HIPAA-compliant call center software is any tool that handles patient calls under a signed Business Associate Agreement (BAA) and with the safeguards the HIPAA Security Rule requires. That covers every system a call passes through: call recording, transcription, quality assurance (QA), analytics and any AI that summarizes or scores the call. The vendor signs the BAA and supplies the safeguards. Your team decides who hears which calls. Below: what HIPAA asks of these tools, the questions to put to every vendor, and Ender Turing's own answers as a reference point.
The short answer
Before the first patient call reaches a new tool, confirm eight things:
- A signed BAA on the plan you will actually buy, with the vendor's own subcontractors covered.
- Encryption of every recording and transcript, in transit and at rest.
- Access by role, so each person opens only the calls their job needs, with single sign-on (SSO) and multi-factor authentication (MFA).
- Audit logs that show who listened to, exported or deleted what.
- Redaction of sensitive details in transcripts and audio.
- Retention you set, so recordings are deleted on your schedule, not the vendor's.
- Hosting you choose: a US region, your private cloud or your own data center.
- A breach-notice promise far shorter than HIPAA's 60-day outer limit.
What HIPAA requires of call center software
HIPAA's Privacy, Security and Breach Notification Rules apply to health plans, health care clearinghouses and health care providers that transmit health information electronically, and certain provisions apply directly to their business associates.
A business associate is a vendor that creates, receives, maintains or transmits protected health information (PHI) on a covered entity's behalf. HHS lists cloud service providers that store electronic PHI, an AI chatbot on a patient portal and transcription vendors among its examples. The conduit exception covers only services that transmit PHI, such as the postal service; a vendor that accesses PHI regularly to perform a service is not a conduit. Recording, transcription and QA tools store and analyze calls, so they sit on the business-associate side of that line.
Since the HITECH Act and the 2013 Omnibus Rule that implemented it, HHS can take enforcement action directly against business associates that violate the Security Rule. Its technical safeguards ask five things of any system that holds electronic PHI:
- Access control: only authorized persons reach the data.
- Audit controls: activity in the system is recorded and can be examined.
- Integrity: the data is not improperly altered or destroyed.
- Authentication: the system verifies that a person is who they say they are.
- Transmission security: data sent over a network is protected from unauthorized access.
The Security Rule also requires that access be granted only when it fits a person's role, consistent with the Privacy Rule's minimum-necessary standard. Every workforce member must be trained on the organization's security policies and procedures.
If a vendor has a breach of unsecured PHI, it must tell you without unreasonable delay and no later than 60 days after discovering it. PHI encrypted the way HHS guidance specifies is not "unsecured," so losing it does not trigger breach notification.
Civil penalties range from $145 to $2,190,294 per violation, depending on culpability, with a calendar-year cap of $2,190,294 (45 CFR 102.3, 2025 amounts).
Every tool a patient call touches needs a BAA
A patient call can pass through five or six systems. Any vendor that stores, transcribes, scores or summarizes it handles PHI and needs a BAA with you:
- Contact center platform: routes the call and often records it.
- Call recording: stores the audio.
- Transcription and speech analytics: turn the audio into searchable text.
- QA and scorecards: score the call and keep reviewers' notes.
- AI summaries and assistants: send transcripts to a language model.
- CRM and reporting: receive call notes, summaries and exports.
Then ask two more questions:
- Who are your subcontractors? HHS requires a business associate to sign a BAA with each subcontractor before passing it PHI, so the chain must cover the vendor's cloud host, speech recognition and AI model provider.
- Where does the AI run? If a summary or chat feature sends transcripts to an outside model provider, that provider is a subcontractor handling PHI.
For the wider choice between outsourced services, phone software and analytics, see healthcare call center solutions.
The vendor checklist, with Ender Turing's answers
Ask every vendor the same questions. HIPAA work at Ender Turing runs on the Enterprise plan, so the answers in the third column are the Enterprise plan's.
| Check | Ask the vendor | Ender Turing's answer |
|---|---|---|
| BAA | On which plan do you sign a BAA? | On the Enterprise plan, with hosting in the US region or fully on-premise |
| Encryption | How are recordings and transcripts encrypted, and who holds the keys? | TLS 1.3 in transit and AES-256-GCM at rest; customer-managed keys available |
| Access by role | Can we limit each user to the calls their role needs? | Role-based access with custom roles, scoped to a team or to a user's own conversations |
| Sign-in | Do you support SSO and MFA? | SSO through SAML 2.0 or OIDC; MFA required for every admin account |
| Audit logs | What is logged, can logs be changed, and how long are they kept? | Every action is logged; logs are immutable, kept to your policy (7 years by default) and available through the API for your SIEM |
| Vendor staff access | Can your staff open our recordings? | Only on your explicit support request, and every access is audit-logged |
| Redaction | Can you mask sensitive details in transcripts and audio? | Anonymization set per language: sensitive words you list are redacted, and audio is masked around detected sensitive content |
| Retention | Can we set how long recordings are kept? | You set the maximum number of days audio files are stored |
| Hosting | Where is PHI stored, and can it stay in our environment? | The US region, or your private cloud (AWS, GCP, Azure) or fully on-premise with speech recognition inside your own environment |
| Breach notice | How fast do you tell us about an incident? | Within 72 hours of any incident affecting customer data |
| Evidence | Can we see a SOC 2 Type II report and penetration-test results? | Both, in the Trust & Compliance pack under NDA; a third-party firm runs penetration tests every year |
Sources: Ender Turing's data security page and Help Center articles on anonymization, roles and permissions and general settings, checked October 2026.
Score every patient call without widening access
In manual QA, coverage and privacy pull against each other: hearing more calls means more people hearing PHI. AI QA changes that trade-off. Ender Turing listens to every conversation and scores it on your own scorecard, so reviewers spend their time on the calls that need a person: critical calls, disputes, calibration and coaching.
AutoQA scores 100% of conversations, typically in 95%+ agreement with your own reviewers. The accuracy is shown for every scorecard point, and the accuracy-improvement workflow rewrites point definitions from their reviews. Across 50+ contact-center deployments, the averages are 100% of calls automatically scored versus a 3–5% manual baseline, +19% customer satisfaction, −15% average handle time, and 68 QA hours saved per specialist per month (case studies).
Ender Turing is HIPAA compliant: on the Enterprise plan it signs a Business Associate Agreement (BAA) with healthcare customers, with hosting in the US region or fully on-premise. On Enterprise, it runs in your private cloud (AWS, GCP, Azure) or fully on-premise, with speech recognition, services and monitoring inside your own environment and no cloud access needed. It analyzes calls in any language. Ender Turing is rated 4.8 out of 5 on G2.
See how it fits a healthcare contact center on the healthcare page, or request a demo to start the BAA conversation.
A HIPAA routine for the QA team
- Grant access by role. A team lead sees their own team's calls; an agent sees their own.
- Turn on anonymization before patient calls are processed. It applies to new transcripts, not to ones already processed.
- Keep transcripts out of tools without a BAA. Pasting a call transcript into a general-purpose chatbot discloses PHI to a vendor you have no BAA with.
- Review the audit log every month. Look for bulk exports and listening outside a reviewer's own team.
- Set retention to your records policy, then check that old recordings are gone.
- Train every reviewer on your security policies and procedures, as the Security Rule requires for all workforce members.
More on running the floor: healthcare call center best practices.
FAQ
Does call center software need a BAA under HIPAA?
Yes, when the vendor creates, receives, maintains or transmits PHI for a covered entity or for another business associate. Recording, transcription, QA and analytics tools store and analyze calls, so they need one. A carrier that only transmits calls can fall under the conduit exception.
Is Ender Turing HIPAA compliant?
Yes. Ender Turing is HIPAA compliant: on the Enterprise plan it signs a Business Associate Agreement (BAA) with healthcare customers, with hosting in the US region or fully on-premise.
Can AI score calls that contain patient information?
Yes, under a BAA. HIPAA lets a covered entity disclose PHI to a business associate that gives written assurances, in a BAA, that it will safeguard the information. Check that the BAA also covers any model provider the AI uses.