What UCaaS compliance requirements apply to healthcare organizations?

Sign a Business Associate Agreement with the UCaaS provider before transmitting any ePHI through voice, video, voicemail, or chat. (source)

Encrypt ePHI in transit (TLS 1.2+ for signaling, SRTP for media) and at rest using AES-256 or equivalent per HIPAA Security Rule §164.312. (source)

Enforce unique user IDs and multi-factor authentication for every account that can access ePHI, with automatic session timeout. (source)

Retain audit logs of ePHI access for a minimum of 6 years per HIPAA documentation retention requirements. (source)

Notify affected patients and HHS within 60 days of discovering an ePHI breach under the HITECH Breach Notification Rule. (source)

Disable voicemail transcription and SMS for ePHI workflows unless the provider's BAA explicitly covers those subsystems. (source)

Apply stricter 42 CFR Part 2 consent rules when communications involve substance use disorder treatment records. (source)

Document a Security Risk Analysis covering the UCaaS platform and refresh it annually or after any material change.

Health Insurance Portability and Accountability Act; sets US standards for safeguarding electronic protected health information.

Written contract required between a covered entity and any vendor that handles ePHI on its behalf, including UCaaS providers.

Electronic Protected Health Information — any patient-identifiable health data created, received, or transmitted electronically.

Federal rule requiring notification to affected patients, HHS, and sometimes media within 60 days of an ePHI breach.

Tamper-resistant record of who accessed which ePHI, when, and from where; required for HIPAA Security Rule compliance.

Federal rule with stricter consent requirements than HIPAA for substance use disorder treatment records.