Is Curogram HIPAA compliant?
Curogram signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Curogram with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Curogram doesn't say whether the BAA covers its AI features.
Does Curogram sign a BAA?
Yes, it signs a BAA
Curogram's compliance page says it executes BAAs with all clients. It doesn't advertise its own AI features; its AI Calls to Action API lets an outside AI receptionist trigger actions in Curogram, and that outside vendor needs its own BAA.
Not confirmed for the AI features: Curogram doesn’t say whether its BAA covers AI Calls to Action API (integration for third-party AI receptionists). Get that in writing before using it with patient data.
- Business associate
- Curogram
- Tool
- Curogram
- Plans with a BAA
- Curogram (all clients)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Curogram (all clients) | Signs a BAA | Not stated | The compliance FAQ says Curogram executes BAAs with all clients. Its help center also describes a Client PHI Acknowledgment and HIPAA Compliance Agreement signed during onboarding. No plan restrictions are stated.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Curogram says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| AI Calls to Action API (integration for third-party AI receptionists) | Not stated | The API lets an external AI system send patient details to trigger actions in Curogram. Curogram doesn't describe its own AI processing, and the external AI system is a separate vendor that needs its own BAA.[3] |
Sources
- Curogram Compliance Standards
- Protecting Patient Data: Why HIPAA Compliance Matters in SMS and Communication
- AI Calls to Action API Integration Guide
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.