The short answer
HIPAA-compliant team communication comes down to ten things: a signed business associate agreement with every tool that touches PHI, patient conversations kept off personal apps, one account per person with access that ends when they leave, no PHI stranded on unmanaged phones, an audit trail you can produce, encryption in transit and at rest, clinical answers kept with the conversation, a compliant way to reach patients and families, one set of controls across every site, and training tied to the tools people actually use.
Most agencies have the EHR locked down. The exposure lives in the channels staff reach for between visits: a wound photo in a text thread, a former aide still in a group chat, a call from a personal cell. Those are the gaps this checklist is built to find.
How to use it
Work through each item and tick the box only if the answer is yes for your whole organization, not just your main office. Your score builds in the score panel as you go, and the full list of open items waits at the bottom. Every item includes one question to put to any vendor, whoever you are evaluating.
The checklist
Item 1 · Contracts
A signed business associate agreement with every communication vendor
- What HIPAA expects
- Any vendor that creates, receives, keeps or transmits PHI for you signs a business associate agreement before PHI changes hands.
- Where teams slip
- The EHR has a BAA. The texting app, the video tool, the fax service and the file-sharing link do not.
- Ask any vendor
- “Will you sign our BAA, or yours, before we exchange any PHI?”
- In Buzz
- Skyscape signs a BAA before any PHI is exchanged, and it covers messaging, calls, video, fax and documents together, so one agreement replaces four.
45 CFR 164.308(b) and 164.502(e)
Item 2 · Daily practice
Patient conversations stay off personal messaging apps
- What HIPAA expects
- PHI moves only over channels your organization controls and can account for.
- Where teams slip
- Clinicians use iMessage, WhatsApp or plain SMS because the approved tool is slower than the phone in their pocket. Policy rarely beats convenience.
- Ask any vendor
- “Show me a field nurse sending a photo and getting an answer in under a minute.”
- In Buzz
- Messages, calls, video, fax and documents live in one place built for care teams, with addressing and acknowledgement in the message. Every user gets a Buzz phone number at no extra cost, so nobody calls a patient from a personal cell.
45 CFR 164.312(e)(1), transmission security
Item 3 · Access
One account per person, and access ends the day someone leaves
- What HIPAA expects
- Every workforce member has a unique user ID, and access is removed promptly when employment ends or a role changes.
- Where teams slip
- Shared logins at a nurses’ station, and former staff still sitting in group threads on their own phones months later.
- Ask any vendor
- “When we remove someone from our directory, what happens to their access to patient conversations?”
- In Buzz
- One account per named person. Sign-in runs through your own identity provider, accounts are created automatically on first sign-in, and when your directory stops vouching for someone, Buzz stops letting them in. Administrators add and remove members directly as well.
45 CFR 164.312(a)(2)(i) and 164.308(a)(3)(ii)(C)
Item 4 · Devices
PHI does not live on devices the organization cannot control
- What HIPAA expects
- Policies govern PHI on devices and media, including when a device is lost, replaced or leaves with its owner.
- Where teams slip
- Photos sit in a personal camera roll, texts back up to a personal cloud account, and a lost phone is a breach report.
- Ask any vendor
- “If a clinician’s phone is lost tonight, where does the patient content actually live?”
- In Buzz
- Conversations, photos and files are held in Buzz under your organization’s account rather than in a personal message history, and access ends with the account.
45 CFR 164.310(d)(1), device and media controls
Item 5 · Evidence
An audit trail you can produce on request
- What HIPAA expects
- Mechanisms that record activity in systems holding PHI, and regular review of that activity.
- Where teams slip
- When a complaint arrives, the conversation that matters is spread across personal phones and inboxes nobody can search.
- Ask any vendor
- “Can our compliance officer review who said what, and when, without calling you?”
- In Buzz
- Administrative and conversation activity can be reviewed, across messages, calls, video and documents, in one place.
45 CFR 164.312(b) and 164.308(a)(1)(ii)(D)
Item 6 · Encryption
Encryption, and a vendor that tells you where the boundary sits
- What HIPAA expects
- PHI is protected in transit and at rest, and you understand who can access it and under what conditions, well enough to write it into your risk analysis.
- Where teams slip
- A security page full of adjectives and no list of which features need a server to read content, such as search and file download.
- Ask any vendor
- “Which of your features decrypt content on your servers, and why?”
- In Buzz
- Messages, documents and images are encrypted in transit and at rest. The security page names the exact operations that read content on Skyscape’s servers, so your privacy officer can write them down.
45 CFR 164.312(a)(2)(iv) and 164.312(e)(2)(ii)
Item 7 · Clinical decisions
Clinical answers and the team conversation in one place
- What good looks like
- The evidence behind a decision travels with the decision, inside the same governed conversation.
- Where teams slip
- A nurse looks something up in one app, then screenshots or retypes it into a text thread. The source is lost and the screenshot lands in a camera roll.
- Ask any vendor
- “Where does a clinical reference answer end up once it is shared with the team?”
- In Buzz
- BuzzLightning answers clinical questions from licensed references and attaches the source, right in the conversation. It drafts care plans and appeal letters on top of those cited answers.
Item 8 · Patients and families
Patients and families reached without an app or an account
- What good looks like
- Families can be part of the care conversation through a channel your organization governs, under the same agreement as everything else.
- Where teams slip
- A separate portal nobody logs into, so the conversation drifts back to personal texts.
- Ask any vendor
- “What does a daughter with a phone and no account need to do to join?”
- In Buzz
- BuzzLink lets a patient or family member join from a link with nothing to install and no account to create. It is covered by the same BAA, and administrators decide where it is used.
Item 9 · Governance
One set of controls across every location and discipline
- What HIPAA expects
- Access is granted by role, under policies your organization sets, wherever the work happens.
- Where teams slip
- Each branch or discipline picks its own tool, so policy and visibility fragment along with the conversation.
- Ask any vendor
- “Can we set a policy once and have every location inherit it?”
- In Buzz
- Administrators set roles and organization-level settings once, and every linked space inherits them. A super admin stands behind the administrator, so authority over your account never depends on one person.
45 CFR 164.308(a)(4), information access management
Item 10 · People
Training tied to the tools staff actually use
- What HIPAA expects
- A security awareness and training program for the whole workforce, with records that show it happened.
- Where teams slip
- An annual slide deck about rules, and five different apps in daily use.
- Ask any vendor
- “Who answers my staff’s questions at 9 p.m. on a Sunday?”
- In Buzz
- One tool instead of five is less to teach. Questions go to BuzzConcierge inside the app, around the clock, with phone and email support 8 a.m. to 8 p.m. Eastern on weekdays. Training records remain your organization’s to keep.
45 CFR 164.308(a)(5), security awareness and training
Your score
0 of 10
Tick the items you have in place.
Your open items:
What the score means
- 10 of 10. A strong baseline. Recheck whenever a tool or workflow changes.
- 7 to 9. Close the open items, starting with personal devices, missing BAAs and offboarding.
- 6 or fewer. Team communication is a material exposure. Fix channels and access first; they close the most risk the fastest.
How Buzz maps to the checklist
| Checklist item | In Buzz |
|---|---|
| Business associate agreement | One signed BAA covering messaging, calls, video, fax and documents |
| Off personal apps | BuzzChat, BuzzPhone, BuzzVideo, BuzzFax and BuzzDrive in one place, plus a Buzz phone number for every user |
| Unique accounts and offboarding | One account per person; single sign-on, automatic provisioning and directory-driven removal through BuzzPassport* |
| Device control | Content held under the organization’s account, not a personal message history |
| Audit trail | Reviewable administrative and conversation activity |
| Encryption | Encrypted in transit and at rest; boundary named on the security page |
| Clinical answers | BuzzLightning, with the source attached |
| Patients and families | BuzzLink, nothing to install |
| Multi-site governance | Roles and settings set once in BuzzSpace, inherited everywhere |
| Training and support | Fewer tools to teach; BuzzConcierge in the app, around the clock |
Skyscape holds a SOC 2 Type 2 attestation covering the Security trust services criteria. The report and the BAA are both available to review before you commit.
One simple price for the whole checklist
Every Buzz control in the table above, one per-user price.*
Per person, per month, it costs about what a Venti latte at the airport does. No tiers to decode, and no feature on this checklist held back for an upgrade.
- Risk-free start. Begin with a 30-day premium trial. If Buzz isn’t right for your agency, you don’t owe anything.
- No large contract. Monthly, quarterly or annual billing, your choice, with no lock-in to a term you didn’t pick.
- Onboarding included. Setup and training come with Buzz, and BuzzConcierge support is always free.
- A Buzz phone number for every user, at no extra cost.
*Single sign-on (BuzzPassport) and usage-based services are quoted separately.
What changes when the gaps close
Results reported by the agencies using Buzz:
NPS and G2 from current customer reviews. Star rating, patient volume and rehospitalizations from recent home health case studies.
“Buzz has helped reduce time spent on other administrative tasks like getting documents electronically signed by our providers and notifying providers of critical patient labs and conditions. This on average saves our nursing department staff over 10 hours a week collectively which contributes to an increase in staff satisfaction by 20%.”
Compliance and growth turned out to be the same project: one place the team actually uses, instead of one more app.
Questions care teams ask
Is texting patient information over iMessage, WhatsApp or SMS HIPAA compliant?
Not for workforce communication about patients. Consumer messaging apps do not sign a business associate agreement with your organization, leave messages and photos on personal devices you cannot wipe, and give you no audit trail. Encryption alone does not fix that. A patient may ask to receive unencrypted messages after being told the risk, but that is the patient’s choice and does not cover staff talking to each other.
Is there such a thing as HIPAA certification for a messaging app?
No. HHS does not certify products, companies or people as HIPAA compliant. What a vendor can offer is a signed business associate agreement, documented security controls and independent attestations such as a SOC 2 Type 2 report. Compliance depends on how your organization configures and uses the tool.
Does a signed BAA make a communication tool HIPAA compliant?
A BAA is required, but it is not the whole answer. It makes the vendor contractually responsible for protecting PHI. You still need unique accounts, prompt offboarding, an audit trail, encryption in transit and at rest, and staff who actually use the approved tool instead of a personal app.
What should a home health or hospice agency fix first?
Start with personal devices and missing BAAs, then offboarding. Those three gaps create the most exposure because PHI leaves your control entirely. Replacing personal texting with a tool clinicians prefer closes all three at once.
Can patients and families be part of a HIPAA-compliant conversation without installing an app?
Yes, if the platform supports guest access from a link. In Buzz, BuzzLink lets a patient or family member join from a link with nothing to install and no account to create, under the same business associate agreement. Administrators decide where guest access is used.
Which HIPAA rules apply to team communication?
Mostly the Security Rule: unique user identification (45 CFR 164.312(a)(2)(i)), audit controls (164.312(b)), transmission security (164.312(e)), termination procedures (164.308(a)(3)(ii)(C)), device and media controls (164.310(d)) and security awareness training (164.308(a)(5)). The business associate requirements sit in 164.308(b) and 164.502(e).
What should a HIPAA communication checklist cover for care teams?
A signed business associate agreement with every communication vendor, patient conversations kept off personal apps, unique accounts with prompt offboarding, no PHI left on unmanaged devices, a producible audit trail, encryption in transit and at rest with a clear trust boundary, clinical answers kept with the conversation, a governed way to reach patients and families, consistent controls across locations, and training tied to the tools staff use.
How can home health and hospice agencies reduce HIPAA risk from team messaging?
Move patient conversations off personal apps onto a platform that signs a business associate agreement and gives you unique accounts with prompt offboarding, organization-controlled storage, an audit trail, encryption in transit and at rest, and a clear statement of where the vendor can access content. One platform for messaging, calls, video, documents and clinical answers reduces both risk and tool sprawl.
More detail: Buzz security and compliance · HIPAA-secure communication features · Buzz FAQ · Is email HIPAA compliant? · HHS Security Rule guidance
This checklist is a self-assessment, not legal advice. HIPAA compliance depends on how your organization implements and uses its tools.