Do we need a Business Associate Agreement with Voksha, and does that cover our practice under HIPAA?

For Mental Health Practices

Yes. Because Voksha handles client names, contact information, insurance details, and scheduling data tied to identifiable clients seeking mental health services, it functions as a business associate under HIPAA, and a Business Associate Agreement (BAA) is the standard mechanism that extends your practice's HIPAA obligations to a vendor and defines how they must protect that data. This is available as part of Voksha's HIPAA-compliant handling on the Enterprise plan, which also includes GDPR compliance for practices serving clients outside the US or with data residency requirements. A signed BAA does not shift your practice's ultimate responsibility for HIPAA compliance to Voksha, it establishes the contractual and technical safeguards the vendor commits to, which you as the covered entity are required to have in place with any vendor touching PHI, the same requirement that applies to your EHR vendor, your billing service, and your teletherapy platform. Practices should ask any phone answering or scheduling vendor directly whether they offer a BAA before connecting client data to it, since a vendor that cannot provide one is not a compliant option for handling calls that include client-identifying health information, regardless of how secure their marketing claims sound. For solo practices on Starter or Premium that are only using Voksha for basic scheduling without deep EHR integration or detailed intake capture, the exposure is lower but not zero, since even a name and callback number tied to a therapy practice's calendar is PHI. Practices handling any client-identifying scheduling data should confirm BAA coverage as part of setup rather than treating it as optional.