An answering service meets HIPAA compliance if it sets in place business associate agreement (BAA) with your practice and protects all the messages entrusted to it. It doesn't matter what kind of service you use. HIPAA applies to vendors that handle protected health information (PHI).

According to HHS guidance, you can disclose PHI to a business associate once you receive "satisfactory assurances" they will protect that information. Typically, this will be in the form of a written BAA. Your answering service would be bound to this agreement for any messages they receive.

 

Does an answering service count as a business associate?

Yes, if they're managing and transmitting PHI for your practice. The HHS notes they are a business associate because they are performing this task. If an operator records a patient's identifying details and the purpose of their contact, they are a business associate.

There are two exceptions. One is the conduit exception, which applies to the postal service. They're handling the transmission of PHI and might hold onto it briefly. The HHS notes if an entity is accessing PHI on a regular or frequent basis to provide a service, they are not considered a conduit. The second exception is if you are disclosing information to another health care provider for treatment purposes. An answering service would not fall under this exception. Let's say you have a cardiology office and want patients to call your answering service after hours to ask about their stress test. Since your answering service will be hearing the patient's name and asking about their stress test results, they should have a BAA in place.

 

What must the agreement cover?

Your BAA should outline what uses and disclosures are allowed and required. Any alternative use or disclosure should not be permitted. They should agree to comply with the Security Rule as well as their subcontractors. They will also need to notify you of any security incidents including breaches of unsecured PHI. For an answering service, you'd want them to be able to relay messages to you and record calls. You can also state how quickly they will report any incidents to you so you can determine if it's a breach under the Breach Notification Rule.

 

Which parts of a call contain PHI?

A study featured in the Journal of the American Board of Family Medicine collected all calls directed to an answering service for a full year. There were 4,949 calls taken by the answering service for a family medicine residency office in Denver. They noted the date and time of the call, the caller's name and the patient's name, which provider they saw if they were pregnant, when they last came to the office, and what the patient's chief complaint was. Then they faxed the information to the office the following morning. All of this information would be considered PHI because it can identify the patient.

 

How should the service send messages to your team?

In an FAQ, the HHS states that you can email your patients as long as you have reasonable safeguards in place. For example, make sure you have the correct email address and only send certain information. They also tell you, as a covered entity, to follow the Security Rule when transmitting electronic PHI (ePHI). Since this is talking about emailing your patients, you would want to make sure your answering service has safeguards in place to follow the Security Rule.

If you want to receive your answering service messages by email, you can use Paubox Email Suite. Our plans will encrypt your outbound emails so your recipient can reply to you easily. There's no need for a portal login or password. With our Plus plan, you can also transcribe voicemails and any audio attachments. This will help keep your practice protected when receiving and replying to these emails. But remember you still need to have a BAA in place with your answering service.

Read also: HIPAA compliant voicemail transcription via email

 

When do patient contact preferences apply?

Under the Privacy Rule, patients have the right to request communication with you by an alternate method or at a different location. Be sure to let your answering service know when a patient requests their information be delivered to a different address than their home.

Maybe a patient sees you for a dermatology appointment and wants to be contacted about their biopsy results at work. You can note this in your script for your answering service. You can also assume a patient is okay with you emailing them if they initiate the conversation through email according to the HHS FAQ.

 

Who else needs an agreement?

Your business associate will need to have a BAA in place with any subcontractors they may use before disclosing PHI to them. You don’t need to have a BAA with these subcontractors. If your answering service sends your calls to another company to be transcribed they would need a BAA in place.

The HHS gave an example of using an AI chat bot on your patients portal to answer questions about symptoms, provide reminders and schedule appointments. They stated this would be considered a business associate. While this may not apply to an AI that answers your phone lines it is similar to what an AI could do for your practice. Be sure to ask your answering service if they use any subcontractors or AI to transcribe or listen to your calls.

 

What does a signed agreement not establish?

Having a BAA in place with your answering service will not guarantee that they are forwarding the appropriate calls or have your email secure. You’re expected to take reasonable action to resolve a material breach upon discovery, and terminate the agreement if you cannot. You should always be monitoring your vendor.

As we know from the study earlier, the answering service was only forwarding calls that the patient deemed an emergency. Of the 119 patients with complete information, 3% were harmed, and 26% experienced continued pain due to their delay. There was no control group, and many of the patients' charts were missing. Another Journal of General Internal Medicine study looked at 32 phone-related malpractice claims and found that 38% had no telephone policy in place. They attributed this to missed messages. Again, this study had a small sample size and was considered preliminary.

 

FAQs

Does HIPAA require a specific process for verifying callers?

HIPAA does not prescribe a fixed verification script. When a patient requests their information and their identity is unknown, reasonable verification is required.

 

Can an answering service take a message from a patient’s family member?

Yes, HIPAA does not prevent providers from listening to concerns from relatives or caregivers. An answering service can therefore take a message for the practice without sharing information in return.

 

How long should an answering service keep call recordings?

HIPAA does not establish a general retention period for patient call recordings. The practice should set a schedule that accounts for applicable state recordkeeping laws and other retention obligations. HIPAA’s six-year requirement applies to specified compliance documentation; it does not mean every patient call must be saved for six years.