Healthcare
Patients say things on the phone they would not put in an email
Clinics, dental practices, therapy groups and home care. Your phone system handles protected health information whether you planned for it or not — in voicemail, in call notes, in the reason somebody is calling back.
The part that matters most
Your patients’ voices stay on our hardware
Hosted voicemail transcription normally works by uploading a recording to a third‑party speech service. For most phone systems, that means a recording of your patient describing a symptom leaves the vendor and reaches a company you have never assessed.
Corinne transcribes on hardware Reverie Tech owns and operates. The service is reachable only from inside the platform. There is no third‑party transcription vendor in the path, because there is no third party.
For a practice, that removes an entire subprocessor from the conversation. It is the single clearest difference between Corinne and the hosted systems you are probably comparing it with.
Worth asking any phone vendor
- Which company transcribes our voicemail?
- Is that company inside your BAA?
- How long do they keep the audio?
- Is any of it used to train a model?
- Are calls between our desk phones and your server encrypted?
Ask us the same five. Our answers are on this page.
Controls
What supports your obligations
HIPAA asks a covered entity to protect PHI in transit and at rest, limit who can reach it, know who did reach it, and keep it no longer than needed. Here is what Corinne contributes to each.
In transit
Every call leg is TLS‑signaled and SRTP‑encrypted, including between the handset on a desk and our platform. There is no cheaper tier where calls inside your clinic travel in the clear.
At rest
Voicemail and recordings are encrypted where they are stored, with keys belonging to your practice rather than one key across the platform.
Who can reach it
Roles decide what each person sees, enforced on the server rather than hidden in the page. A front‑desk user cannot reach another department’s messages by guessing a web address.
Who did reach it
Every configuration change records the person, the change, what it was before, and where they were. The log is append‑only, so it cannot be tidied up afterwards, including by us.
How long it is kept
You set retention for voicemail and recordings, and expired content is purged automatically. A legal hold exempts specific items when you need them kept for a complaint or an investigation.
Recording stays off
Call recording is disabled until somebody with the authority turns it on, set per practice or per extension, and turning it on is itself audited. Consent rules vary by state and that decision stays yours.
Being straight with you
What still has to be agreed
Technical controls are one half of HIPAA. The other half is contractual, and it is not something a feature list can settle.
A covered entity needs a signed Business Associate Agreement with any vendor that handles PHI. If your practice is considering Corinne, raise the BAA in the first conversation. We will deal with it before anything else, not as paperwork after you have committed.
On certifications, the honest position has two halves. The platform runs in a datacenter certified to SOC 2 Type II and ISO 27001, which covers physical access, power and environmental controls. Corinne’s own software has not been through either audit.
We would rather your compliance officer hear that from us in week one than discover it in week three. If a certification of the application itself is a procurement requirement, say so early and we will tell you where that stands.
The everyday problem, too
Compliance is the part that gets attention. The part that costs money is simpler: a patient calls once to book, reaches a full mailbox or a phone ringing in an empty room, and books somewhere else.
- Every route ends somewhere deliberate — no call falls off the end
- Overflow to another desk, or to a cell phone, before voicemail
- Voicemail arrives as text, so a message left at 7pm is read at 7:01
- A record of every missed call, so somebody can call back the same morning
- Separate after‑hours handling for urgent calls
Start with the BAA conversation
Bring your compliance officer. We would rather answer hard questions now than discover a blocker after your numbers have moved.