Compliance & Security

HIPAA-Compliant AI IVR Replacement with Full Call Encryption and Audit Trail

Replace legacy IVR systems with AI that meets HIPAA, state privacy, and medical regulatory requirements. All calls encrypted, PHI handled per your compliance policy, audit logs ready for inspections.

All calls encrypted end-to-end; no unencrypted patient data in transit or at rest
HIPAA Business Associate Agreement (BAA) included; your practice remains liable; MedReception is a covered service provider
Audit logs capture every call: timestamp, caller info, options selected, data captured, staff actions, and dispositions
Automatic retention and deletion policies: define how long calls and recordings are kept; auto-purge on schedule
PHI handling built in: medical history, allergies, medication lists, insurance info never auto-populate; returned as secure summary for staff review
State-specific compliance: supports HIPAA, CCPA (California), PIPEDA (Canada), and similar state/provincial privacy frameworks

How it pays back

Regulatory Inspections Ready

Audit logs, encryption certificates, and BAA documentation available on demand. No surprises during HHS or state audits.

Patient Data Never Exposed in Motion

All calls and patient information encrypted. MedReception staff cannot access your patient records; you control all keys and retention.

Compliance Policies Automated

Set retention rules once; calls and recordings auto-delete after 30, 60, 90 days, or per your practice's policy. No manual purging or accidental data lingering.

Staff Accountability Built In

Every action logged: which staff member accessed a call, when, for how long. Supports compliance training and breach investigation.

HIPAA BAA included

Covered service provider; audit-ready documentation

Complete audit logs

Timestamp, caller, options, data, staff actions, and dispositions

Automatic data retention policies

Auto-delete calls and recordings per your compliance schedule

Frequently asked questions

Does MedReception need a HIPAA BAA?

Yes. A HIPAA BAA is included with every account. It defines MedReception as a Business Associate and outlines our obligations to encrypt, audit, and protect PHI. You remain the Covered Entity and are ultimately liable for HIPAA compliance.

Are calls and recordings encrypted?

Yes. All calls are encrypted end-to-end using AES-256 or equivalent. Recordings are encrypted at rest. Only authorized staff in your practice can access call data; MedReception staff cannot.

What information is logged for audit purposes?

Timestamp, caller phone number (masked for privacy), reason for call, menu options selected, patient data captured, which staff member accessed the call, when they accessed it, and the final disposition (appointment booked, escalated, etc.).

Can we set automatic deletion policies for calls and recordings?

Yes. You define a retention period (30, 60, 90 days, or custom). Calls and recordings outside that window are automatically deleted. You can also manually request deletion of specific calls.

Does the AI share patient data with third parties?

No. All patient data is retained within your practice's MedReception account and your EMR. We do not sell, share, or use patient data for any purpose other than fulfilling the call and appointment booking.

Are we compliant with state privacy laws (CCPA, etc.)?

MedReception's encryption, data handling, and retention policies support HIPAA, CCPA, PIPEDA, and similar state/provincial regulations. We recommend consulting your compliance officer to confirm your specific obligations.