Q
On some plansIs Quo (formerly OpenPhone) HIPAA compliant?
Checked 6 Nov 2026 from 3 vendor sources
Quo offers a BAA on its Business and Scale plans, but SMS/MMS and third-party integrations are not covered services under it. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Starter | Not covered |
| Business | Covered |
| Scale | Covered |
What the BAA leaves out
- SMS and MMS are not a Covered Service
- Third-party integrations and analytics that send data outside the BAA
- AI features are usable only if the customer meets conditions and accepts responsibility for PHI processed
How to get the BAA
Existing customers use the BAA request form in Quo’s HIPAA article; new customers contact Quo sales.
What the vendor says to do
- Be on a Business or Scale plan
- Request and sign the BAA
- If using SMS, obtain patient authorization, limit PHI to the minimum necessary, document risks and add safeguards
- If using AI features, give patient notice, get authorization, use minimum necessary PHI, document in policies and add safeguards
- Notify patients of call recording as law requires
- Use device-level auto-lock for session timeouts shorter than 15 days
Proof from the vendor
- Security and compliance, Quo SupportOnly Business and Scale customers can request a BAA
- HIPAA compliance, Quo SupportBAA on Business and Scale; SMS, AI and integration terms; how to request
- Quo pricingPlan comparison, including the HIPAA ready row
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.