SimplePractice HIPAA Phone Compliance

Where PHI leaks on a therapy practice's phones

Most HIPAA risk on the phones of a small behavioral health practice is not dramatic. It is a sticky note with a client's name and "wants to talk about her divorce" left on a shared desk. It is voicemail on a clinician's personal cell phone, played on speaker in a coffee shop. It is a receptionist confirming an appointment to a caller who turns out to be an estranged spouse. It is a detailed message left on a home answering machine that a family member hears first.

Phone handling deserves the same attention you give to your EHR and your email, because in therapy practices it carries just as much sensitive information.

Behavioral health adds weight to every one of these slips. A disclosed appointment can reveal that someone is in therapy at all, which for many clients is itself the sensitive fact. A careless callback can expose a client to a partner they are trying to leave.

The agreements in place

MedReception AI signs a Business Associate Agreement with every practice; it is included, not an upgrade. The company's HIPAA compliance is verified by Compliancy Group, an independent compliance firm. Those two things are the baseline any practice should require from a vendor that hears client conversations.

Behind them, the operating principle is simple: calls end in a structured summary for your staff, rather than in loose notes or a voicemail box someone checks from home.

Your privacy rules, applied on every call

Most phone privacy problems come from inconsistent handling. Katie applies the rules you set the same way every time:

• The identifying details Katie asks for, so staff can match each call to the right client
• What may be said, and what may not, to someone calling about another person
• Whether a client allows voicemails or texts, and what they may say
• Records, subpoena and attorney calls routed to the person your policy names
• Clinical questions sent to clinical staff, never answered by the AI

What remains your responsibility

No vendor can make a practice HIPAA compliant on its own. Your practice still needs its own policies, a risk assessment, staff training, and procedures for releasing records. MedReception AI covers its part of the chain and follows the rules you give it; how your staff handle summaries once they act on them in SimplePractice is governed by your practice's policies.

MedReception AI is live with practices on SimplePractice, and the BAA covers the calls and summaries it handles for them. If your compliance advisor has a vendor questionnaire, send it during evaluation; it is easier to settle those questions before launch than after.