Is Voksha HIPAA compliant for a physical therapy practice?

For Physical Therapy Clinics

HIPAA compliance features are included on the Enterprise plan, which is the tier most relevant to PT clinics because intake calls routinely involve protected health information: injury descriptions, diagnosis details from a physician referral, treatment history, and insurance information all qualify as PHI under HIPAA when tied to a patient's identity. A solo practice or small clinic on Starter or Premium using Voksha mainly for basic appointment scheduling and general availability questions is handling less PHI-sensitive call content, but any clinic where Voksha is collecting injury details, physician referral information, or insurance authorization specifics as part of intake should be on Enterprise, where HIPAA and GDPR compliance features apply. Before rolling this out, your practice should still treat this the way you would any vendor touching PHI: confirm a Business Associate Agreement is in place, since HIPAA requires a signed BAA with any vendor that creates, receives, maintains, or transmits PHI on your behalf, and this applies to an AI receptionist just as it would to a traditional medical answering service or a cloud EMR vendor. Ask specifically what call transcripts and recordings are retained, how long they are stored, and whether they are encrypted in transit and at rest. This is not a hypothetical compliance box to check for PT: your practice is bound by HIPAA regardless of size the moment you handle PHI, and a phone intake process that captures injury and insurance details over the phone falls squarely inside that scope, same as your paper intake forms or EMR always have.