Healthcare communications
HIPAA Compliance and Cleod9 Voice
Cleod9 Voice runs on Wildix, which operates as a HIPAA business associate and publishes an annual HIPAA attestation. Cleod9 will sign a business associate agreement covering voice calls, voicemail, video meetings, call recording and transcription; text messaging is not covered. This page explains what that agreement does, what stays with your practice, and how the HIPAA Security Rule applies to a cloud phone system.
Book a DemoUpdated October 2026 · Cleod9 Voice, Arlington, TX
Business associate
Wildix Inc. states that it operates as a business associate under HIPAA.
BAA available
Cleod9 will sign a BAA through Wildix covering voice, voicemail, video, recording and transcription.
Texting excluded
SMS and other text messages fall outside the BAA, so patient information stays out of texts.
2026 attestation
Wildix's 2026 internal review of its HIPAA program reported no exceptions.
What the business associate agreement covers
Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information on behalf of a covered entity is a business associate, and the two must sign a business associate agreement, or BAA, before patient information flows through the vendor's systems. A cloud phone platform that stores voicemail, call recordings and transcripts falls squarely in that group.
Cleod9 provides its BAA through Wildix, the platform its service runs on. It is arranged directly with Cleod9 rather than clicked through online, so ask for it during setup and keep the signed copy with your compliance records. Wildix's 2026 attestation describes a HIPAA program covering administrative, physical and technical safeguards.
- Voice calls
- Voicemail
- Video meetings
- Call recording
- Call transcription in x-bees
Not covered: text messaging
SMS and other text messages are outside the business associate agreement. Do not send protected health information by text, and do not invite patients to text photos of insurance cards, referral forms or symptoms.
Talk with your privacy officer about whether and how the practice uses texting at all. If it does, keep messages free of clinical details, test results and insurance information, and give patients a covered channel, such as a phone call or video visit, for anything about their care.
Confirm before use with patient information
Some tools are not named in the list above. Before website chat, the AI Voice Concierge, AI call and chat summaries, or any connection to an outside EHR or CRM handles patient information, ask Cleod9 to confirm in writing whether the BAA covers it for your account.
Keep that written answer with the signed agreement. It is the first thing an auditor, or your own counsel, will ask to see.
Where recordings are stored, and for how long
Recordings are stored in Wildix's instance on Amazon Web Services. Your practice chooses the retention period, anywhere from one week to ten years. Pick the shortest period that meets your record-keeping duties, write it into your policy, and revisit it once a year.
Recording can run automatically or be started by the user, in three modes: record and transcribe, record only, or transcribe only. Transcribe only skips the audio file but still leaves a written transcript, and that transcript is protected health information too. Limit playback and transcript access to the few people whose jobs require it.
Texas allows a call to be recorded with one party's consent, but patients calling from all-party consent states should hear that calls may be recorded. Cleod9's guide to recording business calls in Texas covers announcements, access and retention in more detail.
The HIPAA Security Rule in brief
The Administrative Simplification provisions of HIPAA, the Health Insurance Portability and Accountability Act of 1996, directed the Department of Health and Human Services to set national standards for protecting health information. The Security Rule, published on February 20, 2003, and found at 45 CFR Part 160 and Part 164, Subparts A and C, covers the electronic side: individually identifiable health information that is created, received, maintained or transmitted electronically, known as e-PHI.
It applies to covered entities, meaning health plans, health care clearinghouses and health care providers that conduct standard transactions such as claims electronically, and to their business associates. The HITECH Act of 2009 made business associates directly responsible for meeting the rule. CMS publishes a covered entity decision tool, and HHS explains who counts as a business associate.
One line matters for any phone system. In its 2022 guidance on audio-only telehealth, HHS said the Security Rule does not apply to calls on a traditional landline but does apply when a covered entity uses electronic communication technologies such as VoIP, smartphone apps or Wi-Fi calling. Calls on a cloud platform like Cleod9 fall on the Security Rule side of that line, and so do the recordings, voicemail and transcripts they leave behind.
Covered entities and their business associates must do four things:
Protect the information
Keep e-PHI confidential, protect it from improper changes or deletion, and keep it available to the people who need it.
Anticipate threats
Identify and guard against threats to the security or integrity of the information that can reasonably be foreseen.
Prevent improper disclosure
Protect against uses or disclosures of the information that the Privacy Rule does not permit.
Hold staff to it
Make sure the workforce follows the security policies the organization puts in place.
The rule is deliberately flexible. HHS does not prescribe specific technology. Each organization weighs its size and complexity, its technical setup, the cost of security measures, and the likelihood and impact of the risks it faces, then reviews those choices as circumstances change. The full rule and HHS's summary are on the HHS Security Rule page.
What the platform handles, and what stays with your practice
A signed BAA does not make a practice HIPAA compliant. It settles the vendor's side of the arrangement; the rest belongs to the practice, and your privacy officer or counsel should own those decisions.
The platform's side
Wildix and Cleod9 are responsible for how the platform protects the information it holds for you: how it is encrypted and stored, the security of the data centers, the access controls built into the system, and notifying your practice if information in their care is breached.
Wildix lists its SOC 2 Type I and Type II reports, its ISO/IEC 27017 and 27018 certifications and its HIPAA materials on the Wildix trust center.
Your practice's side
Your practice decides who can play back recordings and read transcripts, how long recordings are kept, which staff have accounts and how quickly those accounts are removed when someone leaves, what your notice of privacy practices says, and how staff are trained.
It also runs its own risk analysis, covering the phone system along with everything else, and keeps patient information out of text messages.
About the 2026 attestation letter
In 2026, Wildix published a HIPAA attestation letter summarizing an internal audit of its HIPAA program. The review ran over three weeks in Vanta, the compliance platform Wildix uses, and examined policies, procedures, tests and control ownership against the HIPAA Privacy, Security and Breach Notification Rules. It reported no exceptions.
Wildix states two caveats with it, and both are worth knowing. HIPAA has no official certification program, so no vendor can truthfully claim to be HIPAA certified. And the letter describes the period that was reviewed; it does not promise future compliance. You can download the 2026 attestation letter or read Wildix's HIPAA compliance page.
Common questions
Is Cleod9 HIPAA certified?
No one is, because HIPAA has no official certification program. What matters is a signed business associate agreement, a vendor whose safeguards are reviewed and documented, and a practice that runs its own risk analysis and policies. Cleod9 will sign the BAA, and Wildix publishes its attestation letter and security reports.
Does signing the BAA make my practice HIPAA compliant?
No. The agreement covers how Cleod9 and Wildix protect the information they hold for you. Your practice still controls who has access, how long recordings are kept, how staff are trained, what its notice of privacy practices says and how its risk analysis is done. Have your privacy officer or counsel review the agreement and those decisions.
Can we send patient information by text message?
No. Text messaging is not covered by the BAA, so protected health information should not travel by text. Talk with your privacy officer about whether the practice uses texting at all, and if it does, keep clinical details, test results and insurance information out of it.
Where are call recordings stored, and who controls them?
Recordings are stored in Wildix's instance on Amazon Web Services. Your practice chooses how long they are kept, from one week to ten years, and decides which users can play them back or read the transcripts. Write both choices into your recording policy.
Does a law firm need a BAA for its phone system?
Sometimes. A law firm that receives patient information while doing legal work for a health care provider or health plan is generally that client's business associate, and vendors that hold that information for the firm may need an agreement with it. Ask your health care clients what their agreements require of you.
This page is general information, not legal advice.
Talking to Cleod9
Bring your privacy officer to the demo. Ask to see recording permissions, retention settings and how a departing employee's account is removed, and request the business associate agreement before the first patient call runs on the system.
If your practice uses website chat or the AI Voice Concierge, ask for written confirmation of how the BAA treats them for your account.