If we're on Voksha's Enterprise plan for HIPAA, do we still need a signed Business Associate Agreement?
For Dental Practices
Yes, and Voksha provides one as part of the Enterprise plan rather than treating it as an add-on negotiation. Since Voksha is handling protected health information on your behalf, patient names, dates of birth, insurance details, symptom descriptions, appointment types that reveal what procedure someone is having, it meets the legal definition of a business associate under HIPAA, and your practice needs a signed BAA in place before routing real patient conversations through it, the same way you'd need one with any cloud-based practice management system, clearinghouse, or patient communication platform that touches PHI. The BAA covers what Voksha can and can't do with the data it collects, requires it to maintain appropriate safeguards, and obligates it to notify your practice if there's ever a breach involving your patients' information, consistent with HITECH Act breach notification requirements. Practices should keep a copy of the signed BAA in the same compliance file where they keep BAAs for their PMS vendor, their clearinghouse, and any other vendor that touches patient data, since it's something a HIPAA compliance audit or a patient complaint investigation would ask to see. This is specific to Enterprise: Premium and Starter don't include the BAA, which is why practices planning to have the AI receptionist collect real symptom descriptions, insurance member IDs, or anything else that constitutes PHI need to be on Enterprise rather than a lower tier, regardless of call volume.
Yes, and Voksha provides one as part of the Enterprise plan rather than treating it as an add-on negotiation. Since Voksha is handling protected health information on your behalf, patient names, dates of birth, insurance details, symptom descriptions, appointment types that reveal what procedure someone is having, it meets the legal definition of a business associate under HIPAA, and your practice needs a signed BAA in place before routing real patient conversations through it, the same way you'd need one with any cloud-based practice management system, clearinghouse, or patient communication platform that touches PHI. The BAA covers what Voksha can and can't do with the data it collects, requires it to maintain appropriate safeguards, and obligates it to notify your practice if there's ever a breach involving your patients' information, consistent with HITECH Act breach notification requirements. Practices should keep a copy of the signed BAA in the same compliance file where they keep BAAs for their PMS vendor, their clearinghouse, and any other vendor that touches patient data, since it's something a HIPAA compliance audit or a patient complaint investigation would ask to see. This is specific to Enterprise: Premium and Starter don't include the BAA, which is why practices planning to have the AI receptionist collect real symptom descriptions, insurance member IDs, or anything else that constitutes PHI need to be on Enterprise rather than a lower tier, regardless of call volume.
More Questions About Dental Practices
More ways to learn about Voksha
Try Voksha
for Dental Practices.
Set up your AI receptionist in under 5 minutes. 7-day money-back guarantee.