Four quotes on your desk. Two are from BPO firms promising “24/7 omnichannel patient engagement”, whose compliance pages cite HIPAA, a United States statute and not the one your Ontario clinic answers to. One is a local answering service that has covered plumbers and law offices for twenty years, at a flat rate per message. The fourth asked what your EMR is and who signs off on your escalation script, and is the most expensive.
The fourth one is asking the right questions, and choosing a call centre for a health clinic really does turn on them.
A patient phone line is not a customer service line. A meaningful share of callers open with clinical content, and an unlicensed agent is not permitted to assess or act on any of it. The design problem is how those calls get recognised and handed off in the first fifteen seconds, before the agent has said anything resembling advice. Cost per call, hold times and bilingual coverage matter, and they are the second conversation. Pick on price and you will redesign the escalation path afterwards, on real patients.
This is general information for clinic administrators, not legal or clinical advice. Your clinical leads own the triage protocol; your privacy officer or counsel owns the compliance questions, including which statute governs you.
What patients are calling about, and who may act
Code two weeks of call logs. Almost everything lands in eight categories, and the useful split is not by topic but by whether closing the call needs a judgment somebody has to own in their own name.
An unlicensed agent can complete these end to end, given a written rule set: new patient and roster enquiries; booking and rescheduling from your service list with real durations encoded; cancellations where the policy is written and absolute, plus the waitlist backfill nobody has time for; directions, hours, forms, interpretation requests; billing quoted from a fee list rather than estimated; and referral or results status, meaning whether a thing has arrived, not what it says. Most of your volume.
These they may only capture and route, on a structured form with mandatory fields:
- Prescription refill requests. Drug, dose, pharmacy and last fill date into a queue is administrative. Telling a patient whether it will be approved is not.
- Results enquiries. “Your bloodwork is back” sounds harmless. It is both a disclosure of health information and an invitation to interpret. The script ends at booking time with the clinician.
- Anything framed as a question for the doctor. Verbatim capture, no paraphrase, no reassurance.
The eighth category is why the build exists: the caller who leads with a symptom. Chest pain. A newborn who will not feed. Suicidal thoughts. Sudden one-sided weakness. A post-operative fever. These calls do not announce themselves. They arrive inside a booking request, phrased casually, at 4:50pm. Your coding gives you a rate for how often that happens. No vendor can tell you that number.
The line your vendor does not get to draw
Symptom assessment is regulated. Deciding whether a complaint is seen today, tomorrow or in the emergency department is clinical work done by licensed people against approved protocols, and in Canada it sits inside provincial scope-of-practice rules administered by the colleges, not a call centre’s quality framework. An outsourced agent is not performing triage. Build something that never lets them try: no judgment, only recognition and handoff, which are different things.
- A red-flag word and phrase list written and signed off by your clinicians, on the agent’s screen at all times, not buried in a training module. Your clinicians decide what is on it. Nobody else.
- One instruction, no branches. When a listed phrase appears, the agent stops collecting details and moves to the handoff line. No triage question, no “how bad out of ten”, no judgment about whether the patient sounds worried enough. Follow-up questions are where judgment creeps in.
- A handoff script requiring no decision, roughly: “I’m the clinic’s phone team, so I’m not able to advise on symptoms. I’m putting you through to a clinician now, please stay on the line.” Then a warm transfer. Plus an explicit emergency instruction for the presentations your clinicians decide warrant one, worded by them, and a rule that the agent never ends that call first.
- A destination that is genuinely answered. Where these builds fail. An escalation path ringing an unattended extension is worse than not answering at all, because the patient now believes they have been handled.
The destination has to exist before the contract starts: a named clinician or nurse on a rota, a backup, and a documented answer for 7pm and Sunday. And the script is a clinical document your practice produces and hands to the vendor. If a vendor offers you theirs, you have learned something.
The Canadian compliance layer, and it is not HIPAA
In Ontario a clinic and its clinicians are health information custodians under the Personal Health Information Protection Act. PHIPA is built around custodians and their agents: you stay responsible for patient information even when someone acting on your behalf handles it. Outsourcing the phones does not outsource that. Federally, PIPEDA covers commercial handling of personal information, and the federal regulator’s published expectations for outsourcing are the clearest available statement of what a call centre contract should contain. Which statute reaches which part of your arrangement is one for your counsel.
The Office of the Privacy Commissioner of Canada published guidance on assessing third-party service providers on 10 September 2026, and it is unusually concrete. Assess a provider’s privacy practices before you sign. Confirm in a contract that they understand their roles, responsibilities and obligations. Establish in writing whether a subcontractor will handle personal information and, if so, their identities, held “to the same standards for privacy protection as the provider.” Agree in advance how a breach will be managed and who does what. And work out how compliance will be monitored on an ongoing basis, which means an inspection right you intend to use.
On sending calls across a border, the OPC’s position is precise and widely misquoted. A transfer to a processor is a use of the information, not a disclosure, so it does not by itself need fresh consent where the processing serves the original purpose. It does need contractual or other means providing comparable protection while the third party holds the data, plus a real risk assessment rather than an assumption that protection abroad is equivalent. There is a transparency duty: make plain, in clear language and ideally at collection, that information may be processed in another country and “may be accessible to law enforcement and national security authorities of that jurisdiction.” And no contract overrides the criminal or national security laws of the country it has gone to, whatever a vendor promises. So offshore patient calls are not prohibited. They are conditional, documented, and something patients are entitled to be told in your privacy notice.
The breach clock is the term most contracts get wrong. Under PHIPA a custodian must notify the affected individual under subsection 12(2), and the Information and Privacy Commissioner of Ontario at the first reasonable opportunity in defined circumstances, under subsection 12(3) and clause 55.5(7)(b). The IPC’s reportable categories include theft, ransomware, unauthorised use or disclosure, a pattern of breaches suggesting something systemic, disciplinary action against an agent over a breach, and any breach significant given sensitivity and volume. Read that as a procurement spec: you cannot notify at the first reasonable opportunity if the contract says the vendor will tell you “promptly.” Put hours in the clause, name who receives the call, and require notice when an agent is disciplined.
If you are reading this from the US
Shorter, because the ground is well covered elsewhere. A call centre creating, receiving, maintaining or transmitting protected health information on your behalf is a business associate, and HHS puts the required contract contents at 45 CFR 164.504(e). A business associate must itself hold a BAA with any subcontractor before disclosing PHI to it, so your vendor’s downstream agreements are your problem. Minimum necessary, at 45 CFR 164.502(b) and 164.514(d), sets how much of the chart a scheduling agent ever sees.
Call recording has two separate questions in it
People conflate them. In Canada, intercepting a private communication is an offence under section 184(1) of the Criminal Code, but subsection 184(2)(a) exempts a person with the consent, express or implied, of the originator or the intended recipient. A party to the call can record it: one-party consent. In the US, 18 U.S.C. 2511 likewise permits interception where one party consented, but several states require all parties to consent, so a vendor with agents in multiple states has a problem your greeting has to solve.
That is only the criminal-law question. Separately, a recording of a patient describing symptoms is health information, needing a stated purpose, a notice the patient hears, a retention period and access controls. Record the line anyway, in my view, because escalation audits are impossible without it. Only with the retention period set before go-live and kept short.
Read-only or write access sets your price
Vendors ask about volume. The bigger question is whether their agents will be inside your EMR. Message-taking is cheap and converts a booking into a callback task that lands back on staff already drowning. Real write access to the schedule is what makes an outsourced line worth having, and it changes the compliance picture. Two things to settle before anyone logs in, plus one email to your EMR rep asking in writing whether your licence restricts third-party or non-domestic access.
- Named accounts, never shared credentials, provisioned and disabled by you within hours of someone leaving the vendor. If the vendor holds one login and rotates staff through it, your audit trail is fiction and you cannot answer the only question that matters after an incident: who opened this record.
- A role that sees the schedule and not the chart. Test it yourself. Scheduling roles that open progress notes and imaging are a shipped default in more systems than vendors admit, and under a minimum-necessary standard that is the wrong starting point.
Answering service, clinical line, or contact centre
Three products sold in identical language. An answering service takes a message against a script and routes by rule: cheap, fine for after-hours capture, unable to resolve anything, and its escalation is a phone tree that cannot recognise a red flag inside an unstructured sentence. A clinical after-hours line is licensed nurses on approved protocols, a different procurement entirely: provincial licensure, liability coverage, protocols your medical director reviews. It is the only one that can assess a symptom, and priced accordingly. A patient contact centre is a staffed administrative team on your line in business hours with EMR access, absorbing volume and handing off clinical content.
The third is what most clinics asking about call centres need, and the usual error is buying the first while describing the third. Most end up with a mix, and the after-hours half of it belongs to your clinical lead.
What to require before you sign
Ask these in one call and grade the speed of the answer, not its polish.
- Named agents on our account, and how many. A rota of thirty shared agents cannot hold your clinic’s knowledge, and the patient hears that on their third question.
- Where the agents physically are: country, office or home, and whether that shifts across the day. In writing, because it drives your cross-border assessment and your patient notice.
- Per-agent training records with dates, privacy training included, and what happens when someone joins mid-contract.
- Our escalation script, signed off by our clinicians, as the only script in use, not edited without our sign-off.
- Audit logs for EMR access and call handling, on request, retained for a stated period.
- Breach notification in hours, to a named person, plus notice when an agent is disciplined over patient information.
- Subcontractor disclosure by identity, in writing, same standards flowed down, notice before a new one is added. The OPC guidance asks for precisely this.
- What happens when a caller says “chest pain”? The most diagnostic question in the procurement. A firm that has run health lines answers in one breath.
On language: where a large share of your patients speak something other than English at home, “we have French” is not an answer. Name your top three or four languages off your own roster and ask for coverage in your actual busy hours, not a claim of forty languages through a relay service. Then the harder question: how is the red-flag list handled in those languages? A translated list your clinicians never reviewed is not a reviewed list, and language capability without an escalation design just gets you a patient who explains their chest pain to someone who cannot act on it.
Measuring it, and the target that will hurt patients
- Abandonment rate. The share who hang up before reaching a human, and the closest thing you have to a count of patients you failed. Measure it for two weeks before the pilot or you have nothing to compare against.
- Time to answer, as a percentile, not an average: what share is answered inside thirty seconds. An average hides the 4pm cliff, where the abandoned calls live.
- Escalation accuracy, not escalation speed. Audit a random weekly sample both ways: calls escalated unnecessarily, and, far more important, calls containing a red-flag phrase that were not. One missed escalation outweighs a month of slow answering, and you only find them by listening to calls nobody flagged.
- Booking accuracy. Right provider, appointment type, duration, location, record. Sample twenty a week at first. Wrong durations are how an outsourced line quietly wrecks a clinician’s Thursday.
Now the one to refuse. Do not set average handle time as a target on a clinical line. AHT is legitimate in retail because a shorter call is usually a better call. On a patient line the longest calls are often the ones that mattered: the confused elderly caller, the parent who took ninety seconds to reach the symptom, the escalation that needed someone to stay on. Score an agent against seconds and you have paid them to cut off those calls. Track it for capacity planning, keep it out of bonus schemes and SLAs, and if a vendor’s standard contract carries an AHT commitment on a health line, strike it and watch what they say.
An eight-week pilot you can undo in a minute
Never hand over the main line first. Keep your own number and use forwarding, so the whole experiment reverses in a minute. Weeks one and two: after-hours and the lunch hour, calls that go to voicemail today, so the worst case is no change. Capture and escalation only. Weeks three and four: daytime overflow forwarded after four rings, read-only EMR, bookings still keyed by your staff so you can judge the data the agents produce. Weeks five and six: write access fenced to a fourteen-day window and standard appointment types. Weeks seven and eight: your two busiest days on the main line.
Throughout, your clinical lead signs off weekly, in writing, that the red-flag list is working, and you listen to ten random recordings a week yourself, short ones included, not a sample the vendor picked. Clean audit at week eight, extend. Otherwise you have lost some overflow coverage and nothing that was working.
If you would rather not assemble this from four half-fitting quotes, AB7 Solutions builds patient contact and healthcare support teams that work inside your EMR instead of emailing your front desk a pile of messages, and will go through the call taxonomy, the recognition-and-handoff design your clinicians sign off on, the PHIPA or HIPAA paperwork and the agent-location and subcontractor disclosures before quoting a rate. Start with overflow and after-hours: +1 321 341 7733, ab@ab7solutions.com or director@ab7solutions.com, or https://www.ab7solutions.com.
Questions clinic administrators ask next
Can an outsourced agent tell a patient to go to the emergency department? Reading an instruction your clinicians wrote, triggered by a phrase your clinicians listed, is not the same as deciding the patient needs it. The safe version has the agent making no assessment and no choice between options. Get the wording from your clinical lead and do not let it be broadened.
Does a call centre outside Canada put us offside? Not automatically. The OPC treats a transfer to a processor as a use rather than a disclosure, requires comparable protection secured by contract plus a real risk assessment, and expects you to tell patients their information may be processed abroad and reachable by that country’s authorities. Your privacy officer and counsel decide whether your arrangement clears it.
How much volume justifies outsourcing? Look at abandonment before volume. A clinic taking 200 calls a week at 4% abandonment does not have a phone problem worth a contract. At 25% the same clinic has fifty people a week who gave up, and some of them needed something.
Sources: Office of the Privacy Commissioner of Canada, Guidance on assessing third-party service providers (10 September 2026) and Guidelines for processing personal data across borders; Information and Privacy Commissioner of Ontario, Report a privacy breach (PHIPA ss. 12(2), 12(3), 55.5(7)(b)); Criminal Code, s. 184; 18 U.S.C. 2511; US Department of Health and Human Services, Business Associates and Minimum Necessary Requirement.
Related reading
Related AB7 service: HIPAA-trained healthcare remote professionals.