructions and says nothing about whether the instructions were any good. A vague verification rule fails every operator, and the fix is a call with the practice.
Machine scoring holds up on the rule shaped half of that, and Aircall and StackAI both note the same split, since "was the verification question asked" compares a transcript against a known string. Whether an operator's read of an agitated caller was reasonable needs a person, and we would rather write that down than sell you a confidence number for it.
Where CallSniper sits in this
Trinsic typically requires a business associate agreement with each CallSniper customer, because recorded calls can carry protected health information. Call audio stays inside Trinsic's own cloud, the model doing the transcription and scoring is Trinsic's, it runs on CPU in that same environment, and no public model sits anywhere in the path.
Users are scoped by role across Agent, Supervisor, and Admin, so a supervisor works inside the accounts they own instead of the whole archive.
CallSniper is not HIPAA certified, and no such thing exists to be. SOC 2 is not a claim this page makes either. What we put in writing is the agreement, where the audio lives, and who can open it.
The three documents a practice will ask you for
Procurement for a medical account comes down to paper. A practice manager or a compliance officer asks for three documents, and the services that win those accounts have all three in a folder before the call.
First is the business associate agreement, with a subcontractor clause and a termination clause somebody can actually read. Then an access policy naming the roles that can open a message or a recording on that account, and a retention schedule stating how long audio is held and what deletion removes.
Have a fourth thing ready that nobody asks for: a sample quality report on one account, identifiers replaced, showing calls scored against that account's own script with the auto fails listed. It answers what sits underneath all three documents, which is whether anybody at your service has looked at how these calls get handled. QA for telephone answering services is where that gets built.
A call review runs your own historical audio for two accounts against the scripts you approved, and costs a fixed pilot price.
Frequently asked questions
Is my answering service HIPAA compliant?
No certification exists that would answer it, so the question turns into two others: did the service sign a business associate agreement with your practice, and what does it do with your callers' information. Ask for the agreement, the roles that can open a message, and the retention terms in writing. A badge on a website is not evidence about either one.
Do answering services need a BAA?
Where the service handles protected health information on behalf of your practice, yes. 45 CFR 164.502(e)(1)(i) lets a covered entity disclose that information once it obtains satisfactory assurance the business associate will safeguard it, and 164.502(e)(2) requires the assurance to be documented in a written contract meeting 164.504(e). Vendors the service brings in sit downstream as subcontractors on the same terms.
What happens if an answering service violates HIPAA?
Responsibility follows the agreement. A business associate is directly obligated under the rules and has to report any use or disclosure its contract does not permit to the covered entity, including breaches of unsecured protected health information. What happens after that depends on the contract and on enforcement decisions outside this page's scope, so take it to counsel.
Can an answering service record calls with patient information?
Yes, and the recording carries the same obligations the message does once it holds patient information. HIPAA neither requires nor forbids recording, so what matters is where the audio sits, who can open it, and whether every company touching it signed. Announcing the recording is a separate question under state wiretap law.
What should be in an answering service BAA?
45 CFR 164.504(e) sets the floor: permitted uses and disclosures, appropriate safeguards, reporting of unpermitted use or disclosure, subcontractors bound to the same conditions, and return or destruction at termination where feasible. Your counsel drafts it and decides what else your practice needs in there.
Sources
- 45 CFR 160.103, definitions of business associate and covered entity. Read via Cornell LII on 2026-09-12. Confirm on eCFR before publish.
- 45 CFR 164.502(b)(1), minimum necessary applied to covered entities and business associates. Cornell LII, 2026-09-12.
- 45 CFR 164.502(e)(1)(i), (e)(1)(ii), and (e)(2), satisfactory assurance and its documentation. Cornell LII, 2026-09-12.
- 45 CFR 164.504(e), required business associate contract terms. Cornell LII, 2026-09-12.
- HHS FAQ stating that the department does not endorse or recognize private certifications of Security Rule compliance. Located by search on 2026-09-12, page not retrieved because hhs.gov returned an error. Wording unverified.
- Trinsic feature sheet and call notes, 2026-08-27 through 2026-09-10. Verified internally, with role based access conflicting between the two.
- callsniper.ai datacenter line, read 2026-09-12. Conflicts with this page and is flagged for the editor.
- Aircall and StackAI on rule based criteria scoring more reliably than tone. Third party, unverified.