Everything we have written on trust & compliance, newest first. Written for practice owners, not engineers.
Trust & Compliance
An AI voice answering your phone is not a robocall. The same voice dialing a patient is. Here is the consent an outbound AI call needs, the real conditions on the healthcare exemption, and what the call has to disclose.
Trust & Compliance
42 CFR Part 2 protects substance use disorder records under a stricter federal rule than HIPAA, with a 16 February 2026 compliance date. Here is who it covers and what it changes on your phone line.
Trust & Compliance
A parent is usually a minor's personal representative under HIPAA, but 45 CFR 164.502(g)(3) names 3 exceptions and state law decides the rest. Here is who may book, who may be told, and what a phone system verifies.
Trust & Compliance
When an AI agent texts a patient or changes a record, you have to explain it months later. Here is what the action log must contain, how long each artifact should live, and what to produce on request.
Trust & Compliance
A consent rule written in application code never applied to the nightly job or the query someone runs by hand. Here is how to build patient consent records a practice can demonstrate rather than promise.
Trust & Compliance
Section 1557 defines who counts as a qualified interpreter, limits when a family member may translate, requires a notice in 15 languages, and addresses machine translation. Here is what a practice owes.
Trust & Compliance
Carriers block unregistered business texts outright, and a blocked message never bounces back to your front desk. Here is what registration costs in 2026, how long it takes, and where healthcare campaigns get rejected.
Trust & Compliance
Most practices read the good faith estimate rule as an uninsured-patient rule. It is not. An insured patient paying cash triggers it too, on a deadline that starts the moment the appointment is booked.
Trust & Compliance
Your phone system probably records calls by default. In 11 states that needs every caller to agree, and once patient details are inside, the recording becomes protected health information with its own rules.
Trust & Compliance
A records request that misses HIPAA's 30-day deadline is a real compliance risk. Here is the exact timeline, what you can legally charge, and what to automate safely.
Trust & Compliance
A BAA proves legal accountability, not real security. Here is what to verify beyond HIPAA before trusting a vendor with patient calls long-term.
Trust & Compliance
HIPAA protects health information. TCPA governs whether you had the right to text a number at all. Here is what the narrow healthcare exemption actually covers.
Trust & Compliance
"HIPAA compliant" on a vendor homepage is a marketing claim, not a government stamp. Here is what actually protects patient phone data: a signed BAA, a no-PHI-by-default design, and 8 blunt vendor questions.
Five frames from the front desk, before and after the phone gets help.
Who called. What they wanted. What got booked.
If you don't know what happened on the phone, you can't run the place. Guesswork isn't management.
Two lines in your pocket the moment the call ends: who it was, what they needed, what happened next.
Calls answered. Bookings made. The questions asked most. Monday morning, you read the front desk's diary.
It answers; you supervise. Notes on every call, logs you can read, and a stop that's always yours.
