Summary: HIPAA rules are in place to protect patients. All medical facilities, their call centers, and medical answering services must follow the rules pertaining to phone calls and messages. The question is this: what does it mean to be fully compliant?
Medical answering services are somewhat unique in what they represent. A missed call to a healthcare facility is more than just a potentially lost lead. It could represent a lapse in patient care. That is unacceptable. Still, answering the phones in a medical practice is not simple. So hiring a generic call center will not do.
In addition to continuity of care, medical facilities have another important obligation: ensuring that every form of communication – including phone calls and message forwarding – complies with the Health Insurance Portability and Accountability Act (HIPAA).
A generic call center may or may not be compliant. Likewise for a medical answering service that claims compliance without demonstrating it. As a private practice owner or medical facility operator, you have an obligation to choose a medical answering service that actually protects your patients, employees, and license. The most important thing you need to know is what it actually means to be a HIPAA-compliant provider.
What Makes a Service Truly Compliant
‘HIPAA-Compliant’ is a buzzword and marketing phrase common in our industry. But genuine compliance is a complex operational standard. It goes way beyond a few software settings and a policy manual that may not get updated very often. Compliance is also part of the medical answering service culture.
In order to be truly compliant, a medical answering service must demonstrate:
- Business Associate Agreements (BAA) – BAAs provide a legal foundation for medical answering services. They bind providers to compliance. A provider unwilling to sign one might not be fully compliant.
- Administrative Safeguards – Truly compliant providers employ administrative safeguards to guarantee things stay on track. These safeguards include things like routine staff training and strict access control of all data.
- Physical Safeguards – Compliance demands secure facilities with monitored access. Only authorized individuals can take sensitive phone calls, view computer screens, etc.
- Technical Safeguards – Genuine compliance also demands technical safeguards designed to prevent unauthorized access. These include things like automatic account log-off, unique user IDs, and state of the art auditing capabilities.
A HIPAA-compliant medical answering service not only employs operators who know the rules, but it also takes the necessary steps to ensure that no sensitive information can be accidentally or purposely leaked.
Messaging Must Always Be Secure
Medical answering services routinely take messages that are ultimately forwarded to appropriate parties. A truly compliant provider does not assume that all digital messages are secure. Why? Because they are not. Digital technologies that do not make use of encryption are actually not secure at all.
Your typical email or text message is no different from a postcard sent in the mail. It can easily be intercepted by third parties with cheap laptop computers and a little bit of hacking knowledge. Furthermore, storing standard messages on an unsecured server or provider network is a direct HIPAA violation.
Secure digital messages are made secure through encryption. The process of encryption scrambles data into a protected code there can only be unscrambled by recipients with the correct key.
Encryption is built in to secure, compliant messaging apps and platforms. Therefore, a compliant medical answering service should only use a proprietary platform proven to be secure through encryption. A good platform allows sending an invitation message so that the recipient can log into their encrypted account to view sensitive data.
The Legal Risks of Non-Compliance
While it can be awfully attractive for a private practice or medical facility to go with the cheapest answering service around, hooking up with a non-compliant provider subjects an organization to certain legal risks. In our opinion, the risks are not worth the amount of money saved.
A non-compliant provider creates a massive liability risk in multiple ways:
- Bad Phone Scripts – Non-compliant providers, especially generic answering services, often do not understand the finer details safeguarding protected health information (PHI). So their telephone scripts might actually invite violations, like asking for sensitive information over a non-secure line.
- Insufficient Audits – A non-compliant provider tends to offer little or no audit trail. When a legal dispute arises, there is not enough information to prove how a call was handled, who had access to the data, etc.
- Willful Non-Compliance – HIPAA fines escalate when willful neglect is involved. A medical facility continuing to work with a non-compliant provider despite full knowledge of compliance failures is subject to much higher fines when violations are discovered.
It’s worth noting that fines can eclipse $70,000 per violation in some cases. And because medical providers are ultimately responsible for how sensitive data is managed, they are the ones stuck paying the bills. It is not the answering service that takes the financial hit.
A Quick and Easy Compliance Checklist
Comparing medical answering services is no easy task. There are plenty to choose from. As far as HIPAA compliance is concerned, we recommend using the following checklist in the search for a new provider:
- The provider is willing to sign a BAA. (if not, drop the provider)
- The provider should never send PHI via standard email or text messaging.
- The provider’s operators should be trained specifically on HIPAA rules and protocols.
- The provider should be able to demonstrate a ‘least privilege’ data access policy.
- The provider should be able to demonstrate and audit log of all communications.
- The provider should store all recorded calls and digital data on secure, encrypted servers.
The first item on the checklist is critically important because it can reduce a long list of potential answering services to a more manageable short list. Walk away from any provider unwilling to sign a BAA. A BAA binds a provider to compliance. Therefore, an unwillingness to sign one immediately raises red flags.
It is one thing for an answering service to claim HIPAA compliance. It is another matter to demonstrate it daily. If you are looking for a new medical answering service to handle your incoming calls, make sure the service you choose is demonstrably compliant. Apello is, and we can prove it.
FAQs
Can answering service operators handle PHI?
Provided a service is HIPAA compliant and an appropriate BAA is in place, yes. Under such circumstances, the medical answering service is considered an extension of the medical provider.
Is a BAA absolutely necessary just for taking names and phone numbers?
Yes. Names and phone numbers are considered PHI in a medical environment. They can be linked to other information if not protected.
Can my answering service send patient names in standard text messages?
If an SMS platform is not encrypted, patient names cannot be sent via text messages. Compliance requires an encrypted platform and encrypted storage.
Can my answering service send notification text messages?
Yes. Notification messages are acceptable through standard text messaging. But they cannot contain any PHI. Instead, a notification message invites the recipient to log in to their account for the full message.
Can I use voicemail instead of a compliant answering service?
Voicemail is doable, but there is significant risk involved. Voicemail platforms must be HIPAA-compliant in a medical environment, and most are simply not.
