What a BAA should cover with an AI receptionist

When considering an AI receptionist for your dental or medical practice, ensuring HIPAA compliance is critical. A Business Associate Agreement (BAA) is the cornerstone of this compliance, outlining how patient information is handled securely. Here's what to look for in a BAA with an AI receptionist vendor.

Why a BAA matters

A BAA is a legal contract between your practice and a vendor handling patient data. It ensures that the vendor complies with HIPAA regulations, protecting sensitive information like names, phone numbers, and reasons for appointments. Without a BAA, your practice could be exposed to legal risks if patient data is mishandled.

For AI receptionist services, the BAA should cover every aspect of data handling, from call recordings and transcripts to text communications. Each step must meet HIPAA's requirements for privacy and security.

Key elements to include

• Call handling: The agreement should specify how calls are answered and what information is collected. For example, Catchsera captures only essential details like caller name, callback number, and reason for the call.
• Recordings and transcripts: If calls are recorded, the BAA must ensure they are encrypted and stored securely. In Massachusetts, all-party consent is required, and Catchsera informs callers when recording.
• Text communication: Texts must be HIPAA-compliant, avoiding health details and using secure links for sensitive information. Catchsera sends texts only after caller consent and ensures they are encrypted.
• Data storage: All data, including call summaries and transcripts, should be encrypted both in transit and at rest. Catchsera uses Microsoft Azure for secure hosting.
• Access controls: The vendor should implement two-factor authentication, role-based access, and an audit trail to monitor data use.

Keeping sensitive details off the phone

A compliant AI receptionist avoids asking for sensitive information like dates of birth or Social Security numbers over the phone. Instead, secure methods should be used for collecting these details. Catchsera sends a one-time secure form link via text, but only after the caller agrees during the call. This approach minimizes risks while maintaining efficiency.

Additionally, texts should never include health-related information. This ensures that even if a message is intercepted, no sensitive data is exposed.

Questions to ask your vendor

Before signing a BAA, ask the vendor these important questions:

• Do you sign a BAA with every practice?
• How do you ensure HIPAA compliance for calls, recordings, and texts?
• What encryption methods do you use for data storage and transmission?
• How do you handle sensitive information like dates of birth?
• Can I access call summaries and transcripts securely?

These questions help you evaluate whether the vendor takes patient privacy seriously and meets HIPAA standards.

Catchsera: HIPAA-compliant AI receptionist

Catchsera is a HIPAA-compliant AI voice receptionist designed for dental and medical offices. It answers calls 24/7, capturing essential details and answering common questions in English or Spanish. Sensitive information is never requested over the phone, and secure links are sent only with caller consent.

Plans start at $129 per month, and every practice receives a signed Business Associate Agreement (BAA). Catchsera uses encrypted data storage, two-factor authentication, and role-based access to protect patient information.

Setup is simple, taking under 10 minutes on your end. Calls forward to Catchsera, and your staff can review summaries and transcripts via a live dashboard.

Common questions

What is a BAA?

A Business Associate Agreement (BAA) is a legal contract ensuring HIPAA compliance between a healthcare provider and a vendor handling patient data.

Does Catchsera sign a BAA?

Yes, Catchsera signs a BAA with every practice to ensure HIPAA compliance.

How does Catchsera protect sensitive data?

Catchsera never asks for sensitive details over the phone. Secure links are texted only after caller consent.

Can I review call transcripts?

Yes, Catchsera provides a live dashboard with call summaries and full transcripts for your review.