A call center that creates, receives, maintains or transmits protected health information on behalf of a HIPAA covered entity may function as a business associate. Buyers should determine whether a Business Associate Agreement is required and map every system that receives PHI.
Review phone systems, recordings, CRM, ticketing, email, AI platforms, analytics, storage and subprocessors. Evaluate access controls, authentication, encryption, audit logging, workforce training, incident response, breach obligations and retention.
Design workflows around the minimum necessary information. Do not assume an AI platform is outside HIPAA simply because no human listens to the call.
This guide is educational and is not legal advice.