Patient Communication Risk
Patient communication platforms routinely process appointment information, health conditions, treatment reminders, and intake forms — all of which may constitute PHI. Organizations must verify BAA status, review data routing, and confirm encryption standards for all patient-facing communication tools.
Watchlist Stats
Who Should Review
Practice managers, front office directors, compliance officers, and marketing teams.
Why This Watchlist Matters
Appointment reminders that include health-related context may constitute PHI.
Call tracking tools may record or route patient conversations through non-covered services.
SMS and email reminder platforms must encrypt PHI in transit under HIPAA.
Review request platforms may inadvertently expose treatment context in public responses.
Vendor Table — 33 of 33 vendors
| Vendor | Category | BAA Status | Approval Tier | PHI Risk | AI Risk | Last Verified |
|---|---|---|---|---|---|---|
| Weave | Patient Communication | Verify Directly | Restricted / Review Required | 2026-09-16 | ||
| Zocdoc | Scheduling | Verify Directly | Restricted / Review Required | 2026-10-01 | ||
| Solutionreach | Patient Communication | Verify Directly | Restricted / Review Required | — | ||
| Dialpad Healthcare | Phones & Call Tracking | Verify Directly | Conditional / Verify BAA | High | High | 2026-09-30 |
| Nexa Healthcare | Patient Communication | Verify Directly | Conditional / Verify BAA | High | Medium | — |
| GoTo Connect Healthcare | Phones & Call Tracking | Verify Directly | Conditional / Verify BAA | High | Low | 2026-09-30 |
| RingCentral for Healthcare | Phones & Call Tracking | Verify Directly | Conditional / Verify BAA | High | Medium | 2026-10-01 |
| Zocdoc | Scheduling | Verify Directly | Conditional / Verify BAA | High | Low | — |
| Mango Voice | Phones & Call Tracking | Verify Directly | Conditional / Verify BAA | High | Low | — |
| LocalMed | Scheduling | Verify Directly | Conditional / Verify BAA | High | Low | 2026-09-15 |
| Simplifeye | Patient Communication | Verify Directly | Conditional / Verify BAA | High | Low | — |
| Twilio | Patient Communication | Verify Directly | Conditional / Verify BAA | High | Medium | 2026-10-01 |
| Spruce Health | Patient Communication | BAA Available | Approved With Restrictions | High | Medium | 2026-10-01 |
| Solutionreach | Patient Communication | Verify Directly | Conditional / Verify BAA | High | Medium | 2026-09-16 |
| Luma Health | Patient Communication | BAA Available | Approved With Restrictions | High | Medium | 2026-09-30 |
| Klara | Patient Communication | BAA Available | Approved With Restrictions | High | Medium | 2026-05-21 |
| 8x8 Healthcare | Phones & Call Tracking | Verify Directly | Conditional / Verify BAA | High | High | 2026-09-30 |
| Genesys Cloud CX | Phones & Call Tracking | Verify Directly | Approved With Restrictions | High | High | 2026-05-22 |
| Zocdoc | Scheduling | Verify Directly | Approved With Restrictions | High | Low | 2026-05-22 |
| CallTrackingMetrics | Phones & Call Tracking | Verify Directly | Approved With Restrictions | High | Medium | 2026-05-22 |
| Five9 | Phones & Call Tracking | Verify Directly | Approved With Restrictions | High | High | 2026-05-22 |
| Podium | Patient Communication | Verify Directly | Approved With Restrictions | High | Low | 2026-05-22 |
| Mend | Patient Communication | Verify Directly | Approved With Restrictions | High | Low | 2026-05-22 |
| Fabric Health | Patient Communication | Verify Directly | Approved With Restrictions | High | High | 2026-05-22 |
| Updox | Patient Communication | Verify Directly | Approved With Restrictions | High | Low | 2026-05-22 |
| Memora Health | Patient Communication | Verify Directly | Approved With Restrictions | High | High | 2026-05-22 |
| Lighthouse 360 | Patient Communication | Verify Directly | Conditional / Verify BAA | High | Low | 2026-05-21 |
| TeleVox | Patient Communication | Verify Directly | Approved With Restrictions | High | Medium | 2026-05-22 |
| Doxy.me | Patient Communication | Verify Directly | Approved With Restrictions | Medium | Medium | 2026-05-21 |
| Relatient | Patient Communication | Verify Directly | Approved With Restrictions | High | Medium | 2026-05-22 |
| Doctible | Patient Communication | Verify Directly | Approved With Restrictions | High | Low | 2026-05-21 |
| Twilio | Patient Communication | Verify Directly | Approved With Restrictions | High | Medium | 2026-05-22 |
| Weave | Patient Communication | Verify Directly | Conditional / Verify BAA | Medium | Low | 2026-05-21 |
Recommended Actions
Verify BAA before PHI use
Contact the vendor to confirm current BAA terms and scope before processing any PHI.
Restrict PHI entry
Implement technical or administrative controls to prevent PHI from entering unapproved systems.
Require legal review
Engage legal counsel to review data processing agreements and contract terms.
Require security review
Conduct a security assessment before deployment in PHI-adjacent workflows.
Disable tracking where needed
Remove or reconfigure tracking pixels and analytics tools on pages where PHI may be present.
Document consent workflow
Establish and document patient or staff consent processes for relevant data collection.
Review configuration settings
Verify that vendor configuration meets HIPAA requirements for your specific deployment.
Train staff before approval
Provide governance and usage training before allowing staff access to the vendor platform.
Add to internal monitoring
Include this vendor in your organization's recurring vendor risk review cycle.
Governance Checklist
Identify PHI exposure paths for this vendor category
Confirm BAA availability with the vendor directly
Review vendor contract terms and data processing agreements
Review data retention and deletion settings
Review AI training data usage clauses
Review user access controls and audit logging
Document approved use cases and restrictions
Train staff on usage restrictions before deployment
Set a recurring review date based on risk classification
Related Intelligence
Vendor Registry
Browse the full VNDRIQ healthcare vendor registry.
Compare Vendors
Side-by-side comparison of any two vendors.
Benchmark Reports
Executive benchmark reports for healthcare vendor risk.
All Watchlists
View all VNDRIQ vendor risk watchlists.
Patient Communication Category
Compare all Patient Communication vendors.
Scheduling Category
Compare all Scheduling vendors.
Phones & Call Tracking Category
Compare all Phones & Call Tracking vendors.
Dental Ai Vendor Risk Benchmark
View related benchmark report.
Frequently Asked Questions
Yes. Appointment scheduling tools that process patient names, dates, procedures, or provider information on behalf of a covered entity typically require a BAA. Verify the scope of the BAA with each vendor.
VNDRIQ watchlists are based on available public information and internal review. Being on a watchlist does not mean a vendor is unsafe — it means active governance attention is recommended. This is not legal or compliance advice. Verify vendor BAA status and HIPAA program scope directly with each vendor.