HIPAA-Compliant Medical Answering Service

As their client, you can simply phone your current call center and ask. But first, get informed about the regulations relevant to every medical answering service. 

– Who is your HIPAA Compliance Officer? 
– Are customer service agents trained in HIPAA / HITECH / OMNIBUS? 
– When was the last documented training and how often is the training renewed? 
– Is your e-mail and text solution secure with encryption and password protection? 
– Does your medical office use Windows XP or any earlier version of Windows? 
– Does your answering service software have the ability to audit logins in real-time and block unauthorized users to prevent PHI breaches? 
– What physical security measures are in place to protect medical information? 
– Will you sign our Business Associate Agreement? 
– Are you properly storing, transmitting, and destroying all messages as required by the Health Insurance Portability and Accountability Act?   

If your current answering service does not have an immediate answer to the questions above then we suggest looking for a new HIPAA-compliant medical answering service. As the covered entity, you must make sure that the answering service is HIPAA compliant or risk violations, fines, and possible criminal charges.  

Based upon HHS requirements and documented fines from PHI breaches, you are exposing your business to hefty fines and/or criminal charges. Penalties depend on the extent of the breach and if there is evidence of willful neglect. Violations put patient data at risk and there can be other expensive liability issues that result. Of course, news of HIPAA violations damages the reputation of healthcare entities and may negatively impact stakeholders’ and patients’ decisions in the future. 

No. Any traditional method like paging is not secure for transmitting PHI, therefore NOT HIPAA compliant. This is due to the lack of encryption and password protection. Any transmitted patient name or phone number – even for the purpose of appointment scheduling – that could be linked with medical relevance is considered PHI and needs the proper protections defined by HIPAA. 

Yes. Your medical office is defined as the covered entity. A live answering service is a business associate hired to capture protected health information and to store and transmit it digitally, which is defined as ePHI. HIPPA privacy and security rules outline specific requirements for handling and transmitting ePHI.  

Therefore, all medical answering services that store and transmit PHI and ePHI must comply with HIPAA regulations and customer service agents must be trained to follow HIPAA compliance policies.  It is also the responsibility of your organization to perform a risk analysis of your current answering service to identify possible HIPAA violations and vulnerable breach points.