HIPAA compliant answering service
HIPAA compliant medical answering service — with a signed BAA included.
DeskMD is a HIPAA compliant medical answering service built on the controls that actually matter: a signed BAA, KMS-encrypted recordings, audit logging on every PHI access, minimum-necessary intake, per-provider inbox redaction, and secure links instead of PHI in text messages.
The controls
The safeguards behind a HIPAA compliant medical answering service.
A compliant answering service is more than a promise. These are the specific controls DeskMD runs on every account.
Signed BAA included
DeskMD signs a Business Associate Agreement with every customer before any PHI reaches the service.
KMS-encrypted recordings
Recordings and transcripts sit in KMS-encrypted storage at rest; calls and dashboards travel over TLS 1.2+.
Audit logging
Every PHI access is written to an audit log, with retention defaulting to six years.
No PHI in SMS
Team text alerts stay non-PHI. Patient details sit behind secure, access-controlled links that expire.
Minimum-necessary PHI
Capture what the practice needs — and nothing it doesn’t.
DeskMD follows your plain-English instructions to capture the specific details your staff needs, then applies the minimum-necessary principle so patient data is only ever handled to the extent the workflow requires.
Calls route to the right provider through per-provider auto-detection, and the inbox redacts PHI so team members see only what their role should see. When an emergency phrase is captured, the team is notified by SMS and email through a secure link — not by exposing symptoms or callback numbers in a plain message. DeskMD flags emergency language for your team; it is not a 911 replacement.
What “HIPAA compliant” means
What HIPAA compliant actually means for an answering service.
There are four things to check. Watch any vendor answer all four before you send a single patient call.
1. Signed BAA
A Business Associate Agreement between the practice and the service. DeskMD signs a BAA with every customer before PHI lands on the platform. If a vendor says “we’re working on it,” do not push PHI through them yet.
2. Encryption at rest + in transit
Recordings and transcripts are stored in KMS-encrypted storage at rest. Calls and dashboard views travel over TLS 1.2+, enforced at the gateway.
3. Audit logging + retention
The HIPAA Security Rule requires policies and procedures be retained for six years (45 CFR §164.316(b)(2)(i)). DeskMD logs PHI access and defaults audit-log retention to six years.
4. Minimum-necessary + deletion
Minimum-necessary PHI handling, per-provider inbox redaction, secure links instead of PHI in SMS, and patient-level deletion workflows that remove transcript, recording, and derived references.
Subprocessors
Every PHI processor needs a signed BAA.
A HIPAA compliant medical answering service is only as compliant as its subprocessor list. DeskMD’s production stack and BAA status:
| Subprocessor category | Role | BAA status |
|---|---|---|
| Cloud infrastructure | Compute, KMS-encrypted storage, recordings + transcripts at rest | Signed BAA available |
| Telephony | Inbound voice + media streams + recording | Signed BAA on HIPAA-eligible accounts |
| Database | Call records, structured intake, audit logs | Signed BAA on dedicated tier |
| Payment processing | Billing only — never carries PHI | BAA not required (no PHI) |
| Voice AI | Real-time voice agent + post-call translation | Signed BAA required before PHI production use |
DeskMD does not enable PHI production traffic on any subprocessor surface until the relevant Business Associate Agreement is fully executed and its scope explicitly covers the data flow in question.
Multilingual + HIPAA
Multilingual calls, without breaking BAA scope.
DeskMD Pro answers in 20+ languages at native quality (additional languages best-effort) and shows English translation in the inbox. Every language and translation call stays inside the BAA-covered subprocessor stack.
Why it matters: practices that reach for a consumer translation tool on a non-English call create a clear BAA gap. DeskMD’s translation runs on the same BAA-covered infrastructure as the call itself, under the same agreement. Standard is English-only; multilingual answering is a Pro feature.
Pricing
Per-provider pricing. BAA and security on every plan.
Standard
For English-only practices
$0 setup. 14 days free, cancel anytime. 15% annual discount.
- Unlimited calls (fair-use)
- Per-provider auto-detection + inbox redaction
- Structured intake from plain-English instructions
- Emergency flagging by SMS + email (secure links)
- HIPAA compliant + signed BAA
- KMS-encrypted recordings + audit logging
- English-only answering
- 365-day recording retention
- Email support, 48-hour SLA
Pro
For specialty and multi-provider practices
$0 setup. 14 days free, cancel anytime. 15% annual discount.
- Everything in Standard
- 20+ languages with English translation
- Conditional intake instructions for common call types
- Business-hours and after-hours greeting/tone
- Custom escalation rules
- 1,825-day (5-year) recording retention
- Advanced analytics
- Priority support, 24-hour SLA
5+ providers? We offer custom plans — contact sales. No per-minute or per-call fees on either plan.
FAQ
HIPAA compliance questions.
Is DeskMD HIPAA compliant?
DeskMD is built as a HIPAA compliant medical answering service: a signed BAA, KMS-encrypted recordings and transcripts, audit logging on PHI access, minimum-necessary intake, per-provider inbox redaction, and secure links instead of PHI in SMS.
Do you sign a BAA?
Yes. DeskMD signs a Business Associate Agreement with every healthcare customer before any PHI reaches the service. A medical answering service with a BAA is the baseline for handling patient calls — ask any vendor for theirs before sending PHI.
Is a medical answering service required to be HIPAA compliant?
If a service handles patient information on your behalf, it is a business associate under HIPAA and must operate under a signed BAA with appropriate safeguards. Do not route PHI to a vendor that cannot provide one.
Are call recordings encrypted?
Yes. Recordings and transcripts are stored in KMS-encrypted storage at rest, and calls and dashboard views travel over TLS 1.2+.
Does DeskMD put PHI in text messages?
No. Team SMS alerts stay non-PHI. Patient details sit behind secure, access-controlled links that expire, so names, callback numbers, and symptoms never travel in a plain text message.
How long are audit logs retained?
DeskMD’s audit-log retention defaults to six years, aligning to 45 CFR §164.316(b)(2)(i).
Compare further
Related comparisons + alternatives.
Security details · After-hours coverage · Virtual receptionist · Pricing
Compliant answering, without the compromise.
Sign a BAA, get KMS-encrypted recordings and audit logging, and give patients a real answer after hours — all on flat per-provider pricing.