Is Voksha HIPAA compliant for a physical therapy practice?

For Physical Therapy Clinics

HIPAA compliance, with a signed Business Associate Agreement, is available only on the Enterprise plan, which is the tier most relevant to PT clinics because intake calls routinely involve protected health information: injury descriptions, diagnosis details from a physician referral, treatment history, and insurance information all qualify as PHI under HIPAA when tied to a patient's identity. Starter and Premium do not include a BAA, and since even a patient's name tied to a PT appointment is PHI, any clinic routing real patient calls, and certainly any collecting injury details, physician referral information, or insurance specifics, should be on Enterprise, where HIPAA and GDPR apply. Before rolling this out, treat it the way you would any vendor touching PHI: sign the BAA Voksha provides on Enterprise, since HIPAA requires a signed BAA with any vendor that creates, receives, maintains, or transmits PHI on your behalf, and this applies to an AI receptionist just as it would to a traditional medical answering service or a cloud EMR vendor. Ask specifically what call transcripts and recordings are retained and how long they are stored; data is encrypted in transit (TLS 1.3) and at rest (AES-256) on every plan. This is not a hypothetical compliance box to check for PT: your practice is bound by HIPAA regardless of size the moment you handle PHI, and a phone intake process that captures injury and insurance details over the phone falls squarely inside that scope, same as your paper intake forms or EMR always have.