Security and BAA Review

A practice needs clear answers about access, patient information and responsibility before adopting an EHR or AI front desk. This page describes product controls and the items to review for your intended use.

Published by CallSphere Health · Reviewed September 9, 2026

Controls built into the product

  • Role permissions and practice scoping limit access to authorized workflows.
  • Clinical records include audit and note-signing controls. Signed clinical notes use a separate clinician workflow.
  • AI appointment changes and account questions require patient verification and are limited to that person’s records.
  • AI scribe sessions require consent; generated notes remain drafts for clinician review.
  • The patient-facing AI is limited to administrative requests and does not provide medical advice or clinical triage.

These controls are part of a security program. Their presence alone is not a certification, an independent audit conclusion or a guarantee that a deployment meets every practice’s obligations.

Review before using patient information

  1. Agreement and scope. Review the applicable business associate agreement, service scope and responsibilities before sending protected health information.
  2. Data flow. Confirm which services process calls, transcripts, notes, messages, files and payments, and which data each receives.
  3. Access and retention. Confirm roles, account recovery, audit access, data export, retention and deletion requirements for your practice.
  4. Deployment safeguards. Request current information about hosting, encryption, backups, recovery and incident response for the service you will use.
  5. Practice procedures. Establish staff access reviews, consent handling, communication preferences and a response process for exceptions.

HIPAA is a shared operational responsibility

The U.S. Department of Health and Human Services explains that covered entities and business associates must evaluate their arrangements and safeguards. Review the official business associate guidance and cloud computing guidance with your practice’s qualified advisers. Sources reviewed September 9, 2026.

CallSphere Health does not present this page as an independent compliance assessment, HIPAA certification or ONC certification. Contract terms and current deployment evidence should inform your decision.

Use a safe evaluation workflow

Use synthetic information in demonstrations. Confirm permissions, recording consent, failed-booking behavior and staff follow-up without placing real calls, messages or payments. See our capability boundaries, privacy policy and terms.

For a security or contractual question, contact sagar@callsphere.ai. Do not include patient information in the initial request.