Is Phreesia AI HIPAA compliant?
Phreesia signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Phreesia AI with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Phreesia doesn't say whether the BAA covers its AI features.
Does Phreesia AI sign a BAA?
Yes, it signs a BAA
Phreesia's Platform Privacy Policy says it acts as a business associate of healthcare providers and enters into BAAs with them. No official page says whether VoiceAI or its other AI features fall under that BAA.
Not confirmed for the AI features: Phreesia doesn’t say whether its BAA covers Phreesia VoiceAI (24/7 AI phone agent); AI insurance coverage classification and other AI release features. Get that in writing before using them with patient data.
- Business associate
- Phreesia
- Tool
- Phreesia AI
- Plans with a BAA
- Phreesia provider contract
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Phreesia provider contract | Signs a BAA | Through sales | The Platform Privacy Policy says Phreesia enters into BAAs with healthcare providers that require it to safeguard patients' PHI under HIPAA. No public BAA template, request process or plan restriction was found.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Phreesia says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Phreesia VoiceAI (24/7 AI phone agent) | Not stated | VoiceAI verifies callers against records and writes call records back to the chart. Its page mentions HIPAA-compliant texting for on-call alerts but doesn't mention a BAA.[2] |
| AI insurance coverage classification and other AI release features | Not stated | The 26.1 release notes describe AI-based insurance classification (early access) and VoiceAI transcription exports to the EHR, without saying how PHI is handled or whether the BAA covers them.[3] |
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.