CallEngineX is HIPAA-aware. This means our systems are built to make it feasible to handle protected health information (PHI) under a signed Business Associate Agreement (BAA), but a signed BAA is required before any PHI may be processed through the Service.
What "HIPAA-aware" means
- Call transcripts and recordings are encrypted in transit and at rest.
- Access to production data is limited to authorized personnel and logged.
- We can execute a BAA with Med Spa, Dental, and other covered-entity customers.
- We use subprocessors (voice, LLM, telecom, hosting) that themselves support HIPAA workflows under BAAs; those BAAs flow through to your usage.
Before a BAA is signed
Do not configure your agent to collect PHI (diagnoses, treatment details, insurance information tied to a health condition, etc.) until we have executed a BAA with you. During signup, Med Spa and Dental customers are required to acknowledge our BAA before their AI number can be activated.
Your responsibilities
- Make sure the prompts and lead-capture fields you configure are appropriate for the type of information you're actually collecting.
- Provide any legally required call-recording disclosure to your callers.
- Manage access to your CallEngineX dashboard using strong, unique credentials.
- Delete calls or leads containing PHI when they are no longer needed.
Requesting a BAA
Email compliance@callenginex.com from the address on your account. Include your business legal name and any specific addenda required by your compliance team.
Not legal advice
This page is informational and does not constitute legal or compliance advice. Consult your own counsel to confirm the Service is appropriate for your regulatory posture.