When a patient calls to reschedule a visit, a member asks about a denied claim, or a customer checks on a prescription refill, the person who answers is handling protected health information (PHI). If that person works for a call center rather than the hospital, health plan or pharmacy itself, HIPAA still applies, and it applies to both organizations.
This guide explains what a HIPAA-compliant call center is, which HIPAA rules govern it, what safeguards the Security Rule requires, and how those requirements play out for payers, providers, pharmacies, telehealth, MedTech and wellness programs. If you are already comparing vendors, our guide to outsourcing to a HIPAA-compliant call center covers partner evaluation and contract terms in depth.
What is a HIPAA-compliant call center?
A HIPAA-compliant call center is a contact center that handles protected health information on behalf of a healthcare organization as a business associate. It operates under a signed Business Associate Agreement (BAA), implements the HIPAA Security Rule’s administrative, physical and technical safeguards, and follows the Privacy and Breach Notification Rules in every interaction.
In practice, compliance rests on three things working together:
- Contract: a BAA that defines exactly how the center may use and disclose PHI.
- Controls: documented safeguards for people, facilities and systems, backed by a current risk analysis.
- Conduct: agents who verify identity, share only the minimum necessary information and escalate incidents correctly, on every call.
Compliance is not a badge a call center earns once. It is how the operation runs every day, across every channel. That includes phone calls and also email, chat, SMS, patient portal messages and the recordings and notes those interactions leave behind. That is why the terms “HIPAA-compliant call center” and “HIPAA-compliant contact center” are used interchangeably.
| Element | What it means for a call center |
|---|---|
| Legal status | Business associate of a covered entity (or subcontractor of another business associate) |
| Contract | Signed BAA before any PHI is shared |
| Core rules | Privacy Rule, Security Rule, Breach Notification Rule, Enforcement Rule |
| Safeguards | Administrative, physical and technical, documented and reviewed |
| Channels covered | Voice, email, chat, SMS, portals, recordings, CRM notes, reports |
| Accountability | Directly liable to HHS for certain violations, in addition to contract liability |
Who needs a HIPAA-compliant call center?
HIPAA applies to covered entities: health plans, healthcare clearinghouses and healthcare providers that conduct standard electronic transactions such as claims and eligibility checks. It also applies to their business associates, meaning any outside organization that creates, receives, maintains or transmits PHI on their behalf.
A call center that schedules appointments, answers benefit questions, processes refill requests or follows up on bills fits that definition almost automatically. So does any subcontractor the call center uses to handle PHI, such as a telephony platform, transcription service or cloud host. Each of those relationships needs its own BAA.
A covered entity’s in-house call center must meet the same standards. Its agents are part of the covered entity’s workforce, so the organization’s own HIPAA policies, training and safeguards apply to them directly.
Is a call center a business associate under HIPAA? Yes, when it handles PHI for a covered entity. Telephone carriers and internet providers can rely on a narrow “conduit” exception because they only transmit data. A call center cannot, because its agents hear, record, view and act on patient information.
Which HIPAA rules apply to a call center?
Four HIPAA rules shape how a compliant call center operates.
| HIPAA rule | What it requires of a call center |
|---|---|
| Privacy Rule | Use and disclose PHI only as the BAA permits. Apply the “minimum necessary” standard. Support the covered entity when patients exercise their rights, such as access to their records. |
| Security Rule | Protect electronic PHI (ePHI) with administrative, physical and technical safeguards, based on a documented risk analysis. |
| Breach Notification Rule | Notify the covered entity of a breach of unsecured PHI without unreasonable delay, and no later than 60 days after discovery. Many BAAs set shorter deadlines. |
| Enforcement Rule | Accept investigation and civil penalties from the HHS Office for Civil Rights (OCR). Since the 2013 Omnibus Rule, business associates are directly liable for certain violations. |
Other rules often apply alongside HIPAA. PCI DSS governs card payments taken over the phone. CMS requirements govern many Medicare and Medicaid programs. State privacy and call-recording consent laws can add further obligations.
What counts as PHI in a call center?
PHI is any individually identifiable information about a person’s health, care or payment for care that a covered entity or business associate holds. In a call center, it shows up far more often than clinical details. Common examples include:
- a caller’s name linked to an appointment date or visit type
- a health plan member ID, claim status or prior authorization decision
- a prescription name, refill date or pharmacy benefit question
- an outstanding medical bill or payment plan
- the reason for a call, captured in a CRM note or call disposition
Once that information is stored or sent electronically, it becomes ePHI. Call recordings, chat transcripts, text messages, CRM notes, emails and exported reports all qualify. For a step-by-step look at how a single call can expose PHI at multiple points, see where PHI risk appears in an outsourced call center.
The Business Associate Agreement: the legal foundation
No PHI should reach a call center until a Business Associate Agreement is signed. The BAA is the contract HIPAA requires between a covered entity and its business associate. HHS publishes sample BAA provisions that show what the regulation expects.
At a minimum, a BAA must:
- define the permitted and required uses and disclosures of PHI
- require appropriate safeguards, including Security Rule compliance for ePHI
- require reporting of breaches and security incidents to the covered entity
- extend the same restrictions to any subcontractors that handle PHI
- make PHI available so the covered entity can meet patient access, amendment and accounting requests
- make records available to HHS for compliance reviews
- require return or destruction of PHI when the relationship ends
- allow termination if the business associate materially violates the agreement
A signed BAA is necessary, but it does not make a call center compliant on its own. It sets the obligations. The safeguards below are how a call center actually meets them. Healthcare organizations often negotiate stricter terms, such as shorter breach notification windows and audit rights; our guide to outsourcing a HIPAA-compliant call center covers those terms.
The three HIPAA safeguards, applied to a call center
The Security Rule groups its requirements into administrative, physical and technical safeguards. Some implementation specifications are “required.” Others are “addressable,” which means the organization must implement them where reasonable and appropriate or document an equivalent alternative. Addressable never means optional.
Administrative safeguards
Administrative safeguards are the policies, people and processes that govern how ePHI is handled. They are the backbone of a compliant call center, because most contact center incidents start with a human decision rather than a technical failure.
| Security Rule standard | What it looks like in a HIPAA-compliant call center |
|---|---|
| Security management process | A documented risk analysis covering every program, channel and site, plus a plan to reduce the risks it finds |
| Assigned security responsibility | A named security official accountable for HIPAA policies and their enforcement |
| Workforce security | Background checks, role-based access and same-day removal of access when agents leave or change programs |
| Information access management | Agents see only the data their role requires, following the minimum necessary standard |
| Security awareness and training | HIPAA training at onboarding and at least annually, plus program-specific guidance on verification and disclosure |
| Security incident procedures | A defined path for agents to report suspected incidents, with investigation and documentation |
| Contingency plan | Backups, disaster recovery and emergency operations that keep safeguards in place when calls shift to another site |
| Evaluation | Periodic technical and non-technical reviews of whether safeguards still work |
| Business associate contracts | BAAs in place with every subcontractor that touches PHI |
Physical safeguards
Physical safeguards protect the places and devices where PHI is viewed or stored. For a call center, that means production floors, home offices and every workstation an agent uses.
| Security Rule standard | What it looks like in a HIPAA-compliant call center |
|---|---|
| Facility access controls | Badge or biometric entry, visitor logs, CCTV and restricted production areas |
| Workstation use | Clean-desk rules, privacy screens and no personal phones or note-taking on paper in PHI areas |
| Workstation security | Locked or supervised workstations, including secured home-office setups for remote agents |
| Device and media controls | Tracked hardware, secure reuse procedures and certified disposal of any media that held ePHI |
Technical safeguards
Technical safeguards are the controls built into systems that store, process or transmit ePHI. In a modern contact center they must cover every channel, not only the phone.
| Security Rule standard | What it looks like in a HIPAA-compliant call center |
|---|---|
| Access control | A unique user ID for every agent (no shared logins), automatic logoff and encryption of stored ePHI |
| Audit controls | System logs that record who accessed which records and when, with regular review |
| Integrity | Controls that prevent ePHI from being improperly altered or deleted |
| Person or entity authentication | Strong login verification, typically multi-factor authentication for agents and administrators |
| Transmission security | Encryption of ePHI moving across networks, including VoIP, email, chat and SMS platforms |
Two of these, encryption and multi-factor authentication, are treated as baseline expectations today even though the current rule lists encryption as addressable. A proposed update to the Security Rule would make both mandatory, as explained below. Remember too that system authentication and caller authentication are different controls. A well-run center also verifies every caller’s identity before discussing PHI, because many disclosure incidents involve no hacking at all.
How HIPAA compliance looks across healthcare segments
The HIPAA rules are the same everywhere, but the calls, data and companion regulations differ by segment. A HIPAA-compliant call center adapts its workflows to each.
Health plans and payers
Health plans are covered entities, so member services, enrollment, claims, grievance and appeals calls all involve PHI. Verification must confirm that the caller is the member or an authorized representative before any benefit or claim detail is shared. Medicare Advantage, Part D and Medicaid programs add CMS and state contract requirements on top of HIPAA. Those can include call monitoring standards and rules about offshore work. Learn more about our health plan services.
Healthcare providers
Hospitals, health systems, medical groups and clinics generate high volumes of scheduling, patient inquiry and billing calls. Common compliance pressure points are family members calling on a patient’s behalf, voicemail content and requests for records. Agents need clear rules on who counts as a personal representative and what may be left in a message. See our healthcare provider services.
Pharmacies and PBMs
Refill requests, benefits investigation, prior authorization follow-up and delivery updates all involve PHI. When patients pay by card, PCI DSS applies alongside HIPAA, so card details must be kept out of call recordings through pause-and-resume or masking. Many pharmacy programs also need bilingual support with the same safeguards in every language. Explore our pharmacy BPO services.
Telehealth and virtual care
Telehealth contact centers handle visit scheduling, technical support and follow-up across video, chat and phone. Every platform in the chain, from the video service to the messaging tool, needs to be covered by a BAA and configured securely. Read how telehealth contact centers support virtual care, or see our telehealth services.
MedTech and DME companies
HIPAA’s reach in MedTech depends on the business model. DME suppliers that bill insurers are covered entities. Device manufacturers often are not, unless they act for a provider or plan. Programs that capture complaints and adverse event reports for the FDA have their own documentation rules, and HIPAA permits certain disclosures for that public health purpose. See our MedTech services.
Health and wellness programs
Wellness is where HIPAA’s boundaries matter most. A wellness program offered through an employer’s group health plan, or on behalf of a health plan or provider, is generally covered by HIPAA. A direct-to-consumer app or brand acting on its own usually is not. It may instead fall under the FTC’s Health Breach Notification Rule and state consumer health privacy laws. Either way, health data deserves the same level of protection. Read about human-guided wellness navigation or see our health and wellness services.
Common misconceptions about HIPAA-compliant call centers
- “A signed BAA makes us compliant.” The BAA sets obligations. Compliance depends on whether the safeguards behind it work every day.
- “There is an official HIPAA certification.” HHS does not certify or endorse any HIPAA certification program. Third-party assessments, SOC 2 reports and ISO/IEC 27001 certification are useful evidence of strong controls, but none of them is a government HIPAA credential.
- “Offshore call centers can’t be HIPAA compliant.” HIPAA does not prohibit offshore handling of PHI. The same safeguards apply at every location. Some CMS programs, state contracts and client agreements do restrict where PHI may be accessed, so location must be checked against each program’s obligations.
- “HIPAA only covers phone calls.” It covers PHI in any form, including email, chat, SMS, recordings, CRM notes and reports.
- “Encryption is optional because it’s addressable.” Addressable means implement it or document why an equivalent measure is reasonable. For a contact center sending ePHI across networks and cloud platforms, encryption is the expected baseline.
The cost of non-compliance
OCR enforces HIPAA through civil money penalties set in four tiers based on culpability. For penalties assessed on or after January 28, 2026, the inflation-adjusted amounts are:
| Penalty tier | Minimum per violation | Maximum per violation |
|---|---|---|
| Tier 1: did not know | $145 | $73,011 |
| Tier 2: reasonable cause | $1,461 | $73,011 |
| Tier 3: willful neglect, corrected within 30 days | $14,602 | $73,011 |
| Tier 4: willful neglect, not corrected | $73,011 | $2,190,294 |
The calendar-year cap for violations of an identical provision is $2,190,294. Under a 2019 enforcement discretion policy, OCR applies lower annual caps to tiers 1 to 3. Amounts are adjusted for inflation each year.
Civil penalties are only part of the exposure. Knowingly obtaining or disclosing PHI in violation of HIPAA can bring federal criminal penalties of up to $250,000 and 10 years in prison in the most serious cases. State attorneys general can also bring HIPAA actions. Most OCR resolutions also require multi-year corrective action plans, and a publicized breach can cost far more in lost trust than any fine.
What’s changing: the proposed HIPAA Security Rule update
HHS proposed the first major overhaul of the Security Rule in January 2025. As of this update, it has not been finalized, and OCR continues to enforce the current rule. If adopted as proposed, it would:
- remove the “addressable” category, making encryption of ePHI at rest and in transit mandatory
- require multi-factor authentication for access to systems containing ePHI
- require a written technology asset inventory and network map
- require vulnerability scanning at least every six months and penetration testing at least annually
- require plans to restore critical systems within 72 hours of an incident
- require covered entities to obtain written verification of their business associates’ safeguards at least once a year
That last change matters most for call centers. Healthcare organizations would need documented evidence of a vendor’s controls, not just a signed BAA. Call centers that already encrypt every channel, enforce MFA and keep current independent audit reports will be ready when the final rule arrives.
HIPAA compliance, AI and automation
Speech analytics, real-time agent assist, automated transcription and AI-driven quality monitoring are now common in healthcare contact centers. Each of these tools processes PHI, so each must be covered by a BAA, configured to the minimum necessary standard and included in the risk analysis. Agents should never paste PHI into consumer AI tools that are not covered by an agreement.
Used well, AI strengthens compliance. Automated monitoring can review far more interactions than manual sampling and flag a missed verification step or an inappropriate disclosure quickly. Ameridial’s AI-driven quality monitoring scores compliance behaviors alongside service quality, with humans reviewing every flag. Learn more about how AI agent assist works in healthcare call centers.
How Ameridial operates as a HIPAA-compliant call center
Ameridial has supported healthcare contact center programs since 1987, serving health plans, providers, pharmacies and PBMs, MedTech and DME companies, telehealth platforms and wellness programs. Every program runs on the same foundation:
- a signed BAA before any PHI is shared, with subcontractor BAAs throughout our vendor chain
- role-based, minimum necessary access, reviewed whenever agents move between programs
- HIPAA training at onboarding and annually, plus program-specific verification and disclosure procedures
- encryption and multi-factor authentication across voice, email, chat and SMS
- AI-assisted quality monitoring that checks compliance on every scored interaction
- defined incident escalation and breach notification procedures
- independently audited controls, including SOC 2 Type II, ISO/IEC 27001 and PCI DSS (see our certifications)
We deliver from onshore, nearshore and offshore centers, and we apply the same safeguards at every site. Where a program’s contract or regulator restricts location, we build the delivery model around that requirement. Our healthcare compliance and risk management services extend the same discipline to regulated payer operations.
Compliance is how the call center runs
A HIPAA-compliant call center is not defined by a certificate or a single technology. It is defined by a signed BAA, safeguards that work in daily operation, and agents who protect PHI on every call, chat and message. For healthcare organizations, that is the standard to expect from any team that speaks to patients and members on their behalf.
If you are deciding whether to keep patient and member support in-house or bring in a partner, read why healthcare organizations outsource contact center work. When you are ready to talk through your program, book a consultation with Ameridial’s healthcare team.
