Covered services
In a HIPAA organization, you can use these services with patient information:
To learn how covered data is protected, see How we handle your data.
Outside the BAA
Z360 handles features outside the BAA in three ways:Not HIPAA-supported and unavailable
These features rely on vendors that do not have the required BAA. They are unavailable for PHI in a HIPAA organization:- Voices or models labeled Not HIPAA-supported.
- Third-party apps connected through the integration service, including calendar connections.
Outside the BAA
Email, your own EHR or CRM, and custom actions or MCP connections to your own systems are not covered by Z360’s BAA by default. After a written request from the BAA signer, a practice-owned destination can be enabled and labeled Enabled at your request. Your practice is responsible for the destination’s safeguards and can ask Z360 to turn the connection off.Configured not to receive PHI
Product analytics and error monitoring are outside the BAA and are configured so they do not receive PHI. Session replay is disabled for HIPAA organizations. Web search and research are blocked for HIPAA organizations and must not be used with PHI.Email appears in the same Z360 Inbox as your texts, but only SMS and MMS conversations are covered. Email isn’t.Before a covered call is recorded, Z360 plays a recording disclosure that your practice can approve. AI voice agents identify themselves as AI assistants. Your practice is responsible for approving the wording and obtaining any consent required by applicable law.HIPAA organizations can turn call recording off and configure automatic deletion where those controls are available in their settings.