Most practices know they need a BAA with their phone vendor. Far fewer can say what PHI actually flows through a modern phone system — or what the agreement does and does not protect. Here is the map, from voicemail to AI transcription.
Where PHI lives in a phone system
More places than most covered entities list in their risk analysis: call recordings, voicemail audio and transcriptions, SMS threads, caller ID paired with an appointment context, call notes, and — on an AI-first platform — transcripts, agent conversation logs, and scoring data. If a caller says "this is Maria, I’m calling about my biopsy results," that recording, its transcript, and the AI agent’s notes are all PHI.
What the BAA obligates the vendor to do
A real BAA commits the vendor to use PHI only to deliver the service, to safeguard it per the Security Rule, to report breaches on a defined clock, to bind subcontractors (carriers, cloud providers, AI infrastructure) to equivalent terms, and to return or destroy PHI at termination. Ours adds two commitments worth demanding from any vendor: AI processing stays in US data centers, and your call content never trains models offered to other customers.
What a BAA does not do
It does not make your configuration compliant. Retention schedules, who can play recordings, whether after-hours AI agents should collect symptom details or only callback numbers — those are your policy decisions, made in the console. A BAA also does not cover channels it does not govern: staff texting patients from personal phones is outside every vendor agreement you will ever sign.
Questions to ask any phone vendor
Where is call audio processed and stored? Is the BAA included or a paid add-on? Can AI features be disabled per-line for high-sensitivity workflows? What is the breach notification window in business days? Can you produce a subprocessor list on request? A vendor who answers those five without a sales-engineering escalation is a vendor with a real compliance program.