People type "HIPAA answering service" into a search box when they want a desk that will not get the practice in trouble. The phrase sounds like a category, the way "board-certified" sounds like a category. It is not. The U.S. Department of Health and Human Services (HHS) does not certify answering services. There is no federal HIPAA badge a vendor can hang on the homepage that ClinicOnCall, or anyone else, can verify as a government grant.
What you can actually buy is a vendor that will sign a business associate agreement (BAA) before it hears protected health information (PHI), plus a security posture your counsel is willing to accept. This page explains that split. It is not legal advice. ClinicOnCall does not certify vendors. We do not sell a HIPAA seal.
BAA versus certification
A BAA is a contract. Under the HIPAA Privacy and Security Rules, a covered entity may disclose PHI to a business associate only after it obtains satisfactory assurances, in writing, that the associate will safeguard that information. HHS publishes this in its Business Associates guidance, last reviewed July 30, 2026 on the HHS site. The required terms live at 45 CFR 164.504(e).
Certification, in the way sales pages use the word, is something else. HHS does not run a HIPAA certification program for answering services. A vendor may have completed a third-party security assessment, a SOC 2 report, or HITRUST. Those are separate artifacts. They are not a government HIPAA certificate, and they do not replace a BAA. A homepage that says "HIPAA-compliant" is a marketing sentence until counsel reads the contract and the security evidence.
The longer contract briefing is What a BAA actually requires. Read that page before you treat a badge, a lock icon, or the phrase "HIPAA answering service" as evidence. ClinicOnCall will not tell you a vendor is certified, because we do not certify, and because HHS does not certify this market either.
When an answering service is a business associate
HHS defines a business associate as a person or organization, other than a workforce member, that creates, receives, maintains, or transmits PHI on behalf of a covered entity. Answering services that take patient names, callback numbers, symptoms, or appointment details typically fall in that bucket. So do many AI intake tools and after-hours nurse lines.
A vendor that only transfers a caller, without creating or keeping PHI, might argue it is a conduit. That exception is narrow. HHS says a conduit only provides transmission, including temporary storage, and does not access PHI on a regular basis. Most medical, dental, hospice, and after-hours desks you will find in this directory are not selling a pure transfer. They are selling a message.
Veterinary clinics sit in a different statute. HIPAA governs human PHI. If your animal hospital still sends owner contact data and clinical notes to a desk, ask counsel what your own state and contracts require. Do not copy a human-health BAA conversation onto a veterinary line without reading it.
What ClinicOnCall records, and what it does not
When a listing says "vendor states it signs a BAA," we mean the public site said that on a recorded date, and we stored the URL. We do not review the contract. We do not say the vendor holds a HIPAA certification. We do not collect PHI. Quote requests go from your practice to the vendor.
Filter the directory by "BAA stated" if that is the claim you want to see first. Then open two or three profiles in compare. The filter is a reading of the public site, not a legal opinion. Confirm the live BAA with counsel before you share patient information.
Specialty pages collect the same records by clinic type: medical, dental, hospice, home health, and after-hours. Featured placements on those pages are labeled Sponsored. Quality notes are not for sale.
What to ask instead of "are you HIPAA?"
- Will you sign a BAA before the first live call, and can counsel see the form first?
- Which uses and disclosures of PHI does the BAA permit, and which does it bar?
- Which subcontractors, including overseas agents and model providers, hear the same call?
- Are calls recorded, how long do recordings and transcripts stay, and who can replay them?
- Where do tickets live, and what happens to them when the contract ends?
- What is the incident and breach notice path back to your practice?
Those questions sit next to the operator-model questions in How to choose a medical answering service. Price comes after the contract conversation. See How to read answering-service pricing.
Example profiles, not endorsements
These three listings state, on a recorded date, that they sign a BAA or provide one at setup. That is a public-claim record. It is not a certification and not a recommended shortlist.
- PerfectServe states every practice receives a signed BAA before going live.
- Ruby states a team member provides a BAA during setup, and that HIPAA messages are delivered through its app and portal rather than email or text.
- MedConnectUSA states it signs a BAA with every client and uses U.S. call-center operators.
Reopen the source URL on each profile. Vendor sites change. A sentence we recorded is not a sentence that will stay live forever, and it was never a government certificate. If you only remember one line from this page: we do not certify, HHS does not certify answering services, and a BAA is a contract you have counsel read.