Do we need a Business Associate Agreement with Voksha, and does that cover our practice under HIPAA?

For Mental Health Practices

Yes. Because Voksha handles client names, contact information, insurance details, and scheduling data tied to identifiable clients seeking mental health services, it functions as a business associate under HIPAA, and a Business Associate Agreement (BAA) is the standard mechanism that extends your practice's HIPAA obligations to a vendor and defines how they must protect that data. Voksha provides one only on the Enterprise plan, which also includes GDPR for practices serving clients outside the US or with data residency requirements. A signed BAA does not shift your practice's ultimate responsibility for HIPAA compliance to Voksha, it establishes the contractual and technical safeguards the vendor commits to, which you as the covered entity are required to have in place with any vendor touching PHI, the same requirement that applies to your EHR vendor, your billing service, and your teletherapy platform. Practices should ask any phone answering or scheduling vendor directly whether they offer a BAA before connecting client data to it, since a vendor that cannot provide one is not a compliant option for handling calls that include client-identifying health information, regardless of how secure their marketing claims sound. Starter and Premium do not include a BAA, and since even a name and callback number tied to a therapy practice's calendar is PHI, practices handling any client-identifying calls should be on Enterprise with the BAA signed during setup rather than treating it as optional.