Level365 UCaaS can be used in a HIPAA-compliant manner when it is configured and used correctly. Each Level365 customer is responsible for its organization's HIPAA compliance in all respects, including any applicable state and federal laws and regulations when using Level365 UCaaS within a HIPAA-compliant environment. These guidelines are provided for general guidance only; consult legal and compliance officers about the specifics of the organization's requirements.
Use Restrictions
IP Telephones
Extensions must be assigned to specific individual user names, not generic names such as the front desk. Extensions with a generic name require some other method of tracking device usage. Level365 will not be able to provide information on who participated in calls on those extensions.
Call history can be disabled on telephones so that no Protected Health Information (PHI) is saved on the devices. Call history is enabled by default; to have it disabled, contact Level365 Support.
Voicemail Messaging and Call Recording
Messages and recordings are accessible via secure login to the Level365 web app or with a mailbox PIN. Only authorized users can access messages and recordings.
Voicemail message notifications should be disabled to prevent caller ID information from being sent in emails. To disable them, see the Voicemail Notifications Guide.
SMS/MMS Texting
SMS and MMS text messages are not encrypted and cannot be recalled. PHI must not be sent using the Level365 SMS or MMS function.
For more information, see the Text Messaging Guidelines.
Faxing
Level365 fax infrastructure is stored in a SOC 2 compliant data center. Electronic faxing via the Level365 online portal, fax ATA devices and Fax to Folder/Server services are HIPAA compliant and communicate with the Level365 servers over encrypted HTTPS. Fax to Email is not HIPAA compliant because it sends unencrypted email, and it should not be used.
Call Reports
Authorized administrators can view and download call history reports via secure login to the Level365 web app.
Emailed reporting should not be used because it contains caller names and telephone numbers. To have it disabled, contact Level365 Support.
Contacts
Business contacts can be created in the Level365 application. PHI must not be included in a contact's first or last name, company name or job title.
Video Collaboration
Meetings must be scheduled by invitation only. Access is protected with a passcode by default. Meetings are not listed publicly by Level365.
End-Point Management and Security
The customer is responsible for the security and management of all end-user devices accessing any Level365 services, including desktop and laptop computers and mobile devices. Level365 recommends consulting with the organization's information technology provider on best practices and procedures for device security and password policies.
Some settings mentioned in this article are not enabled by default. For assistance, contact Level365 Support. Consult legal and compliance officers about the specifics of the organization's requirements.