DoubleXL Answer
Is DoubleXL Answer HIPAA compliant?
No. DoubleXL Answer is not sold as a HIPAA-compliant service, and it is not designed to handle protected health information by default. Our terms ask customers not to send PHI through it unless we have agreed in writing, for example with a Business Associate Agreement. If your practice is a covered entity, talk to us before forwarding patient calls.
By Coy Robison, Founder · Published
Where DoubleXL stands
The short version is in our legal terms, and this page doesn't change them. The data processing addendum says the services are not designed for, and do not by default process, protected health information governed by HIPAA, and that customers will not submit it unless the parties have executed a Business Associate Agreement or another written instrument that permits it. The terms of service and privacy policy say the same.
That matters because, under HIPAA, a covered entity that lets a vendor handle PHI on its behalf needs written assurance that the vendor will safeguard it (45 CFR § 164.502(e)). A receptionist answering patient calls is that kind of vendor.
Does HIPAA apply to your practice?
Not every med spa is a HIPAA covered entity. CMS says health care providers who submit HIPAA transactions, like claims, electronically are covered (CMS). Whether that describes your practice is a question for your compliance adviser, not for us.
If you are covered, assume the calls a receptionist answers contain PHI. A caller's name and number together with the treatment they're asking about is enough.
What the receptionist collects on a call
| Data | When |
|---|---|
| Caller phone number | Every call. |
| Name, reason for calling, urgency | Asked for by the default instructions. In capture-leads mode it also asks for the service and preferred times. |
| Call recording | On by default. |
| Transcript | Saved for answered calls. |
| AI-written summary, intent and sentiment | Generated after the call from the transcript. |
Calls are carried by Twilio, the live voice conversation runs on ElevenLabs, and recordings are transcribed with AssemblyAI. Our subprocessors page lists the companies that process customer data.
If you use it at a med spa
If you decide to use Answer at a med spa, set it up so it stays with scheduling and general questions:
- Add never-say rules, such as "never give medical or treatment advice" and "never discuss a patient's treatment history".
- Tell it in its instructions to take a message for any clinical question.
- Add a required disclosure, such as "this call is recorded", which it says early in every call. Some states require every party's consent to record.
- Use the booking-link mode so appointment details are entered in your own booking system, not described on the call (see how booking works).
None of that makes the service HIPAA compliant. If your practice is a covered entity, contact us before forwarding patient calls.
Questions
Is DoubleXL Answer HIPAA compliant?
No. DoubleXL Answer is not offered as a HIPAA-compliant service, and it does not process protected health information by default. Our terms say customers should not send PHI through it unless we have agreed in writing, such as with a BAA.
Will DoubleXL sign a Business Associate Agreement?
Not by default. Our data processing addendum says PHI is only processed where the parties have executed a BAA or another written agreement that permits it. If you need one, contact us before you forward patient calls.
Does HIPAA apply to my med spa?
It depends on whether your practice is a covered entity. CMS says health care providers who submit HIPAA transactions, like claims, electronically are covered. Ask your compliance adviser; we cannot make that call for you.
What does the receptionist record?
The caller's phone number, what they say on the call, a transcript, and an AI-written summary with the caller's intent. Call recording is on by default. Assume anything a caller says can be stored.
Will the AI receptionist give medical advice?
It shouldn't, and you should tell it not to. You can add rules it must never break, such as never giving medical or treatment advice, and instructions to take a message instead. It is an AI and can still get things wrong.
Sources
Related questions
Try it on your own calls
Every plan starts with a 14-day free trial. Set it up, forward your line, and see how it handles real calls before you decide.