Security · HIPAA

HIPAA and Business Associate Agreements

An AI receptionist that handles patient calls processes protected health information. That makes the vendor a business associate — and a Business Associate Agreement the starting point, not an upgrade.

Hear it answer — call our AI receptionist(450) 367-9990

Last updated October 7, 2026

When is an AI receptionist HIPAA compliant?

Only if the vendor signs a Business Associate Agreement covering every layer that touches patient information — platform, speech recognition, voice and telephony. “HIPAA-friendly,” or a BAA gated behind an enterprise plan, doesn’t meet the standard.

We sign at onboarding, before your first call. Our BAA covers every subprocessor involved in handling your data.

What our BAA and safeguards cover

Every subprocessor in the call path: platform, speech recognition, voice generation and telephony
Data stored in the United States or Canada, specified in the contract
Encryption at rest, with retention you choose up to 30 days and verifiable deletion
Role-based access to recordings and transcripts, with every access logged and exportable
No use of call data to train models — written into the agreement
Complete export and deletion within 30 days, confirmed in writing, if you leave

What stays with your practice

A BAA doesn’t move your own HIPAA obligations to the vendor. Your practice still decides who on your team can access call records, how long they’re kept and how patient requests are handled. The AI receptionist never makes clinical decisions: it records what callers say and routes calls by your rules, and directs anyone describing an emergency to 911.

This page explains how 365vox approaches HIPAA. It isn’t legal advice — talk to your compliance advisor about your practice’s obligations.

HIPAA FAQs

Do you sign a Business Associate Agreement?

Yes, during onboarding and before your first call, covering every subprocessor.

Is the BAA only on an enterprise plan?

No. There are no plans or tiers — every customer gets the same product, BAA included.

Which parts of the service does the BAA cover?

Every layer that touches patient information: platform, speech recognition, voice and telephony.

Where is protected health information stored?

In the United States or Canada, whichever you choose, specified in the contract.

Can we set how long recordings are kept?

Yes. You choose the retention period, up to 30 days, and deletion can be verified.

Is PHI used to train AI models?

No. That’s written into the agreement.

Does the AI receptionist give medical advice?

No. It records what callers say and routes calls by your rules. Emergencies are directed to 911.

Does signing a BAA make our practice compliant?

It’s one requirement. Your practice keeps its own HIPAA obligations for access, policies and patient rights.

Your front desk is open 40 hours a week. Your business never closes.

No credit card required. Cancel anytime.Just forward your phone line — we'll handle the rest.

Or hear it first — call our AI receptionist(450) 367-9990

Not ready to start your free trial? Book a no-obligation discovery call.