What HIPAA actually requires
HIPAA (the Health Insurance Portability and Accountability Act) applies to Covered Entities (most healthcare providers) and their Business Associates (vendors who handle PHI on their behalf). It requires:
- A signed Business Associate Agreement (BAA) between the Covered Entity and any Business Associate that handles Protected Health Information (PHI).
- Administrative, physical, and technical safeguards for that PHI — access controls, audit logs, encryption, breach notification, etc.
- Minimum necessary access — staff and vendors should only see the PHI they need to do their job.
When your AI receptionist answers a call from your patient, the call audio, the transcript, the patient's name and phone number, and any clinical content they mention are PHI. That means FrontDesk is acting as a Business Associate to your practice.
How FrontDesk meets the technical bar
| Safeguard | How we do it |
|---|---|
| Encryption at rest | AES-256 on all databases, S3 buckets, and audio storage. |
| Encryption in transit | TLS 1.2+ on every API call, WebRTC media, and SIP trunk. |
| Access controls | Per-user roles inside your practice; principle-of-least-privilege internally; SSO and 2FA available. |
| Audit logs | Every PHI access (by your team or by FrontDesk staff) is logged for 6 years. |
| Data residency | U.S.-based AWS regions only. |
| Sub-processors | Listed in-app under Settings → Compliance. All sub-processors that touch PHI have signed BAAs with us. |
| Breach notification | We notify Covered Entities within HIPAA's required 60 days (we target within 72 hours). |
| AI training | Your patient data is never used to train generic AI models. Period. |
How FrontDesk handles the administrative side
- BAA on every qualifying plan. No extra cost, no negotiation friction. See "Sign your BAA" for the request flow.
- Workforce training. All FrontDesk staff with PHI access complete annual HIPAA training.
- Documented policies. Our Security & Privacy Whitepaper is available under NDA on request.
- Incident response. Documented runbooks, on-call rotation, breach disclosure process.
What's still on you
A signed BAA is not a magic wand. You still need to:
- Restrict team access. Don't share logins. Use real per-person team accounts (Settings → Team).
- Don't paste PHI into unrelated tools. Don't copy a transcript into ChatGPT, Slack, or a public ticket.
- Get patient consent where state law requires it for call recording (two-party-consent states). See "Call recording and consent."
- Set a retention policy that matches your practice (Settings → Compliance → Retention). The default is reasonable; some practices want shorter.
- Respond to patient requests for their data within HIPAA's timelines.
Where to go next
- Sign your BAA — the actual how-to.
- Call recording & consent — the state-by-state two-party-consent rules.
- Data retention & deletion — how long we keep calls, transcripts, and patient records, and how to change it.