What Practice Administrators Should Ask a Phone Vendor Before Signing

Practice administrators are routinely asked to judge phone systems using criteria written for IT departments. Feature charts, integration matrices, and technical specifications answer questions an administrator was never asking.

After 29 years of sitting across the table from buyers, I can tell you the decision really turns on four things: compliance scope, how the system is run across sites, what happens when something goes wrong, and what the contract actually says. Most of these questions get asked after signature. That is the wrong order.

Here are fifteen, grouped by area. Each comes with what a good answer sounds like and what should worry you. Ask them of every vendor, including us.

Compliance and agreements

1. Will you sign a business associate agreement, and which services does it name?

Almost every vendor in this market will sign one. The question that separates them is scope.

HHS sets out what a business associate contract must contain. The list covers permitted uses and disclosures, required safeguards, breach reporting, and disclosure to satisfy patient access requests. It also covers availability of records to the Secretary and the return or destruction of protected health information at termination.

What HHS does not do is tell you which of a vendor's products the agreement covers. A platform sells voice, voicemail, fax, messaging, video, and contact center. An agreement may not name all of them.

Good answer: a written list of the services covered, and a copy of the agreement before you sign.

Warning answer: "We're fully HIPAA compliant." That is a marketing sentence, not a scope.

2. What happens to our recordings, voicemail, and call metadata when the contract ends?

The HHS provisions address return or destruction of protected health information at termination. Ask what that looks like in practice.

Good answer: a named export format, a stated window, and proof that metadata travels with the media.

Warning answer: "We'd work with you on that."

3. Is text messaging to patients covered, and how?

Standard text messaging is not encrypted end to end. It crosses carrier networks that sit outside any business associate relationship, on every platform. That is a property of the transport, not a flaw in one vendor. Texting patients is still possible, but it requires the right safeguards, including informing patients of the risk and respecting their choice, and business texting now requires carrier registration as well.

Good answer: a clear line between what is covered and what is not, guidance on patient consent, and help with carrier registration.

Warning answer: any claim that the vendor's text messaging is HIPAA compliant on its own. Ask how, and press on the transport.

4. Where is our data stored, and in what jurisdiction?

Good answer: named regions, and whether you can choose them.

Warning answer: "In the cloud."

5. Can retention be set differently for different record types?

Voicemail, call recordings, and messaging often need different retention. A single global setting forces the shortest requirement onto everything. Or the longest onto everything.

Good answer: per-record-type setup, with a legal hold that can be applied narrowly.

Warning answer: one global setting described as "fully configurable."

Multisite administration

6. Is a person created once, or once per site?

Good answer: one directory and one identity, with permissions and queue memberships that follow the person.

Warning answer: a per-site console with a bulk import tool.

7. Can we apply a standard configuration to a new location?

Good answer: a site template covering hours, routing, queues, greetings, retention, and permissions.

Warning answer: "Our team will configure it for you," which is fine once. It is expensive at the fifth location.

8. Can a practice manager change their own hours without being able to change routing or retention?

Delegation with no boundaries creates the configuration drift problem. No delegation at all creates a central bottleneck.

Good answer: role-based permissions with a stated boundary.

Warning answer: administrator or nothing.

9. Can I see, on one screen, how recording and retention are configured across every site?

This is the question an auditor will ask in a different form.

Good answer: yes, with a demo during evaluation.

Warning answer: an export you assemble yourself.

10. Does reporting span sites by default?

Good answer: cross-site views without export.

Warning answer: per-site reports and a spreadsheet.

What happens when something goes wrong

11. Describe, as a sequence, what happens at one of our sites when its primary connection to your platform fails.

Ask for a sequence. Not a redundancy claim, not an availability figure. What happens, in order. And what a person at the front desk sees.

Good answer: a stated behavior, including what does not work.

Warning answer: a percentage. A number is not a behavior.

12. If your messaging or meeting service is degraded, does voice continue?

Good answer: a clear statement of which parts fail together and which do not.

Warning answer: "Everything is redundant."

13. What support commitment is in the contract, as opposed to on the website?

Good answer: a response commitment in the contract, with the definition of response.

Warning answer: a marketing response time nobody will put in the agreement.

Contract terms

14. What governs the rate in month thirteen?

Three structures exist: a fixed renewal rate, a capped increase, or a return to then-current list pricing. The third is the most common default. It is also the least favorable.

Good answer: the clause, quoted.

Warning answer: "We rarely raise prices."

15. Which number are you quoting, retail or qualified, and what qualifies us?

Qualified rates are real prices. They are available under specific conditions such as annual agreements, migrations, bundled deployments, or volume licensing. They are not the default rate. Comparing one vendor's qualified rate against another's retail rate gives you a wrong answer.

Good answer: both numbers, with the conditions stated.

Warning answer: one number with no label.

What we say when asked these

Fair questions deserve our own answers. I would rather publish them than have you discover them.

PanTerra signs a business associate agreement. The right way to judge it is to ask us for the list of covered services in writing and read it against the channels you actually use, exactly as you would with any vendor. We will not describe standard text messaging as HIPAA compliant, and no vendor should.

Retail pricing is published on our pricing page, where Business Plus is listed at $24.95 per user per month. Business Plus starts at $14.95 per user per month with qualifying terms and team sizes. Our support and service commitments are written into the contract, and I would rather point you there than quote a marketing figure.

And the honest fit. If your priority is coverage across many countries, other vendors serve that better than we do. The same is true if you need the largest marketplace of integrations with other software in the category. Those buyers should look elsewhere, and I would rather say so during the evaluation than in month four.

Frequently Asked Questions

What should I ask a phone system vendor before signing?

Fifteen questions across four areas: which services the business associate agreement names, how administration works across multiple sites, what happens during an outage described as a sequence, and what governs the renewal rate. Ask every vendor the same list.

How do I know if a vendor's BAA covers what I need?

Ask for the covered-services list in writing and read it against the channels you actually use. A signed agreement does not automatically cover every product a vendor sells, and "we're HIPAA compliant" is not a scope statement.

What contract terms matter most?

The renewal rate structure, whether the support commitment appears in the agreement or only in marketing, and the data portability and exit provisions. All three are easier to negotiate before signature than at renewal.

What is a warning answer?

Any answer that substitutes a capability claim for a mechanism. "Everything is redundant" instead of what fails together. "Fully HIPAA compliant" instead of a covered-services list. "We rarely raise prices" instead of the clause.

Who else should be in the vendor conversation?

Whoever owns compliance, before the first demo rather than after the shortlist. A requirement discovered late costs weeks. Discovered first, it costs a paragraph in the requirements document.

Should I ask these questions of a vendor I already like?

Especially then. The purpose is not to catch anyone out. It is to have the answers written down before you need them, which is the only time getting them is easy.

Quick Answers

• Compliance: ask which services the business associate agreement names. Do not ask whether the vendor signs one.
• Administration: ask whether a person is created once or once per site.
• Outage: ask for a sequence, not an availability percentage.
• Contract: ask what governs the rate in month thirteen. Then read the clause.
• Pricing: ask which number you are being quoted, retail or qualified. Then ask what qualifies you.