HIPAA & PIPEDA Controls

The paperwork you should expect

Any vendor that answers your patients' calls handles protected health information, so it is a business associate. MedReception AI's HIPAA compliance is verified by Compliancy Group, and a Business Associate Agreement is included with the service rather than negotiated as an extra.

Read the BAA alongside your existing ones for eClinicalWorks and your phone vendor. Your compliance officer should be comfortable with all three, since each touches the same patient information at a different point.

Keep the signed BAA where your compliance records live, and note the date it was signed. Auditors ask for it, and it is easier to produce if it is filed with the others.

Canadian clinics

For clinics in Canada, MedReception AI operates under PIPEDA, and under PHIPA for clinics in Ontario. Ask early about any additional requirements your province or health authority applies, so they are settled before launch rather than after.

Privacy terms differ between the two countries, so a group with clinics on both sides of the border should review each set of obligations separately rather than assume one covers the other.

Minimum necessary on the phone

Privacy on calls is mostly about what is said aloud and what is written down. Katie asks only for what the call requires: identity, the request and the details your rules list. She does not read test results, diagnoses or chart contents to callers.

Texts that follow a call stick to the practice name and logistics such as an appointment time. Clinical details stay out of text messages entirely.

Limits built into the role

With MedReception Autopilot, filing a call summary to the eClinicalWorks chart happens from a staff member's own signed-in browser, inside the access that person already has.

These limits are not settings a practice can switch off. They define the job: a receptionist that answers, books within your rules, records and routes, and leaves everything clinical to clinicians.

• No medical advice and no clinical decisions
• No prescription approvals or changes
• No editing of clinical notes or orders
• No card payments taken on the call
• Clinical questions handed to clinical staff

Questions for your compliance officer

Before launch, walk your compliance lead through a few real call types: a caregiver calling for a parent, a refill request, a billing question, an after-hours symptom call. Ask them where each summary goes, who can see it, and whether that matches your policies. Adjust routing until the answer is yes for every one.

Then add MedReception AI to your list of business associates and your annual risk assessment, the same way you track your EHR and phone vendors. A vendor that touches patient information belongs in the assessment even when nothing has gone wrong.