Why this matters now

Telehealth and patient texting have pulled the phone system deeper into clinical workflow than it used to be. Front desks confirm appointments and relay results by text, AI-generated voicemail transcripts land in inboxes, and virtual visits route through the same UCaaS platform used for ordinary business calls. Every one of those is a new place PHI can sit outside your EHR's controls.

OCR enforcement has also kept moving toward smaller practices, not just hospital systems. Settlements increasingly cite missing or informal BAAs, not just breaches themselves, meaning a practice can be found non-compliant even before anything leaks. A phone system nobody thought to check is one of the most common gaps auditors find.

Is your phone system in scope?

The test is the same one HIPAA applies everywhere: does PHI get created, received, maintained, or transmitted through the platform? Walk through where it actually shows up in a phone system:

• Patient calls. Scheduling, billing, and clinical calls where diagnosis, treatment, or condition come up are transmitting PHI live through the platform.
• Voicemail and AI transcription. A voicemail naming a patient and a result is PHI at rest with the provider, and automatic transcription turns it into searchable text.
• Patient text messaging. Appointment reminders that include a patient's name and reason for visit, or any two-way texting with patients, puts PHI in the provider's message store.
• Call recording. Recorded calls that touch clinical or billing detail are PHI your provider now stores indefinitely unless retention is configured.
• IVR and contact center flows. Any menu or agent screen that captures date of birth, member ID, or reason for calling is collecting PHI, including third-party answering services.
• Fax. Cloud fax of referrals, lab orders, or prior authorizations is still one of the most common overlooked PHI flows in smaller practices.

If any of those happen on your phone system today, and they almost always do somewhere, the platform is a business associate and needs a BAA in place.

What a BAA actually requires from your provider

A Business Associate Agreement is a contract, not a checkbox. Signing one obligates the vendor to safeguard PHI the way HIPAA's Security and Privacy Rules require, and it makes the vendor directly liable for its own compliance failures rather than leaving all the risk with your practice. Providers that offer a BAA typically back it with encryption in transit and at rest, access controls and audit logging, configurable retention and deletion for recordings and voicemail, and a signed agreement covering breach notification timelines.

None of this is optional and none of it is standardized by a government certification body. HHS does not run a "HIPAA certified" program for software vendors. When a pricing page says "HIPAA compliant," it means the vendor will execute a BAA and has built the controls to support it, and your practice still has to configure retention, restrict who can text patients, and train staff on what not to say in an unencrypted channel.

Which providers offer a BAA, and at what tier

Coverage is common but uneven. Several vendors include HIPAA support at every plan level; others hold it back for a higher tier, which matters if you were planning to buy the entry-level plan.

Always confirm current BAA availability directly with the provider before signing, since tier structures and included compliance features change between contract renewals.

What else to check beyond the BAA

• Patient texting rules. Two-way SMS with patients needs a compliant workflow, not just a HIPAA-eligible voice plan; confirm texting is explicitly covered under the same BAA.
• Recording and transcript retention. Set retention windows deliberately rather than leaving recordings and AI transcripts to accumulate indefinitely with PHI inside them.
• Access controls. Role-based permissions so voicemail, recordings, and transcripts are visible only to staff who need them, with an audit trail of who accessed what.
• Minimum necessary. Front-desk and billing lines usually need less access to clinical detail than provider lines; segment permissions accordingly rather than giving every extension the same visibility.
• Answering services and third parties. Any after-hours answering service or virtual receptionist that handles patient calls is its own business associate and needs its own BAA.

Three realistic paths

Our view

The mistake we see most often is not picking the wrong provider, it is skipping the BAA conversation entirely because the plan "supports HIPAA" on paper. Confirm the BAA gets signed, not just that the feature exists. After that, the tier question is usually straightforward once you map which lines actually touch PHI and which don't.

Wholesale pricing applies to HIPAA-eligible tiers the same as any other plan. Providers price the compliance tier at a premium over entry-level, but you should not be paying list rate for it.