Does your phone, text or fax provider need to sign a BAA?

What makes a phone, texting or fax vendor a business associate?

A vendor is a business associate when it handles protected health information for the practice, in any of four ways named in the regulation.

The definition is in 45 CFR 160.103. A business associate is a person who, on behalf of a covered entity and other than as a member of its workforce, “creates, receives, maintains, or transmits protected health information” for a function or activity regulated by HIPAA. The same definition adds a person “that provides data transmission services with respect to protected health information to a covered entity and that requires access on a routine basis to such protected health information”. It also adds a person that offers a personal health record on the covered entity’s behalf.

Each of the four verbs maps to something a communications vendor does.

• Creates: a transcription or AI summary service generates a new record of a patient conversation.
• Receives: a texting platform receives a patient’s reply about symptoms or an appointment.
• Maintains: a hosted phone system stores voicemail; a fax service stores inbound documents; a texting app stores the thread.
• Transmits: a carrier moves the call, the text or the fax from one end to the other.

The first three almost always make the vendor a business associate. The fourth is where the conduit exception lives.

PHI itself is defined broadly. Individually identifiable health information held or transmitted by a covered entity in any form or medium, oral, paper or electronic, is PHI. A voicemail that says a patient’s name and “your results are back” is PHI. A text confirming a dental appointment is PHI. A faxed referral is PHI. The medium does not matter; the content and the identifiability do.

What is the conduit exception, and when does a phone carrier qualify?

The conduit exception covers vendors that only transmit PHI and do not access it except randomly or infrequently as needed to deliver it. It is narrow, and HHS has said so repeatedly.

HHS’s business associate guidance states that the Privacy Rule does not require business associate contracts with pure conduits. Its examples are the US Postal Service, certain private couriers and their electronic equivalents that merely carry PHI. In the 2013 Omnibus Rule preamble, HHS described a conduit as an entity that “transports information but does not access it other than on a random or infrequent basis as necessary to perform the transportation service or as required by other law”. It added that the exception “is limited to transmission services (whether digital or hard copy), including any temporary storage of transmitted data incident to such transmission” (78 FR 5571–5572).

The same preamble drew the line that matters for phone systems. A data storage company with access to PHI is a business associate “even if the entity does not view the information or only does so on a random or infrequent basis”. Transmission with temporary buffering is a conduit. Storage is not.

HHS’s cloud computing guidance applied the same test to hosted services. A cloud service provider that stores electronic PHI is a business associate even when it holds only encrypted data and lacks the decryption key, an arrangement HHS calls “no-view services”. The guidance says a cloud provider cannot rely on the conduit exception unless its only service is transmission with no storage beyond what is temporary and incidental to that transmission.

Applied to a phone provider:

• A carrier that only connects live calls, with no voicemail, recording or transcription stored for the practice, is close to the conduit model. Access to call content is incidental to transmission.
• A hosted VoIP provider that stores voicemail, even for a few days, maintains PHI. The exception does not apply.
• A provider that records calls or produces transcripts and AI summaries creates and maintains PHI.
• A texting platform stores messages so the practice can read them later. Storage is the service. Not a conduit.
• An online fax service receives documents and holds them until retrieved. Not a conduit.
• An internet service provider carrying the practice’s encrypted VoIP packets is the classic electronic conduit.

Almost every modern business phone system stores voicemail. In practice, the conduit exception rarely covers a hosted phone system used by a practice, and never covers its texting and fax features.

Which channels create PHI a vendor holds?

The table applies the four verbs to each channel a practice uses. The “PHI likely” column asks whether patient-identifying health information will realistically pass through the channel. The “BAA needed” column asks whether the vendor creates, receives, maintains or transmits it beyond a pure conduit role.

Two cautions. First, “PHI likely” is a practical judgment, not a legal test; a channel the practice intends to keep free of PHI will still carry it the first time a patient replies with a symptom. Second, whether a particular vendor is a conduit depends on what it actually does, not on what its marketing calls it. Ask the vendor in writing whether it stores any content, for how long and who can access it.

What must the BAA say?

A BAA is not a letter of comfort. 45 CFR 164.504(e)(2) lists specific terms, and an agreement missing them does not satisfy 164.502(e).

Under 164.504(e)(2)(i), the contract must establish the permitted and required uses and disclosures of PHI by the business associate. It may not authorize uses that would violate the Privacy Rule if done by the covered entity. Under 164.504(e)(2)(ii), it must provide that the business associate will:

• (A) not use or further disclose the information other than as permitted by the contract or required by law;
• (B) use appropriate safeguards and comply, where applicable, with the Security Rule (subpart C of part 164) for electronic PHI;
• (C) report to the covered entity any use or disclosure not provided for by the contract, including breaches of unsecured PHI as required by 45 CFR 164.410;
• (D) ensure that any subcontractors that create, receive, maintain or transmit PHI on its behalf agree to the same restrictions and conditions;
• (E) make PHI available for patient access under 164.524;
• (F) make PHI available for amendment under 164.526;
• (G) make the information needed for an accounting of disclosures available under 164.528;
• (H) comply with the Privacy Rule to the extent it carries out a covered entity’s obligation;
• (I) make its internal practices, books and records available to the Secretary of HHS;
• (J) at termination, return or destroy all PHI, if feasible, or extend the protections if return or destruction is infeasible.

Under 164.504(e)(2)(iii), the contract must authorize termination by the covered entity if the business associate violates a material term.

For a communications vendor, items (B), (C), (D) and (J) deserve the closest reading. Item (B) is where encryption in transit and at rest, access controls and audit logs belong. Item (C) sets the breach-reporting timeline; the regulation requires reporting without unreasonable delay, and many agreements set a specific number of days. Item (D) matters because phone, text and fax vendors use carriers, SMS aggregators and cloud hosts as subcontractors. Item (J) determines what happens to years of voicemail, texts and faxes when the practice leaves.

Note also what a BAA cannot do. It cannot make a vendor that refuses to encrypt or log compliant by signature alone, and it does not transfer the covered entity’s own obligations. The practice still owns the risk analysis under 45 CFR 164.308(a)(1).

What if the vendor will not sign, or signs only for some features?

If a vendor will not sign, the practice cannot let it handle PHI. If it signs for some features and not others, PHI must stay out of the excluded features.

45 CFR 164.502(e) is a condition on the disclosure itself. Without the written agreement, the covered entity may not permit the vendor to create, receive, maintain or transmit PHI on its behalf. The consequence falls on the practice, not only on the vendor. HHS’s cloud guidance notes that a business associate without a signed agreement is still bound by the HIPAA Rules directly. The covered entity, however, lacks the contractual protections and is itself out of compliance for the disclosure.

Partial coverage is the more common problem. Some vendors execute a BAA for voice service but exclude texting, or cover texting only on a higher plan, or exclude fax that contains PHI. Several vendors in the Practice Phone Price Index publish notes like these. A practice using such a vendor has to keep PHI out of the uncovered channel in practice, which usually means turning the feature off. A reminder text that includes a provider’s name and an appointment type is PHI, so “we only send reminders” is not a safe boundary.

Three questions settle most of this before signing.

1. Which channels does the BAA cover? Ask for calls, voicemail, recordings, transcripts, texts and fax to be named.
2. Which features are disabled in HIPAA mode? Some vendors disable voicemail-to-email or email-to-fax on BAA accounts. The practice should know that before go-live.
3. Who are the subcontractors? Carriers, SMS aggregators and cloud hosts should be covered by the vendor’s own downstream agreements under 164.504(e)(2)(ii)(D).

The 3-year comparison of one platform against separate vendors counts how many of these agreements each setup requires.

What about law firms and financial firms?

Law firms and financial firms are not HIPAA covered entities, so their own client communications do not require a BAA. Their phone, text and fax vendors are governed by other duties.

A law firm’s duty comes from professional conduct rules. ABA Model Rule 1.6(c) requires reasonable efforts to prevent unauthorized disclosure of client information, and state rules follow it. A vendor that stores voicemail, texts and faxes holds privileged material, so the firm should look for confidentiality terms, encryption and access controls that would satisfy a reasonable-efforts analysis. The law practice guide covers this frame.

A broker-dealer’s duty comes from recordkeeping rules. SEC Rule 17a-4 and FINRA Rule 4511 require preservation of business communications, and the SEC’s off-channel enforcement actions since 2022 targeted texts on personal devices. The vendor question is preservation and supervision rather than a BAA. The financial practice guide covers it.

One exception: a law firm, accountant or consultant that performs services for a covered entity and handles its PHI, such as a healthcare lawyer reviewing patient records, is itself a business associate under 45 CFR 160.103(1)(ii). That firm’s own vendors holding the PHI are subcontractor business associates. Counsel should review that chain.

How ZentryVoice handles this

ZentryVoice is a unified communications platform for medical, dental, legal and financial practices: calls, encrypted two-way texting, eFax, transcribed voicemail and AI call summaries on one number, for $20 per user per month, month-to-month, with a BAA countersigned at signup.

• One agreement for every channel. The Business Associate Agreement is presented for e-signature during signup and countersigned by ZentryVoice before texting or fax can be enabled on a medical or dental account. It covers calls, voicemail, recordings, transcripts and AI summaries, texting and fax on the same account, so there is no uncovered channel to police. The agreement text is at /legal/baa.
• Safeguards that item (B) points to. SIP over TLS and SRTP for calls and texts in transit, encryption at rest, role-based access control and one immutable audit log across channels. Details are on the security page.
• Subcontractors. Carrier and messaging subcontractors are bound by downstream agreements as 164.504(e)(2)(ii)(D) requires.
• Other verticals. Law firms receive a Confidentiality and Privilege Addendum; financial firms receive a Recordkeeping and Supervision Addendum.
• Price. $20 per user per month, with texting and eFax at $15 per practice per month each; see the pricing page. The BAA is included at no extra charge and is not gated to a higher tier.

The medical and dental guides cover the rest of the HIPAA frame, and what a unified communications platform is explains why one agreement is easier to keep than three.