Do I need a BAA with an answering service?
- The short answer
- A business associate agreement (BAA) with an answering service is needed when two things are true. Your practice is a HIPAA covered entity, and the service creates, receives, keeps or passes on patient health information for you. A dental office whose calls include appointment reasons meets both tests. A roofer or a hair salon meets neither.
The longer answer
HIPAA only reaches covered entities and the vendors working for them. Covered entities are health plans, clearinghouses and healthcare providers who bill electronically, as defined in 45 CFR 160.103.
A vendor becomes a business associate when it handles protected health information on your behalf. An answering service that writes down a patient's name next to "needs a crown looked at" is handling it.
Rules in 45 CFR 164.502(e) and 164.504(e) say a covered entity may share that information with a business associate only under a written agreement. The agreement spells out what the vendor may do with the data and how it must protect it.
Two tests that decide whether you need one
Ask first whether HIPAA covers your business at all. Clinics, dentists, therapists and most practices that bill insurance are in. A salon, a contractor or a property manager is out, even when a caller mentions a health detail.
Next, ask what the service touches. A phone carrier that only moves the call is treated as a conduit by HHS. A service that hears, records or writes down what the patient says is doing more than carrying the line.
If both answers are yes, get the agreement in writing before the first patient call. Read who it covers too. An AI answering service relies on speech, language and telephony vendors, and each one hears the same audio.
Keep a copy with your other HIPAA records. Your practice stays the covered entity whichever vendor answers the phone.
How GreetKeeper handles it
GreetKeeper asks only the intake questions you set. A practice can keep calls to a name, a callback number and a reason, and leave clinical detail for the chart.
Recording is a setting you control, paired with a disclosure the caller hears. Utah's AI Policy Act asks medical and other regulated occupations to disclose AI verbally at the start of a call, and GreetKeeper's disclosure setting says it on every call.
Each number can carry its own greeting, so a front desk line and an after-hours line can sound right for each. Every call arrives as a transcript and a short summary, which shows you exactly what was captured. You can test all of it with the 14-day free trial.
BAA questions practices ask
Does a small practice need a BAA with its answering service?
Size makes no difference. A solo dentist who bills insurance electronically is a covered entity, and so is a 40-chair group. If the service handles patient information for you, the agreement comes first.
What should a business associate agreement cover?
It names the patient information the vendor may use and what for. It also sets the safeguards, the breach reporting duty, and the return or deletion of data when the contract ends. Rules in 45 CFR 164.504(e) list the required terms.
Do non-medical businesses need a BAA for call answering?
Almost never. A plumber, a salon or a landlord is outside HIPAA, so no business associate agreement is needed. Their duties come from other rules, such as Maine's §1500-DD notice when an AI answers.
Hear it take one of your calls
Two minutes, your own scenario, no card.