Business Associate Agreement
Intermedia states that it will execute its HIPAA form of BAA upon request with covered entities or business associates. CKH can coordinate the request during onboarding.
For therapists and group practices
Build HIPAA supporting communications into the implementation, not as an afterthought.
CKH helps practices evaluate and configure Intermedia communications, security, BAA, and archiving options around approved workflows. Intermedia is CKH’s preferred telecom service partner and makes a Business Associate Agreement available upon request.
Platform capabilities
Technical and administrative controls that can support a HIPAA program.
Available features depend on the selected services, licenses, and configuration. CKH reviews the required use cases before recommending an implementation scope.
Encryption
Intermedia documents TLS encryption in transit and AES 256 bit encryption at rest for supported communications data such as voicemails, recordings, chat, SMS, meetings, and files.
Access controls & MFA
Administrative and user controls can help limit access to authorized people, with multifactor authentication and security settings available for supported applications and roles.
Communications archiving
Archiving can capture voice, SMS, chat, meetings, and other communications for authorized search, review, retention, and audit activity.
Retention & integrity
Available retention options range from 30 days to 10 years. WORM storage and audit logs can support data integrity and review requirements when selected.
Compliance workflows
The optional Compliance Module can add policy based review, assignment, escalation, permissions, legal cases, legal hold, tags, filters, and export workflows.
What CKH can do
Translate requirements into a practical communications configuration.
- Document phone, messaging, recording, retention, and user access requirements
- Review the relevant Intermedia services, licenses, and support documentation
- Coordinate the BAA request with Intermedia
- Configure approved calling, messaging, access, and archiving options
- Document call flows, administrative roles, and operational responsibilities
- Train authorized users and support ongoing communications administration
No platform can make a practice compliant by itself.
A HIPAA supporting platform and BAA are important components, but the practice remains responsible for risk analysis, policies, minimum necessary use, workforce training, permitted communications, device practices, access reviews, and legal guidance.
CKH provides communications implementation and operational support, not legal advice or compliance certification.
Implementation questions
What should be decided before launch?
1
What information is communicated?
Identify where protected or sensitive information may appear in calls, voicemail, SMS, chat, meetings, recordings, or transcripts.
2
Who should have access?
Define administrators, users, reviewers, and export permissions based on job responsibilities.
3
What should be retained?
Choose recording, archiving, legal hold, retention, and deletion settings based on approved policy.
4
How will the team use it?
Train users on approved devices, messaging, recordings, voicemail, escalation, and incident reporting.
Intermedia technical references
Supporting documentation used for this page.
These Intermedia support articles provide additional product and configuration details. Product names, licensing, and features can change, so the final project scope should be confirmed during discovery.
Elevate Archiving: HIPAA Compliance Overview
HIPAA supporting capabilities, safeguards, BAA availability, and shared responsibility guidance.
Read Intermedia article →Archiving Compliance Module
Policy based monitoring, review workflows, permissions, legal cases, and controlled legal hold access.
Read Intermedia article →Archiving Provisioning & Retention
Subscription, enablement, retention options, administrator roles, and Compliance Module activation.
Read Intermedia article →Elevate Apps Security & Compliance
Encryption, access security, application controls, security certifications, HIPAA support, and BAA availability.
Read Intermedia article →Start with the communications environment before choosing settings.
Start with the practice’s workflows, sensitive information, access roles, recording needs, and retention policy.