High-regulation notice
This is a C fit. Patient phone outreach touches protected health information, so the HIPAA Privacy Rule governs what may be said, to whom, and on what record. A software vendor cannot decide any of that. Nothing on this page is legal advice, and nothing here is a compliance program.
Before the first dial block you need a written privacy review, approved scripts, a minimum necessary standard, a recording and retention decision, and a named owner inside the organization. One boundary is plain: DialBreeze does not currently sign a business associate agreement, so protected health information must not flow through it. HHS cloud computing guidance treats a vendor that handles protected health information as a business associate, which is exactly why PHI and DialBreeze do not mix today. Administrative-only calling with no clinical detail is the lane that remains.
What this page actually covers
DialBreeze places live calls with a person on every answered line, up to three lines at once. For healthcare that means every design choice about what is spoken, what is recorded and what is stored is a privacy decision.
The defensible uses are narrow and administrative: appointment confirmation, scheduling and rescheduling, referral coordination, and recall reminders using an approved script with no clinical detail left on a voicemail.
Three administrative workflows
Appointment confirmation. The caller identifies the clinic, verifies that the person answering may receive the information, and confirms the time. No clinical detail is discussed beyond what the script permits.
Rescheduling and referral scheduling. Administrative logistics. The note captures the preference and the new time, nothing more.
Recall reminders for overdue preventive care. The script is written by the clinical team, approved by the privacy officer, and contains no diagnosis. A patient who asks a clinical question is routed, not answered.
What the record should carry, and what it should not
Contact preference, channel preference, appointment changes, and a do-not-call flag. A patient’s request for no voicemail detail should be honored permanently. Clinical questions should be routed to a clinician and, unless your privacy review says otherwise, not stored in the calling system at all. Access should be limited to staff who need it, and retention should match the organization’s policy rather than the tool’s default.
The rules that stack
Under 45 CFR 164.502(a) a covered entity may use or disclose protected health information for treatment, payment or health care operations as permitted by 45 CFR 164.506, and a business associate may only use or disclose it as permitted by its business associate contract under 45 CFR 164.504(e). Minimum necessary is in 45 CFR 164.502(b). A message that promotes a product or service rather than the patient’s own care, or that involves financial remuneration, can fall under the marketing provisions and require an authorization under 45 CFR 164.508.
On the calling side, 47 CFR 64.1200(a)(1) restricts autodialed and prerecorded calls to wireless numbers, calling hours for telephone solicitations run within the legal calling window in the called party’s local time, and several states require all-party consent to record a call. Some states impose medical privacy rules stricter than HIPAA.
Why publish this page at all
Healthcare organizations search for a patient outreach dialer, and the honest answer is that the dialing is the easy part. A page that skipped the privacy analysis would put an organization at risk. This page states the sequence instead: privacy review, agreement, scripts, then calls.
What you need to start
- A completed HIPAA review with a named privacy officer.
- A written PHI decision. DialBreeze does not currently sign a business associate agreement, so protected health information must not enter the system; administrative-only data is the boundary.
- Prepaid calling credit: DialBreeze provides the calling and the numbers, at $0.75 per dialing hour.
- Approved scripts, a minimum necessary standard, and a retention decision.
Pick your plan and seats, check out, set your password. Load calling credit and start dialing.; never load real patient data until the review is signed.
Why the sequence matters more than the dialer
The common failure shape in healthcare outreach is starting the calls before the privacy work is done: the calls look fine for weeks, and then a patient complains about a voicemail, or a vendor relationship turns out to need a contract nobody signed, and the whole program stops while the organization catches up.
Doing the review first costs a few weeks and saves the program. It produces the script, the voicemail rule, the retention period and the access list, and it means the first call is already inside the organization’s policy. It also produces something more valuable than compliance: a clear answer to what the call is for, which makes the queue better.
Scheduling is the highest-value administrative use
Of all the calls an organization could make, the confirmed appointment is the one with the clearest benefit and the least disclosure risk. A confirmed visit reduces no-shows, keeps clinician time productive, and is understood by patients as a service rather than an interruption.
The design rule is simple. Confirm identity before discussing anything specific. Keep the voicemail to a name, the practice and a callback number. Capture the reschedule request and the preference, and let a scheduler handle the change rather than negotiating on the call. That covers most of the value with very little exposure.
What good looks like after six months
An outreach function that has been running with a review in place looks unremarkable, which is the point. Scripts do not change much because the approved wording works. Voicemails are dull by design. The retention schedule is followed, so old records age out on time. The privacy officer reviews exceptions rather than every call.
The measurable benefits are the ordinary ones: fewer no-shows, a shorter appointment backlog, and a record of patient preferences that the clinical staff can actually use. None of that requires the calling system to hold clinical information, and the program is stronger because it does not.