Healthcare / radiology
How we build a HIPAA critical-results relay before anyone touches PHI
A worked example of the compliance groundwork behind a healthcare program. This one is an overnight radiology relay, and it shows what gets written down before an agent dials.
Before any agent handles protected health information, we sign a Business Associate Agreement, write a standard operating procedure with the client, and train against it. For an overnight radiology relay that means patient identity confirmed by medical record number, the provider's name read back and spelled, and every attempt logged within 15 minutes.
Why this one is a process study
The other case studies on this site report what happened. This one reports what we write down before anything happens, because that is the part healthcare buyers actually need to see and the part most vendors will not show you. The program described here is a pilot with items still being confirmed with the client, so there are no outcome numbers on this page and none are implied.
The work
Agents call the treating provider at a US hospital to relay a critical radiology finding, confirm it was received, and document the contact. In clinical terms this is closed-loop communication. A finding relayed to the wrong person, mis-stated, or left undocumented is a patient safety failure, not a missed KPI. Accuracy beats speed every time.
What gets written before an agent dials
- Business Associate Agreement, signed. No agent touches PHI before the BAA is executed and they are authorised in the client's environment.
- A standard operating procedure, written with the client, stating that where the client's instructions and ours differ, the client's instructions govern.
- Hard rules the agent may never break. No clinical advice. No interpreting a finding. Confirm the patient by medical record number, never by name alone. Read the provider's name back, spelled. Never guess: escalate instead.
- A secured workspace standard. No personal phone at the desk, nothing written down, screen not visible to anyone else.
- An escalation path with a clock on it. First attempt within 15 minutes of receiving a finding, re-attempt every 10 minutes, escalate after three attempts or 30 minutes, whichever comes first.
The relay itself
| Step | What the agent does | Standard |
|---|---|---|
| Identify | States who is calling and why, in one line | Approved script only |
| Confirm patient | Reads the medical record number digit by digit | Every call, no exceptions |
| Relay finding | States the finding exactly as written | No paraphrase, no interpretation |
| Capture provider | Takes the full name, spelled, then reads it back phonetically | Every call |
| Close the loop | Confirms the provider acknowledges the finding | Logged with time and outcome |
| Document | Logs to the client registry keyed by record number and hospital | Within 15 minutes |
Two details in that table do a lot of work. The registry is keyed by medical record number and hospital, never by patient name, which is the minimum necessary to do the job. And the completed log moves only over the client's secure encrypted email. No PHI travels by SMS, chat or fax, ever.
What we hold ourselves to
- Documentation accuracy of 99% or better. A guessed entry on a clinical relay is not acceptable.
- Quality assurance score of 95% or better, with at least 10% of calls reviewed monthly.
- Every attempt documented, not only the successful ones.
- No finding is ever dropped. It is worked until the loop closes or escalation takes over.
They have consistently demonstrated professionalism, responsiveness, and a genuine commitment to understanding our needs. They handle our requirements with impressive care and attention to detail. We have always felt that our success matters to them and that we are working with a trusted partner rather than simply another service provider.
Questions buyers ask about this engagement
Does a call centre need a BAA to handle patient information?
Yes. A vendor handling protected health information on your behalf is a business associate under HIPAA and needs a signed Business Associate Agreement before any PHI is shared. We do not let an agent touch PHI before that agreement is executed.
What is closed-loop communication for critical radiology results?
It means the critical finding is not only sent but confirmed received by the treating provider. The agent confirms the patient by medical record number, states the finding verbatim, reads the provider's name back, and logs the time and outcome.
How fast should a critical result be relayed?
On this program the first call attempt goes out within 15 minutes of the finding arriving, with re-attempts every 10 minutes and escalation after three attempts or 30 minutes, whichever comes first. Your own clinical governance should set the target.
Can a call centre agent answer a clinical question?
Not on this program. Agents relay and document only. Any clinical question goes back to the radiologist through the escalation path, and the agent never interprets a finding or gives medical advice.
Client anonymised at our discretion. This page describes the operating procedure and controls for one healthcare program, which is a pilot with some items still being confirmed with the client. It reports no outcomes and should not be read as a claim of results. Nothing here is legal or clinical advice, and your own counsel and clinical governance should set your standards.
Want this run for your desk?
A pilot month, priced at cost, with a live team inside seven days.