Answering Service HIPAA Compliance: What It Takes

When someone types answering service hipaa into Google, they are asking one practical question: will this vendor protect patient information the way federal law requires? That question matters because every call to a medical or dental office carries protected health information, a name, a date of birth, a reason for calling. We run Amy, Valian's voice assistant, for practices that ask this question every day. Here is what the law actually requires, what a Business Associate Agreement needs to say, and what to check before you sign with any answering service, ours or anyone else's.

A HIPAA compliant answering service is a vendor that signs a Business Associate Agreement (BAA) with a medical or dental practice, encrypts every call recording and message, and limits who inside the vendor can see patient names, dates of birth, and reasons for calling. The Health Insurance Portability and Accountability Act requires a signed BAA before any outside vendor can handle protected health information on a practice's behalf. A compliant service stores call logs and voicemails in encrypted systems, trains every person who might hear a call on privacy rules, and gives the practice a way to see who accessed a patient record and when. Without a signed BAA, the practice carries the liability for any mishandled patient information, even when the vendor caused the problem. A friend answering the office phone from a personal cell is not HIPAA compliant. A texting app with no BAA in place is not either. The signed agreement, the encryption, and the access controls are what make the difference, not a badge on a website.

The short answer: a signed Business Associate Agreement, encryption on every call recording and message, and access controls that limit who can see patient data. HIPAA does not require an answering service to use any particular software or any particular phone system. It requires administrative, physical, and technical safeguards around protected health information, and it requires a BAA naming the vendor as a business associate before that vendor touches a single patient record.

A live answering service meets this bar the same way a voice assistant does: training on what can and cannot be said in a message, a secure system for storing call logs, and a signed agreement that spells out what happens if something goes wrong. The format of the service, human operators in a call center or a voice assistant on the phone, does not change the requirement. What changes is how the practice verifies it. Ask for the BAA in writing. Ask where call recordings are stored and for how long. Ask who at the vendor can open a call log and see a patient's name.

A Business Associate Agreement is a contract, not a marketing claim. It should state in plain terms what patient information the vendor will see or store, how the vendor will protect that information, what the vendor will do if there is a breach, and when the vendor must notify the practice. The agreement should also say how long call recordings and messages are kept, and what happens to that data if the practice ever switches vendors.

A website badge that says "HIPAA compliant" is not a substitute for the signed document. We send every new office a copy of our BAA before they ever put us on their phone line, and we keep it on file. If a vendor cannot produce a signed BAA on request, that is the answer to the question, regardless of what the sales page says.

Amy answers every call, 24 hours a day, under a signed BAA. She asks for the reason for the call, collects the caller's name and number, and books into the practice's Valian schedule. The front desk team then enters that appointment into the practice management system the next morning, the same way they would from a paper message slip, just without the slip.

Amy does not replace the people at the front desk. She answers the calls that would otherwise go to voicemail: the lunch hour call, the call at 7pm from a patient who just had a crown come loose, the call that comes in while the team is already on another line. See everything Amy does on a call, and how each kind of call gets routed, from a new patient inquiry to a prescription refill request sent to the clinical team.

For clinical questions, Amy does not give medical advice. She takes the message and routes it to the practice, the same as a live operator would with a script. Every call is logged, every log is encrypted, and the practice can see a transcript the next morning.

Voicemail is not automatically HIPAA compliant just because it is private. A voicemail box that any staff member can access from a shared phone, with no password and no audit trail, is a weak point. The safer setup is a system that logs who listened to a message and when, encrypts the recording, and limits playback to the people who need to know.

Texting carries the same requirement. A personal cell phone texting a patient about test results or a treatment plan is not HIPAA compliant on its own. Two-way texting through a system covered by a signed BAA, with messages stored in an encrypted record tied to the patient's file, meets the requirement. The rule is the same across every format: encryption, access limits, and a signed agreement naming the vendor as a business associate.

Pricing varies by call volume, hours of coverage, and whether the service is a live call center or a voice assistant. A live, 24/7 human answering service typically charges per minute or per call, and the bill grows with call volume. A voice assistant like Amy is priced as a monthly plan per location, sized to the practice, because the hours of coverage do not change the bill the way per-minute pricing does.

We cover what a dental answering service costs in 2026 in detail, including the line items to ask about before you sign: setup fees, minimum call volumes, and what happens to the price when call volume goes up in flu season or after a marketing push.

Most practices lose calls outside business hours: nights, weekends, lunch, and the gap between when the last patient leaves and when the office actually locks the door. An after-hours answering service for medical offices exists to catch exactly those calls, whether that service is a live operator or a voice assistant answering under a BAA.

Run the math on your own numbers: if your office gets even 5 calls a week after hours, that is 5 calls going to voicemail, a busy signal, or a competitor's office if the caller gives up and tries somewhere else. A HIPAA compliant answering service that covers those hours turns that into 5 logged calls with a message or a booked visit waiting in the morning.

Before you sign with any vendor, run your own version of an answering service hipaa search and skip past the review stars. Ask these questions directly: Will you sign a BAA before go-live? Where are call recordings stored, and who can access them? What happens to our call data if we cancel? Does your pricing change with call volume, and by how much?

We wrote a longer breakdown of what a HIPAA compliant answering service needs to cover before signing, and a side-by-side look at how a voice assistant compares to a traditional answering service if you are deciding between a live call center and an automated one. Either format can be compliant. Neither format is compliant by default.

If you want to see how Amy answers calls under a signed BAA, with every log encrypted and every transcript available the next morning, you can book a short walkthrough and bring your own call volume numbers to the call.

Do answering services still exist?

Yes. Live, human answering services still operate across medical and dental offices, usually priced per minute or per call. Voice assistants like Amy are a newer option that answer every call around the clock under the same HIPAA requirements. Both formats are common today, and the choice usually comes down to call volume and budget.

Are voicemails HIPAA compliant?

A voicemail system is HIPAA compliant only when it is covered by a signed BAA, encrypts stored messages, and limits who can access the box. A shared voicemail with no password or access log is a risk, not a safeguard. The system matters more than the fact that it is "just a voicemail."

What is the difference between an answering service and an answering machine?

An answering machine records a message and stops there. An answering service, whether live or a voice assistant, can ask questions, collect the reason for the call, and in some cases book a visit. Any message left on either one is still protected health information the moment a patient states their name and reason for calling.

How much does an answering service typically cost?

Live answering services typically bill per minute or per call, so the price moves with call volume. A voice assistant is usually billed as a flat monthly plan per location instead. Ask any vendor for the full rate sheet, not just the headline number, before you compare the two.