Guide
Medical answering service: HIPAA rules, triage, on-call paging, and cost
Direct answer
A medical answering service answers your practice's phones after hours or during overflow, sends true emergencies to 911, pages the on-call provider for urgent clinical calls, and takes messages for everything else. Because those messages contain patient information, the service is a HIPAA business associate, so it must sign a Business Associate Agreement (BAA) with your practice before it handles a single patient call. As of October 2026, live services that offer HIPAA handling start around $44 to $250 a month, depending on how many minutes are included. Pick one that signs a BAA, follows your triage script word for word, and can prove how it stores and sends messages.
Does a medical answering service have to be HIPAA compliant?
Yes, if it takes calls from your patients. HHS defines a business associate as a person or company that creates, receives, maintains, or transmits protected health information on behalf of a covered entity. A patient calling at 11 p.m. to say their child's fever won't break is giving the operator protected health information. The service writes it down, stores it, and sends it to your on-call doctor. That makes it a business associate.
Some people assume a phone service is a "conduit," like the postal service, and needs no agreement. HHS limits that exception to companies that only transmit information, and says entities that access PHI on a regular or frequent basis to perform a service are not conduits. An answering service reads and records every message, so the conduit exception doesn't fit.
What the BAA has to do, per HHS:
- Describe what the service may and may not do with patient information
- Bar any use or disclosure beyond what the agreement allows or the law requires
- Require the service to follow the HIPAA Security Rule for electronic records and report security incidents and breaches to you
- Require the service to sign its own BAA with any subcontractor that touches the information
The Security Rule sets administrative, physical, and technical safeguards that both covered entities and business associates must put in place. In practice, that means encrypted message delivery, access controls on the portal, training for operators, and audit logs.
"HIPAA certified" means less than it sounds
There's no government HIPAA certification. HHS says it does not endorse or recognize private organizations' "certifications" under the Security Rule, and those certifications don't relieve a practice of its legal obligations. Third-party audits like HITRUST or SOC 2 are still useful evidence of good controls. The signed BAA and how the service actually handles your messages matter more than a badge on a website.
Questions to ask before you sign
- Will you sign our BAA, or send us yours to review? Is there an extra charge?
- How do messages reach the on-call provider? Plain text messages and regular email are a weak point. Ask whether they use a secure app or portal.
- Are calls recorded? Where are recordings stored, who can listen, and how long are they kept?
- Are operators in the U.S., and are they trained on HIPAA?
- What happens if the on-call provider doesn't answer the page?
- If you use AI on any part of the call, does the BAA cover it?
- Can we get a call log for every after-hours call, with timestamps?
Triage: what the operator does with each call
An answering service operator is not a nurse and should never give medical advice. Their job is to follow your script, sort the call, and get it to the right person fast. Write the script with your providers, keep it short, and give the service a clear rule for anything it isn't sure about: page the on-call provider.
| Caller says | What the service does |
|---|---|
| Chest pain, trouble breathing, signs of stroke, severe bleeding, or any life-threatening emergency | Tells the caller to hang up and call 911 now. No questions first. |
| Urgent clinical concern (high fever in an infant, post-op problem, worsening symptoms) | Takes name, date of birth, callback number, and symptoms, then pages the on-call provider |
| Prescription refill | Message to the office for the next business day, unless your script says some refills page the on-call provider |
| Appointment request or change | Message for the front desk, or books it if your scheduling system and contract allow |
| Test results question | Message for the clinical team. Operators shouldn't read results to callers. |
| Billing, insurance, records requests | Message for the next business day |
| Hospital, pharmacy, or another provider calling | Routed per your script, often straight to the on-call provider |
Two rules prevent most problems. First, the 911 instruction comes before anything else, word for word. Second, the operator never tells a caller a symptom is probably nothing. If a call doesn't fit the script, it goes to the on-call provider.
Many practices also use a nurse triage line for after-hours clinical questions, so a licensed nurse decides whether a call needs the doctor tonight. If your providers are paged too often for things that could wait, ask whether the service offers nurse triage or can connect to one.
Setting up on-call paging
On-call paging fails in boring ways: the schedule is out of date, the provider's phone is on silent, or nobody knows what to do when the page goes unanswered. Before you go live:
- Give the service your on-call calendar and a named person who updates it. MAP Communications, for example, describes a portal where practices schedule which on-call staff to contact.
- Agree on an escalation chain. If the on-call provider doesn't respond in a set number of minutes, the service pages again, then calls a backup provider or practice manager.
- Decide how messages are delivered: secure app, portal, or a phone call from the operator. Avoid sending symptoms by plain text.
- Test it. Call your own line after hours with a fake urgent scenario and time how long it takes the page to arrive.
Medical answering service prices (as of October 2026)
| Service | Published price | What it says about HIPAA |
|---|---|---|
| Specialty Answering Service | $44 a month plus $1.54 a minute, or $159 for 100 minutes. Billed by the second, no setup fee | Says it is a business associate and provides its BAA. On HIPAA accounts it doesn't send PHI by text, email, or other electronic means |
| MAP Communications | $49 a month plus $1.37 a minute, $179 for 125 minutes, $339 for 250 minutes | Lists all plans as HIPAA compliant and reports HITRUST and SOC 2 certification. Its pages don't spell out BAA terms, so ask |
| PATLive | $99 for 50 minutes, $189 for 100, $349 for 200 | Its terms say HIPAA coverage isn't on by default and you must sign a BAA before sending any PHI |
| Ruby | $250 for 50 minutes, $395 for 100, $720 for 200 | Provides a BAA, with no extra charge for HIPAA service |
| AnswerConnect | $350 for 200 minutes plus a $49.99 setup fee | Offers a HIPAA option in its portal. Ask about the BAA |
| Abby Connect | $165 for 50 minutes, $329 for 100 | Says HIPAA options are available for human answering only |
Per-minute pricing adds up fast with medical calls, since collecting a date of birth, symptoms, and a callback number takes time. To estimate your bill, multiply your after-hours call count by an average call length and compare that to each plan's minutes. Our answering service cost guide walks through the math.
Live operators, AI, or both?
Live operators are the safer default for patient calls. They handle distressed callers, accents, and unclear symptoms better, and most services that sign BAAs are built around them. If you consider an AI answering tool for patient calls, check two things first. The BAA must cover the AI, and the vendor must tell you where call audio and transcripts go. Abby Connect, for example, limits its HIPAA options to human answering. For a broader look at the tradeoffs, see AI receptionist vs. answering service.
Where TeamShift fits
It doesn't, for patient calls. TeamShift doesn't sign Business Associate Agreements and makes no HIPAA claim, so it shouldn't answer a medical practice's patient line or handle any patient information. Choose a medical answering service that signs a BAA. For related reading, see our after-hours answering service guide and our dental answering service guide.
FAQ
What is a medical answering service?
A phone answering service set up for healthcare practices. It answers calls when your office is closed or busy, sends emergencies to 911, pages the on-call provider for urgent clinical calls, and takes messages for the office. Because it handles patient information, it needs a signed BAA.
What makes an answering service HIPAA compliant?
A signed Business Associate Agreement with your practice, plus the administrative, physical, and technical safeguards the HIPAA Security Rule requires. That includes secure message delivery, access controls, staff training, and breach reporting. HHS doesn't certify vendors, so ask for the BAA and how messages are sent.
Can the answering service give medical advice?
No. Operators follow your script, tell callers with emergencies to call 911, and get urgent calls to the on-call provider. Clinical decisions belong to your providers or a licensed nurse triage line.
How much does a medical answering service cost?
As of October 2026, published prices start at $44 a month plus $1.54 a minute (Specialty Answering Service) and $99 for 50 minutes (PATLive). Ruby starts at $250 for 50 minutes and doesn't charge extra for HIPAA service. Your total depends on call volume and average call length.
Can I use a regular answering service for my medical office?
Only if it signs a BAA and handles patient messages securely. PATLive's terms, for example, say HIPAA coverage isn't enabled by default and require a BAA before any PHI. A service that won't sign one shouldn't take your patient calls.