HIPAA and the answering service: when a BAA is required, what it must say, and how bilingual intake fits in

Published October 26, 2026 by Special Interest Answering Service (SIAS), Joliet, Illinois. Regulatory statements cite the U.S. Department of Health and Human Services (HHS) and the Code of Federal Regulations as they read on that date. This is practical background for practice managers, not legal advice; your compliance officer or counsel has the final word.

A medical or dental practice that forwards its phone line to an answering service is handing patient information to an outside company. HIPAA has a specific name for that company, a specific contract it must sign, and specific duties that fall on it directly. This guide explains the three in plain terms, lists what to ask any answering service before you forward the line, and covers the part most HIPAA checklists skip: what happens when the patient on the line does not speak English.

An answering service is a business associate

HIPAA's Privacy Rule applies to covered entities (health care providers that bill electronically, health plans and clearinghouses) and to their business associates. HHS defines a business associate as a person or entity, other than a member of the covered entity's workforce, that creates, receives, maintains or transmits protected health information (PHI) to perform a function or service on the covered entity's behalf (45 CFR 160.103). HHS's own list of examples includes "an independent medical transcriptionist that provides transcription services to a physician"; an answering service that takes a message containing a patient's name and reason for calling is doing the same kind of work.

Two exceptions come up in conversations with vendors, and neither fits an answering service. The conduit exception covers organizations that merely transport PHI without accessing it, such as the U.S. Postal Service and private couriers. An operator who hears the patient's problem and writes it down is not a conduit. The treatment exception covers disclosures between providers for treatment of the patient, for example a hospital referring to a specialist; an answering service does not treat anyone.

What the business associate agreement has to contain

The Privacy Rule requires a written contract, the business associate agreement (BAA), before a covered entity lets a business associate handle PHI (45 CFR 164.504(e)). HHS publishes sample provisions, and its summary of what the contract must do is this:

1. set out the permitted and required uses and disclosures of PHI by the business associate;
2. bar the business associate from using or further disclosing PHI beyond what the contract or the law allows;
3. require appropriate safeguards, including the Security Rule's requirements for electronic PHI;
4. require the business associate to report unauthorized uses or disclosures, including breaches of unsecured PHI;
5. require the business associate to help the covered entity meet patients' rights to access, amend and get an accounting of their information;
6. require compliance with the Privacy Rule when the business associate carries out one of the covered entity's Privacy Rule obligations;
7. require the business associate to make its practices, books and records available to HHS;
8. at termination, require return or destruction of all PHI where feasible;
9. require the same restrictions to flow down to any subcontractor that handles the PHI;
10. allow the covered entity to terminate the contract if the business associate violates a material term.

For an answering service the practical reading is: the BAA should say what the operators may collect and whom they may send it to, how messages are stored and for how long, how a breach would be reported to the practice, and that any subcontractor (a message-delivery platform, a paging vendor) is bound the same way.

The business associate is liable on its own

Since the 2013 Omnibus Rule, business associates are directly liable under HIPAA, not only through their contracts. HHS's Office for Civil Rights published a fact sheet on May 24, 2019 listing the areas, which include impermissible uses and disclosures of PHI, failing to comply with the Security Rule (including the risk analysis requirement), failing to give breach notification to the covered entity, failing to limit PHI to the minimum necessary, and failing to sign BAAs with subcontractors. For a practice this cuts both ways: the service carries its own exposure, and a service that shrugs at the question is telling you something.

Minimum necessary, applied to a phone script

The Privacy Rule's minimum-necessary standard (45 CFR 164.502(b)) requires reasonable efforts to limit PHI to what is needed for the purpose. The answering-service version of that rule lives in the call script. A night message for the provider on call needs the patient's name, a callback number, the provider the patient sees and a short statement of the problem in the caller's words. It does not need a date of birth, an insurance number, a medication list or a diagnosis, and a script that does not ask for them means the service never holds them. Write the script with the compliance officer, not just the office manager.

How the message travels matters as much as who takes it

The weak point in most after-hours setups is not the operator; it is the text message. A message with a patient's name and problem sent as an ordinary SMS or plain email sits unencrypted on the carrier's network and in the recipient's phone. Options, from weakest to strongest:

• plain SMS or email carrying the full message (common, and the thing a compliance officer will object to);
• a plain SMS that says only "you have a new message" with the content held in a secure portal or app;
• a live phone call or page to the provider on call, with the details given by voice;
• delivery through a secure app with login and encryption in transit and at rest.

SIAS delivers routine messages by text, email or fax as the practice chooses and offers a Secure Delivery app for browser, Android and iPhone for messages that should not travel by plain text or email; urgent calls reach the provider on call by page, text or a live patch. Which path each kind of message takes is the practice's decision and is written into the account.

Ten questions to ask an answering service before forwarding a practice line

1. Will you sign our BAA, or provide yours for our counsel to review? What does it say about subcontractors?
2. Where are the operators located, and are they your employees?
3. How are operators trained on PHI, and how often?
4. What exactly will operators ask callers, and can we limit it to what the on-call provider needs?
5. How are messages delivered, and is there a secure option that keeps PHI out of plain SMS and email?
6. How long are messages and call records kept, and how are they destroyed?
7. Who at your company can see our messages, and how is that access controlled and logged?
8. How would you notify us of a breach, and how quickly?
9. Can the on-call rotation and the emergency definition be changed at any hour, and is there a fee?
10. Do you have Spanish-speaking operators on every shift, and is there a per-call charge for them?

Bilingual intake: the compliance question most checklists skip

Language access is both a patient-safety issue and, for many practices, a legal one. The Census Bureau's 2018-2022 American Community Survey found that 21.7% of people age 5 and older spoke a language other than English at home; Spanish was the language of 61.1% of them, and only 61.0% of Spanish speakers reported speaking English "very well". In other words, close to two in five Spanish speakers in the United States may struggle to describe a symptom to an English-only operator at 2 a.m.

On the legal side, Section 1557 of the Affordable Care Act requires health programs that receive federal financial assistance (which includes Medicare and Medicaid participation) to take reasonable steps to provide meaningful access to people with limited English proficiency; HHS's final rule of April 26, 2024 also requires an annual notice of availability of language assistance in English and the 15 languages most common among limited-English-proficient people in the state, starting July 5, 2025. Whether an after-hours phone line falls within a given practice's obligations is a question for counsel, but a line that cannot take a Spanish-speaking patient's call is hard to defend as meaningful access.

What to look for: operators who are bilingual themselves rather than a third-party interpreter patched in with a delay; Spanish coverage on nights and weekends, not just the day shift; the same script and the same minimum-necessary limits in both languages; and no per-call surcharge, which otherwise becomes a quiet incentive to route Spanish speakers to voicemail. At SIAS, bilingual English and Spanish operators are on every plan, 24 hours a day, at no extra charge, and Spanish calls are billed as ordinary operator minutes.

How SIAS handles medical accounts

SIAS answers for medical and dental offices 24 hours a day with live, US-based, bilingual operators. Medical messages are handled under HIPAA-compliant procedures: operators collect only what the practice's script asks for, messages containing patient information can be delivered through the Secure Delivery app instead of plain text or email, and urgent calls follow the on-call path the practice sets. Medical and dental accounts use the same price table as every other SIAS account, from $159 every 4 weeks for 100 operator minutes, with no setup fee and no contract. If your compliance officer needs a Business Associate Agreement or has questions about storage and delivery, raise it at sign-up so it is settled before the first call. More on the medical answering service page.

Sources: HHS Office for Civil Rights, "Business Associates" guidance and "Sample Business Associate Agreement Provisions" (hhs.gov), 45 CFR 160.103, 164.502(b) and 164.504(e); HHS OCR fact sheet "Direct Liability of Business Associates", May 24, 2019; U.S. Census Bureau press release CB23-208, December 7, 2023, 2018-2022 American Community Survey 5-year estimates; HHS Section 1557 final rule, April 26, 2024 (45 CFR Part 92). Special Interest Answering Service is family-owned, based in Joliet, Illinois, founded in 1980, and not affiliated with Specialty Answering Service (SAS).

More guides

After-hours emergency dispatch: how a live answering service handles it. Per-minute vs per-call answering service pricing.