HIPAA-Compliant Answering Service for Therapists: What to Check
Every answering service that serves healthcare says it is HIPAA compliant. For a therapy practice, that phrase on a website isn't enough. The calls include diagnoses, medications, and sometimes a crisis, and the practice is responsible for who handles them.
Short answer
A HIPAA-compliant answering service for therapists signs a Business Associate Agreement with your practice, protects call recordings, transcripts, and texts, limits and logs who can see them, has a defined retention policy, and, if you treat substance use disorders, handles 42 CFR Part 2 records. Ask for the signed BAA before routing a single patient call.
The checklist
- A signed BAA. The one document that makes the service accountable under HIPAA. "HIPAA compliant" in marketing is not a substitute.
- Recordings and transcripts. Where they are stored, how they are encrypted, and who can play them back.
- Texts. If the service texts patients, those messages are covered too, and shouldn't live on personal phones.
- Access and audit. Named users, and a record of who did what.
- Retention. How long calls and messages are kept, and how they are deleted.
- Subcontractors. Any AI model or telephony provider underneath should be covered.
- 42 CFR Part 2. Stricter rules for substance use disorder records, if you treat SUD.
What popular services state on their own sites
| Service | What its site says | Ask for |
|---|---|---|
| Ruby | Lists "HIPAA-compliant receptionists" | A signed BAA |
| Smith.ai | No HIPAA or BAA mention; recordings deleted after three months | Whether it signs a BAA at all |
| Weave | AI Receptionist "designed to meet and exceed the standards of HIPAA" | A signed BAA |
| Spruce Health | BAA automatically for eligible organizations | Confirmation you're eligible |
| Stable | Signs a BAA | The BAA, and the crisis protocol |
Vendor details checked against each company's own website on November 4, 2026. Confirm specifics, including BAA terms, with each vendor before deciding.
Beyond HIPAA: what therapy calls need
Compliance is the floor. A therapy practice's answering service also needs a defined path for crisis calls, no clinical advice, and a way to get callers booked rather than waiting for a callback. See crisis calls and AI vs traditional answering services.
How Stable handles it
Stable signs a BAA, keeps every call's summary, transcript, and recording in one place your team controls, keeps internal notes away from patients, and transfers crisis calls to the number your practice provides, such as your on-call clinician, or to 988. See Is AI HIPAA compliant?
Frequently asked questions
What makes an answering service HIPAA compliant?
A signed Business Associate Agreement with your practice, plus safeguards for recordings, transcripts, and texts, controlled access, and a retention policy.
Does an answering service need to sign a BAA with a therapist?
Yes, if it handles patient information on the practice's behalf, which an answering service does.
Are call recordings covered by HIPAA?
Yes. Recordings and transcripts of patient calls are protected health information.
Does Stable sign a BAA?
Yes.
Compliant, and it finishes the call.
See Stable answer under a BAA, book the patient, and keep every call on the record.
Book a Demo