HIPAA and privacy
How do we handle HIPAA, BAAs and patient privacy?
For US practices, we sign a Business Associate Agreement, every vendor touching patient data is under a BAA, and patient data stays in US-hosted systems. Automated calls and texts follow TCPA consent rules. For Canadian clinics, we follow PIPEDA, provincial privacy laws and CASL. We never claim to be HIPAA certified, because no such certification exists.
United States
What do we commit to under HIPAA?
- We sign a Business Associate Agreement (BAA).
- Every vendor touching patient data is under a BAA.
- Patient data stays in US-hosted systems.
- Data is used only to provide the service, never to train general AI models.
- Recording and retention are set per practice, and kept to what you need.
- Access is limited to the people who need it.
What about TCPA?
The Telephone Consumer Protection Act governs automated calls and texts. We check consent before reminders and reactivation messages, include opt-out instructions, and honor opt-outs immediately.
Canada
How do we handle Canadian privacy law?
We handle personal health information in line with PIPEDA and provincial privacy laws (such as BC and Alberta PIPA and Ontario PHIPA), and only send texts or emails with consent under CASL.
- Collect only the information needed to book and follow up.
- Consent checked before any commercial electronic message.
- Clear opt-out on every message.
- No clinical notes, ever.
[CONFIRM: Canadian data-hosting option]
Canada hubWhat should you ask any automation vendor about privacy?
| Question | Our answer |
|---|---|
| Will you sign a BAA? | Yes, before any patient data is processed. |
| Are all subprocessors under a BAA? | Yes. We share the list during your audit. |
| Where is data hosted? | US-hosted systems for US practices. Canadian option: [CONFIRM]. |
| Is data used for AI training? | No. |
| Do you access clinical notes? | No. |
| Can patients reach a person? | Always. |
Deeper reading: Is an AI phone agent HIPAA compliant? What a BAA covers. See also our AI receptionist and website privacy policy. This page is general information, not legal advice.
Straight answers
Privacy questions
Are you HIPAA certified?
No one is. The US government does not certify products or vendors as HIPAA compliant. We sign a BAA, keep every vendor touching patient data under a BAA, and keep patient data in US-hosted systems.
Will you sign our BAA or do you have your own?
We have a standard BAA and will review yours. Either way, a BAA is signed before any patient call reaches our systems.
Do you use patient data to train AI models?
No. Patient data is used only to provide the service to your practice.
How do you handle TCPA for texts and calls?
We check consent records before reminders or reactivation messages, include opt-out on every text, and honor opt-outs immediately.
Do you access clinical notes?
No. We do not do clinical charting, AI scribes or clinical decision-making, so we never need access to clinical notes.
What about Canadian clinics?
We handle personal health information in line with PIPEDA and provincial privacy laws, such as BC and Alberta PIPA and Ontario PHIPA, and send commercial messages only with consent under CASL.
Free practice audit
Find out what missed calls and lost sessions are costing you.
Free audit, no commitment. We test your phones at busy times and show you the numbers.