What HIPAA requires
HIPAA (the Health Insurance Portability and Accountability Act) applies to Covered Entities (most healthcare providers) and their Business Associates (vendors that handle PHI for them). It requires:
- A Business Associate Agreement (BAA) between the covered entity and each business associate that handles Protected Health Information (PHI).
- Administrative, physical and technical safeguards for that PHI, such as access controls, audit logs, encryption and breach notification.
- Minimum necessary access: staff and vendors see only the PHI they need to do their job.
When your AI receptionist answers a patient's call, the audio, the transcript, the patient's name and number and anything clinical they mention are PHI. That makes FrontDesk a business associate of your practice.
The BAA
Your organization accepts FrontDesk's BAA when it creates its account, on every plan and at no extra cost. Healthcare practices see who accepted it and when under Settings → Account → Organization → Business Associate Agreement. See Sign your BAA.
How FrontDesk protects the data
| Safeguard | What FrontDesk does |
|---|---|
| Where data lives | United States, on HIPAA-eligible Amazon Web Services infrastructure |
| Encryption | Data is encrypted at rest and in transit |
| Access controls | Each person has their own login. Roles and client care permissions decide who sees chart notes, questionnaires, documents and secure messages (Settings → Team) |
| Audit log | Every view, change and export of patient information is logged with who, when and from where, and kept 7 years (Settings → Account Activity → HIPAA Audit Log). Every team sign-in and failed sign-in is logged too (Sign In Events) |
| Phone privacy | Optional identity checks before the AI discusses a caller's records; see Verify caller identity |
| Breach notification | Under the BAA, reported without unreasonable delay and no later than 60 days after discovery |
| Retention | Set by FrontDesk for all accounts, with a nightly cleanup; see Data retention and deletion |
What's still on you
A signed BAA is not the whole job. You still need to:
- Give everyone their own login. Don't share logins. Invite each person under Settings → Team and give them only the permissions their role needs.
- Keep PHI where it belongs. Don't copy a transcript into unrelated tools, chat apps or public tickets.
- Handle recording consent where state law requires it. See Understand call recording consent.
- Know the retention periods. FrontDesk sets them; there is no retention screen in the app. See Data retention and deletion.
- Respond to patient requests for their records within HIPAA's timelines.
Where to go next
- Sign your BAA: how the agreement is accepted and where to see it
- Review account activity: who accessed what, who signed in, and what changed
- Data retention and deletion: how long each kind of data is kept