A single missed identity check can expose a patient’s private medical information, even when every system around the call is secure. An agent might disclose a lab result to the wrong person, leave sensitive details in a voicemail, or share more information than a caller is authorized to receive. These mistakes can lead to privacy breaches, regulatory penalties, and a loss of patient trust.
The risk extends beyond individual calls. According to the Verizon 2026 Data Breach Investigations Report healthcare snapshot, 54% of healthcare breaches involved the human element, while 32% involved a third party. The impact of vendor-related breaches can be particularly far-reaching: business associates accounted for 16% of large breach reports involving incidents in 2024, yet those breaches affected 85% of all individuals reported, according to the HHS breach report to Congress.
These findings highlight why secure technology alone isn’t enough to deliver HIPAA-compliant call center services. Protecting patient information requires clear responsibilities across your organization and its vendors, reliable caller verification, appropriate access controls, secure recordings and AI tools, and a tested breach response. This guide explains how to build those safeguards into everyday call center operations, from vendor agreements and agent training to quality assurance and incident reporting.
Key Takeaways
- Compliance depends on agent behavior, not just technology. Caller verification, minimum-necessary scripts, and controlled disclosures help protect PHI on every call.
- Outsourcing doesn’t transfer all accountability. Covered entities, call centers, and subcontractors each have specific HIPAA obligations.
- Every vendor that handles PHI needs the right safeguards and agreements. This includes cloud platforms, call recording, QA, transcription, and AI tools.
- Remote and offshore agents are permitted under HIPAA. BAAs, risk analyses, security controls, and any stricter contractual or regulatory requirements must cover the arrangement.
- Call recordings require access controls and a defined retention policy. HIPAA requires six-year retention for certain compliance documentation, but does not set a general retention period for recordings.
- Training and breach response need clear procedures. Teams must know how to recognize incidents, report them promptly, and meet applicable notification deadlines.
- The proposed Security Rule update is not final. MFA, encryption, asset inventories, and regular vendor verification are worth implementing now.
- A structured implementation plan makes compliance easier to verify. Map data flows, establish contracts, implement safeguards, test them through QA and breach drills, and keep required documentation current.
What Makes Call Center Services HIPAA Compliant?
A call center must comply with HIPAA when it handles protected health information (PHI) on behalf of a covered entity, such as a healthcare provider, health plan, or healthcare clearinghouse. PHI includes more than diagnoses and medical records. A patient’s name linked to an appointment, an insurance member ID, a prescription refill request, or a billing inquiry can all qualify.
Three HIPAA rules govern how call centers handle this information:
- Privacy Rule: Defines when PHI can be used or disclosed and limits access to what is permitted.
- Security Rule: Requires safeguards to protect electronic PHI (ePHI) in systems, recordings, and devices.
- Breach Notification Rule: Establishes when and how affected individuals, HHS, and others must be notified of a breach.
The technology used to handle calls also affects which requirements apply. Under HHS guidance on audio-only telehealth, traditional landline calls are not electronic communications subject to the Security Rule. Calls handled through VoIP, cellular networks, and apps, however, involve electronic technologies. The same applies to tools that record or transcribe calls. Because modern healthcare contact centers typically rely on cloud-based phone systems and connected software, the Security Rule applies to much of the technology they use.
There is no official HIPAA certification
A vendor’s claim that it is “HIPAA certified” doesn’t establish compliance. HHS does not endorse or recognize private HIPAA certifications, and obtaining a private certification does not relieve an organization of its legal obligations.
When evaluating a call center vendor, look for evidence of how it manages compliance in practice. Request a signed business associate agreement (BAA), a current risk analysis summary, written security policies, staff training records, and independent audit reports such as SOC 2 Type II. These materials help you assess whether the vendor has documented safeguards and processes in place to protect PHI.
Who’s Responsible for HIPAA Compliance When You Outsource?
When you outsource patient support to a HIPAA-compliant call center, that provider generally becomes your business associate. It may also rely on its own vendors, including contact center platforms, call recording and quality assurance (QA) tools, workforce management systems, and AI services. Each party has its own HIPAA obligations, so you need to know who is responsible for each part of the process. Otherwise, gaps in accountability can become serious outsourcing risks.
Two rules help clarify these responsibilities. First, a business associate must sign business associate agreements (BAAs) with subcontractors that create, receive, maintain, or transmit PHI on its behalf. You generally don’t need to sign separate BAAs directly with those subcontractors (45 CFR 164.502). Second, the HIPAA conduit exception applies to services that simply transmit data, with only temporary storage as needed for transmission. Vendors that store PHI on an ongoing basis generally qualify as business associates, even if the data is encrypted and they don’t hold the encryption key, according to HHS cloud computing guidance.
Who handles each HIPAA responsibility?
| Responsibility | You (healthcare provider or other covered entity) | Call center (business associate) | Its subcontractors (platforms, QA, AI) |
|---|---|---|---|
| BAAs | Sign a BAA with the call center. | Sign a BAA with you and with each subcontractor that handles PHI on its behalf. | Sign a BAA with the call center when required. |
| Risk analysis | Assess risks to PHI across your systems and the data you share with vendors. | Assess risks across its sites, agents, systems, and tools. | Assess risks to PHI within their own operations and systems. |
| Policies and training | Establish the rules for permitted disclosures and access to PHI. | Train agents on applicable procedures and maintain required security policies and training. | Maintain appropriate policies and train their own workforce. |
| Caller verification and minimum necessary | Define the access and disclosure rules for each caller type. | Apply those rules through agent training, scripts, and system permissions. | Support the required controls where their tools are involved. |
| Incident reporting | Report incidents identified within your own operations and follow applicable breach notification requirements. | Notify you of breaches as required by the BAA and HIPAA, without unreasonable delay and no later than 60 calendar days after discovery. | Notify the call center of relevant incidents as required by their BAA and other applicable obligations. |
| Notice to patients, HHS, and the media | Generally coordinate required notifications, unless the BAA assigns the call center to handle them on your behalf. | Provide the information needed for notifications and carry out any responsibilities assigned under the BAA. | Provide relevant incident details to the call center. |
| Documentation retention | Retain required HIPAA compliance documentation for at least six years. | Retain required compliance documentation for at least six years. | Retain applicable compliance documentation for at least six years. |
The key point is that outsourcing doesn’t transfer all your HIPAA responsibilities to the vendor. You still need to oversee your compliance program, while the call center and its subcontractors must meet the obligations that apply to them.
That’s also why a software certificate alone doesn’t prove that a call center is HIPAA compliant. Our guide to choosing a healthcare call center includes a 12-question vendor audit to help you check these responsibilities before signing a BAA.
How to Apply the HIPAA Privacy Rule to Every Call
The HIPAA Privacy Rule governs when agents can disclose protected health information (PHI) and how much they can share. Two principles guide most everyday interactions: minimum necessary and caller verification.
Build the minimum-necessary rule into agent workflows
Agents must limit PHI to the minimum necessary to accomplish the purpose of a call (45 CFR 164.514). The rule also calls for role-based access and standard protocols for routine disclosures. Certain disclosures, including those to the patient and disclosures to healthcare providers for treatment, are exempt from the minimum-necessary standard under 45 CFR 164.502.
In practice, you can build this principle into agent workflows in three ways:
- Define what agents can say. Scripts specify which details agents may share for each call type, such as an appointment’s time and location without revealing the reason for the visit.
- Limit what agents can see. Configure screens and permissions so each role can access only the information it needs. For example, a scheduling agent shouldn’t see lab results.
- Set clear escalation paths. Route questions that fall outside approved scripts, including clinical questions, to a licensed clinician or the healthcare provider.
Caller verification: who can hear what
Before disclosing PHI, agents must verify the requester’s identity and, when relevant, their authority to receive the information. HIPAA doesn’t prescribe a single verification script, so the table below translates the legal requirements into practical steps for agents.
| Caller | What the agent verifies | What the caller can hear | Rule behind it |
|---|---|---|---|
| Patient | Identifiers matched to the record. A common practice is to confirm the patient’s name and date of birth, then use another identifier, such as an address or member ID, if needed. | PHI relevant to the request, subject to applicable access and disclosure rules. | Identity verification and permitted disclosure |
| Personal representative (legal guardian, parent of a minor, healthcare power of attorney, or executor) | Identity and documentation establishing their authority, as applicable. | Generally, the same PHI the patient could access, subject to applicable exceptions. | Personal representatives are generally treated as the individual, unless an exception applies, such as suspected abuse or endangerment. |
| Family member or friend involved in care | Identity and, when the patient is present and able to decide, the patient’s agreement or lack of objection. | Only PHI directly relevant to their involvement in the patient’s care or payment. | Disclosures to people involved in care |
| Other third party (employer, attorney, or another provider) | Written authorization or confirmation that the disclosure is permitted for another reason, such as treatment. Follow approved verification procedures, including callbacks to known numbers when appropriate. | Only the information permitted by the authorization or other applicable rule. | Authorization and other permitted-disclosure requirements |
Two Privacy Rule provisions are particularly relevant here. Under 45 CFR 164.502, personal representatives are generally treated as the individual, subject to exceptions. Under 45 CFR 164.510, agents may share relevant information with family members and friends involved in care when the applicable conditions are met. If the patient is absent or incapacitated, staff may use professional judgment as permitted by the rule.
Health plans also have plan-specific requirements. Payer member services teams must verify callers against member records and follow applicable authorization procedures.
Protect PHI in voicemails, callbacks, and shared workspaces
Accidental disclosures can happen even when agents follow their scripts, especially when leaving voicemails, returning calls, or speaking in a shared workspace.
- Voicemails: Keep messages limited to the patient’s name, a callback number, and a request to return the call. Leave out diagnoses, test results, appointment details, and other clinical information.
- Callbacks: Use the phone number on file or another approved, verified contact method. Don’t call a new number supplied by the requester before verifying their identity.
- Shared workspaces: Use headsets, adequate spacing, and noise control to prevent nearby agents and visitors from overhearing PHI.
- After-hours calls: A HIPAA-compliant medical answering service must follow the same applicable privacy and verification procedures when handling messages and routing calls.
Security Rule Safeguards for Call Center Operations
The HIPAA Security Rule starts with a risk analysis: an accurate and thorough assessment of risks to the confidentiality, integrity, and availability of electronic protected health information (ePHI) (45 CFR 164.308). Both covered entities and business associates must conduct one. For a call center, that means assessing every channel, location, system, tool, and remote workstation involved in handling ePHI.
The required safeguards fall into three categories: administrative, physical, and technical. The table below shows how each can work in a call center and the evidence an auditor may request.
| Safeguard | What it looks like in a call center | Evidence an auditor may request |
|---|---|---|
| Administrative: Risk analysis and risk management | Review risks whenever you add a channel, site, or tool, and track plans to address identified risks. | Current risk analysis and remediation plan |
| Administrative: Workforce access | Grant access by role and promptly revoke it when an agent leaves or no longer needs access. | Onboarding and offboarding logs, periodic access reviews |
| Administrative: Security awareness training | Train all staff, including managers, to recognize phishing, social engineering, and password-related risks. | Dated training records |
| Physical: Facility and workstation controls | Restrict floor access, enforce clean-desk practices, and prohibit personal phones at workstations where required by policy. | Access logs, workstation policies, spot-check results |
| Physical: Device and media controls | Secure devices and media, prohibit unauthorized removable media, and securely wipe or destroy equipment before disposal or reuse. | Device inventory, disposal certificates |
| Technical: Access control | Use unique user IDs, multi-factor authentication (MFA), and automatic logoff where appropriate. | System configuration records, MFA enrollment reports |
| Technical: Audit controls | Log access to patient records and recordings so activity can be reviewed. | Log samples and review records |
| Technical: Transmission and storage security | Protect ePHI in calls, chats, recordings, and CRM systems with encryption and other appropriate safeguards. | Encryption settings, vendor attestations, security documentation |
Under the current Security Rule, encryption is an addressable implementation specification. That means organizations must assess whether it is reasonable and appropriate, implement it when appropriate, or document why an alternative measure is reasonable and appropriate instead. For cloud-based call centers, encryption is generally a key safeguard. The proposed Security Rule update discussed below would make encryption requirements more prescriptive, but that proposal is not yet final.
Call Recording, QA Monitoring, and Retention
Call recordings can turn conversations containing PHI into stored electronic protected health information (ePHI), which requires appropriate safeguards. The HHS audio-only guidance discussed earlier treats technologies that record or transcribe calls, as well as messaging services that store audio messages, as electronic technologies subject to the Security Rule. It also identifies stored recordings as a factor to consider in your risk analysis.
Four controls help protect recorded calls:
- Disclose recording at the start of the call. Recording and consent laws vary by jurisdiction, and some require consent from every party. A consistent disclosure procedure across locations helps agents follow the applicable requirements.
- Redact or pause recordings when sensitive data is shared. Automatic redaction or pause-and-resume controls can keep payment card numbers out of recordings. A PCI-compliant call center should have controls to protect payment data as well.
- Restrict access to recordings. Give QA evaluators role-based access to the recordings they need to review, and log playback so you can track who accessed each file.
- Evaluate compliance, not just courtesy. Include caller verification and minimum-necessary requirements in every call center quality assurance scorecard. For example, an agent who skips a required identity check should fail that part of the evaluation.
You also need a written retention policy. HIPAA requires covered entities and business associates to retain certain compliance documentation, including required policies, procedures, and risk analyses, for six years from the date of creation or the date when the document was last in effect, whichever is later (45 CFR 164.316). HIPAA does not set a general retention period for call recordings themselves. Your BAA should define how long recordings are kept, how they’re securely deleted, and how legal holds are handled, taking applicable state laws and other contractual requirements into account.
Remote and Offshore Agents: How to Protect PHI Outside the Office
HIPAA doesn’t prohibit remote or offshore work. According to the HHS cloud computing guidance discussed earlier, a vendor may store ePHI outside the United States if a BAA is in place and the parties meet other applicable HIPAA requirements. The associated risks must also be included in the covered entity’s or business associate’s risk analysis.
However, contracts can impose stricter limits than HIPAA. For example, organizations applying for a Medicare Part D contract, including PACE organizations, must submit an offshore subcontractor attestation to the Centers for Medicare & Medicaid Services (CMS), according to the CMS PACE Part D application. The attestation covers offshore subcontractors that handle beneficiary PHI. Before choosing a location model, review your payer, state, and client contracts. Onshore teams, nearshore call center teams, and offshore outsourcing each involve different contractual requirements and cost trade-offs.
Remote agents also need safeguards that protect PHI outside a controlled office environment:
- Virtual desktop infrastructure (VDI): Keep PHI on central servers and disable local storage, printing, and copy-and-paste where appropriate.
- Managed devices only: Require company-issued, encrypted laptops with multi-factor authentication (MFA) and remote-wipe capabilities.
- Private workspaces: Require agents to work in a closed room, keep smart speakers out of the workspace, and prohibit personal phones from being used to photograph screens.
- No paper records: Prohibit agents from writing down PHI and have supervisors check compliance during virtual floor walks.
- Monitoring and oversight: Use session logs and periodic camera or screen checks where appropriate, with monitoring practices disclosed to agents in writing.
AI Voice Agents, Transcription, and Chatbots: When Do You Need a BAA?
Every AI tool in your call workflow introduces another vendor that may handle PHI. The same rule applies across the chain: a vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is generally a business associate and needs a business associate agreement (BAA). This also applies to vendors that store call recordings or transcripts, even if they don’t access or read the contents themselves.
Unapproved AI tools add another layer of risk. According to IBM’s 2025 Cost of a Data Breach research, one in five organizations experienced a breach involving shadow AI, meaning AI tools used without organizational approval. Organizations with high levels of shadow AI reported breach costs about $670,000 higher than those with little or no shadow AI.
The table below outlines which tools typically require a BAA and the safeguards to consider for each.
| Tool | Does it handle PHI? | Is a BAA required? | Minimum controls to consider |
|---|---|---|---|
| AI voice agent or AI-powered intake tool | Yes. It may hear, process, and store callers’ personal or medical details. | Yes, if it handles PHI on behalf of a covered entity or business associate. | Verify identity before disclosing PHI, provide a clear handoff to a human agent, and maintain appropriate interaction logs. |
| Real-time transcription and agent-assist tools | Yes. They process conversations and may store transcripts containing PHI. | Yes, if they handle PHI on behalf of a covered entity or business associate. | Set retention limits and prohibit model training on your data without written approval. |
| Speech analytics and AI-powered QA scoring | Yes. They process recordings that may contain PHI. | Yes, if they handle PHI on behalf of a covered entity or business associate. | Apply redaction, role-based access controls, and a defined deletion schedule. |
| Patient-facing chatbot | Yes, if it collects or processes identifiers or other PHI. | Yes, if it handles PHI on behalf of a covered entity or business associate. | Authenticate users before displaying account details and provide a clear escalation path. |
| General-purpose AI assistant used by agents | Yes, if agents enter PHI into the tool. | A BAA is required if the tool handles PHI on behalf of a covered entity or business associate; otherwise, block its use with PHI. | Establish a written policy, use technical controls to prevent unauthorized sharing, and train staff. |
| Carrier that only transmits calls | It transmits communications but does not store PHI beyond what is necessary for temporary transmission. | Generally no, if it qualifies for the HIPAA conduit exception. | Confirm that its service is limited to transmission and any storage is only temporary and incidental to that function. |
Before signing a BAA or service contract, get clear answers to four questions:
- Where is the data stored and processed?
- How long is it retained, and how is it deleted?
- Can the vendor use your data to train or improve its models?
- Which subcontractors can access or process the data?
These questions matter for both traditional healthcare call center automation projects and newer agentic AI in healthcare, where AI systems can take actions and complete tasks rather than simply make suggestions. Make sure your agreements and safeguards reflect what each tool actually does with PHI, not just how the vendor describes its product.
Training and Breach Response: Key HIPAA Deadlines
HIPAA requires both privacy training and security awareness training. Covered entities must train workforce members on their PHI policies and procedures as relevant to their roles, train new staff within a reasonable time, provide additional training when material policy changes affect their work, and document the training (45 CFR 164.530). The Security Rule also requires a security awareness and training program for all workforce members, including management (45 CFR 164.308).
Formal training should be reinforced with scenario-based drills. Practice situations that could lead to an improper disclosure, such as a caller who knows the patient’s name but can’t verify their date of birth, a spouse whose authority hasn’t been confirmed, or someone claiming to be from a doctor’s office who requests records over the phone.
When a breach occurs, the notification timeline depends on when it is discovered. A breach is considered discovered on the first day it is known to the covered entity or business associate, or when it would have been known through reasonable diligence by a workforce member or agent other than the person who committed the breach (45 CFR Part 164, Subpart D).
| Notice | Who notifies whom? | Deadline |
|---|---|---|
| Business associate notice | Call center to the covered entity | Without unreasonable delay and no later than 60 calendar days after discovery |
| Individual notice | Covered entity to affected individuals | Without unreasonable delay and no later than 60 calendar days after discovery |
| Media notice | Covered entity to prominent media outlets serving the affected state or jurisdiction | Without unreasonable delay and no later than 60 calendar days after discovery, if more than 500 residents of a state or jurisdiction are affected |
| HHS notice: 500 or more individuals | Covered entity to HHS | Without unreasonable delay and no later than 60 calendar days after discovery, at the same time as individual notice |
| HHS notice: fewer than 500 individuals | Covered entity to HHS | Within 60 days after the end of the calendar year in which the breaches were discovered |
Check whether your BAA requires the call center to notify you sooner than HIPAA’s 60-day maximum, and rehearse the reporting process so everyone knows what to do. HIPAA civil penalties can also be substantial. Under the latest HHS civil penalty inflation adjustment, penalties range from $145 per violation to a calendar-year cap of $2,190,294, depending on the violation category and applicable circumstances.
The Proposed HIPAA Security Rule Update: What Could Change?
HHS published a proposed update to the HIPAA Security Rule on January 6, 2025. The proposal is not final, so the current rule remains in effect. The latest federal regulatory agenda lists the update as a long-term action, with final action expected in July 2027.
According to the HHS fact sheet on the proposed rule, the proposal would introduce several requirements for covered entities and business associates:
- Remove the addressable category. Nearly all implementation specifications would become required, subject to any exceptions in the final rule.
- Require encryption. ePHI would need to be encrypted both at rest and in transit, with limited exceptions.
- Require multi-factor authentication (MFA). Access to systems containing ePHI would require MFA.
- Require an asset inventory and network map. Organizations would need to maintain both and update them at least every 12 months.
- Require annual written verification from business associates. They would need to verify their technical safeguards to covered entities at least every 12 months.
- Shorten contingency-plan reporting timelines. Business associates would need to notify covered entities within 24 hours of activating a contingency plan.
- Require annual compliance audits. Organizations would need to conduct an audit at least every 12 months.
Many of these practices are already sensible security measures for a well-run call center. Implementing MFA, encryption, and an up-to-date asset inventory, and obtaining written verification of vendor safeguards every year, can strengthen your current security program while helping you prepare for potential regulatory changes. Until HHS finalizes the update, however, these proposed provisions should not be presented as current legal requirements.
A 90-Day Plan to Build HIPAA-Compliant Call Center Operations
The plan below puts the safeguards covered in this guide into a practical sequence. It works for both a new in-house team and the onboarding of an outsourced call center partner.
| Phase | Days | What gets done | Ready to move on when |
|---|---|---|---|
| Map and contract | 1–30 | Map every channel and tool that handles PHI. Sign BAAs with the call center and applicable subcontractors. Complete the risk analysis. | Every tool has a BAA or documented conduit status, and the risk analysis has been reviewed and approved. |
| Build the controls | 31–60 | Develop caller-verification and minimum-necessary scripts. Configure role-based access, MFA, encryption, call recording, and redaction. Equip remote agents with approved devices and safeguards. Train the team. | Scripts are approved, system configurations are documented, and every agent has a training record. |
| Prove it works | 61–90 | Calibrate QA reviews against compliance requirements. Run a mock breach-response drill, review user access, and assemble the compliance documentation. | The breach-response drill meets the notification timeline specified in the BAA, and QA scores meet the established target. |
| Operate and review | Ongoing | Update the risk analysis when systems, vendors, or workflows change. Review access regularly and refresh training as needed. | Required compliance documentation is retained for at least six years, and records remain current as requirements and operations change. |
How Helpware Runs HIPAA-Compliant Call Center Services
You need a patient support partner that can protect PHI, keep quality high, and scale with your business. Helpware brings these priorities together for telehealth, digital health, and healthcare companies, including Headspace, HealthComp, and NexHealth.
Our operations hold SOC 2 Type II, ISO 27001, and ISO 9001 certifications, and we follow HIPAA compliance and PCI DSS requirements. Our teams include HIPAA-trained technical support agents, clinical scribes, and credentialing specialists, so you can build a support operation around the needs of your healthcare program.
We also turn compliance controls into measurable operational gains. In one healthtech program, an AI intake assistant verifies each caller’s name, date of birth, and account ID before transferring the call to an agent. That workflow cut agent call time by 40 seconds per call. Our quality assurance outsourcing service uses AI-enabled QA to score up to 100% of interactions, helping teams check compliance requirements at scale instead of relying on a small sample of calls.
Whether you need a focused pilot or a large, multilingual operation, we can build around your requirements. Helpware operates across 19 locations in 11 countries, with onshore, nearshore, and offshore delivery in 45+ languages. Our hub-and-spoke model helps align delivery locations with your contractual restrictions. Start with a pilot team of five to ten full-time agents and scale to more than 500 in 90 to 120 days as your needs grow.
You retain ownership of your HIPAA program, while we work with your team to support the operational controls your program requires. Let’s discuss your current setup, identify the safeguards your call center needs, and build a patient support operation that’s ready to scale.
Make HIPAA Compliance Part of Every Call
HIPAA compliance isn’t a one-time checklist. It depends on clear responsibilities, consistent caller verification, secure handling of PHI, properly vetted vendors, and a breach-response process your team can execute under pressure. Regular QA reviews, drills, and up-to-date documentation help you verify that those safeguards work in practice.
If you’re launching or replacing a healthcare call center service, Helpware can help you build an operation around your compliance requirements, from the right delivery model to the controls that support day-to-day patient interactions. Talk to our team to discuss your requirements and plan your next steps.
