HIPAA and health information
For medical, dental and other practices that handle protected health information. What turning on PHI handling changes, the Business Associate Agreement, texting templates, and the settings to pair with it.
If your business handles protected health information (PHI), for example a medical or dental practice, Hey Quad works under a Business Associate Agreement (BAA) and handles that information more strictly. This page explains what changes. It isn't legal advice.
Turn on PHI handling
Open Settings → Privacy & PHI. Under PHI handling, turn on This organization handles protected health information. It's on automatically for healthcare and dental organizations.
It turns on:
- AI providers that retain nothing. Features that would send health information to an outside provider use only providers that keep none of it.
- Texting limited to approved templates. See below.
- The HIPAA go-live checks. See below.
Sensitive data
Under Sensitive data, the setting For medical, legal and other confidential work means:
- phones don't keep a copy of your data;
- business cards aren't read by AI;
- notifications don't show message text, only who it's from.
It's always on for healthcare organizations, and available to anyone else with confidential work.
The Business Associate Agreement
You accept our BAA in the HIPAA step of setup (Finish setup on the banner). Press Read the Business Associate Agreement, then Accept.
Hey Quad also needs a signed BAA with every provider your features would send health information to. We sign those, not you. The HIPAA readiness card on Settings → Privacy & PHI shows:
- Business Associate Agreement accepted
- Every provider your features use is BAA-covered
- how long recordings and transcripts may be kept. Longer settings are refused.
A health-information account can't go live until both are done, and nobody can skip this step. If you turn PHI handling on after you're already live, you stay live.
Texting with health information
Organizations that handle PHI may only send texts that match an approved message template. That keeps clinical details out of text messages, which aren't a secure channel.
Under Approved message templates you see the templates already allowed. Add your own with a Label and a Pattern, using {} where something changes, for example: "Your results are ready. Please call to discuss." A text that doesn't match a template is refused, with a reason.
Settings to pair with it
- Two-factor sign-in, Strict. In Settings → Sign-in security, the Strict policy asks for a fresh check before anyone plays recordings or voicemail, reads transcripts or exports. See Two-factor sign-in and passkeys.
- Roles. Give people only what they need. See Users and roles.
Was this helpful?