HIPAA compliant. SOC 2 Type II attested. Encrypted everywhere.
Built for healthcare, legal and financial work from the start: a BAA with every healthcare customer, a record of everything, and private information that never lands in an inbox.
HIPAA compliant and SOC 2 Type II attested
IHS Phone was designed for healthcare, legal and financial work from the start, not certified afterward. We sign a Business Associate Agreement with every healthcare customer, and every partner that touches protected health information has signed one with us.
Our SOC 2 Type II report, prepared by an independent CPA firm, covers the security, availability and confidentiality of the service over a period of months. It is available under NDA to customers and prospects, and it is what your auditors, cyber-insurer and larger clients will ask for.
How your information is protected
These are the protections built into the service, in plain terms. Our written policies, staff training and incident procedures sit alongside them, and the service produces the records that prove both are working.
| Protection | What it means for you |
|---|---|
| Encrypted on the way | Calls, texts, faxes, the portal, the apps and every connection between our data centers are encrypted. Every phone and app we provide has call encryption turned on. |
| Encrypted where it is stored | Voicemail, recordings, faxes, your settings and all backups are stored encrypted, with each customer's data kept separate. |
| Nothing private in an inbox | Private information never appears in email bodies or notifications. Voicemail, recordings and faxes are delivered as secure links that open only after sign-in and expire on a schedule, and every download is recorded. |
| Who can see what | Clear roles for owners, administrators, managers and users. Sign-in by work email with two-step verification; single sign-on with Microsoft 365 or Google Workspace if you prefer. Each phone has its own credentials so a lost device can be cut off on its own. |
| A record of everything | Every sign-in, settings change, recording or voicemail played, file downloaded and AI action is written to a permanent record that cannot be edited, kept for six years. |
| Keep it only as long as you should | Set how long recordings, voicemail, faxes, summaries and texts are kept. They are removed automatically on schedule, and the removal itself is recorded. |
| Hardened network | Our networks are locked down to what each service needs, continuously monitored, and automatically block attackers. Our web portals sit behind a web application firewall. |
| Backups and recovery | Daily encrypted backups in more than one location, continuous protection of your settings, and an automated recovery rehearsal every week. |
| Kept up to date | Security updates are applied continuously; larger upgrades are rolled out one data center at a time. |
| Signed-in devices | Sessions expire; you can see every signed-in device and sign one out or wipe an app remotely. |
| Recording consent | Recording announcements by state, consent captured on the call, caller opt-out, and automatic pause while payment details are read. |
| Emergency calls | The correct address for every phone and app, including laptops and mobiles, in line with Kari's Law and RAY BAUM's Act, with instant alerts to your safety contacts. |
| Verified customers | Every account is verified before activation so our network stays trusted, your caller ID stays clean, and your calls show as verified rather than "Scam Likely". |
What you get as a customer
A signed BAA
Part of every healthcare agreement, with the list of partners who have signed one with us.
Evidence on demand
Access records, change history, retention settings and user access reviews, exportable for your risk assessment or an audit.
Your own storage, if you want it
Keep recordings and faxes in cloud storage you own, or keep them inside our data centers only. Your data can be exported or deleted as a unit.
SOC 2 Type II report
Available under NDA, together with answers to your security questionnaire.
See the whole platform in a 20-minute demo
We will walk through your call flows, compliance needs and phones, then show you exactly how IHS Phone handles them. No pressure, no scripts.