Business phone
HIPAA and your business phone: which providers sign a BAA
Quick answer
Of the nine providers we rank, eight say they will sign a HIPAA Business Associate Agreement: Dialpad, Google Voice, Nextiva, Ooma Office, Phone.com, Quo, RingCentral and Vonage. How you get one differs by provider. Grasshopper says it is not HIPAA compliant. Check what each agreement covers before you rely on it.
If your practice shares patient information with a phone provider, the provider's own terms decide whether it will sign a Business Associate Agreement (BAA). This guide lists what each provider we rank says about it.
What a BAA is
The US Department of Health and Human Services puts it this way: "The HIPAA Rules permit a covered entity to disclose PHI to a business associate if the covered entity obtains satisfactory assurances, in the form of a contract or other written arrangement (collectively referred to as a 'business associate agreement,' or BAA), that the business associate will appropriately safeguard the information, among other obligations." (HHS, checked Sep 25, 2026.)
Which providers say they will sign one
- Dialpad says healthcare customers can sign a BAA "with one click".
- Nextiva says you "must also enter into a Business Associate Agreement or BAA with Nextiva".
- Ooma Office says the account administrator is asked to sign a BAA virtually.
- RingCentral says the customer must request a BAA from RingCentral.
- Phone.com says customers who handle protected health information can request a BAA.
- Quo says healthcare organizations can execute BAAs with it.
- Google Voice is on Google Workspace's list of HIPAA-covered services, for managed users only.
- Vonage's terms refer to "a Business Associate Agreement signed by Vonage"; it has no dedicated BAA page.
Grasshopper says: "At this time, Grasshopper is not HIPAA compliant."
All provider statements were checked on Sep 24, 2026.
What to ask before you rely on it
- Which of the features you plan to use the agreement covers: calls, texts, voicemail, call recordings, video meetings.
- Which accounts or users it covers. Google Voice, for example, is covered for managed users only.
- Whether it applies on the plan you are buying, or needs a particular plan or an extra step to activate.
- Who in your organization signs it, and where you keep the signed copy.
For how these providers compare on price and features, see the business phone systems and virtual phone numbers rankings.