BAA first.
Then the phone.

A Business Associate Agreement before any PHI

Any vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate. Arbol signs a BAA before implementation — it is a precondition, not an upsell.

Source: 45 CFR §164.502(e) and §164.308(b)

Appointment reminders are still PHI handling

Voice and text reminders touch patient identifiers and scheduling detail. We treat them under the same safeguards as inbound calls: encryption, access control, audit trail and your retention rules.

TCPA is a separate question from HIPAA

Consent to dial and consent under the Privacy Rule are not the same checkbox. Outbound calls check consent status before dialling; revocations apply across channels when the patient asks to stop.

Identity, recording and a hard clinical boundary

The agent discloses it is virtual, using your practice's name. Recording is announced where state law requires it. No clinical advice — escalate with the transcript attached.