Answering service for medical offices — answered in seconds, not sent to voicemail
An answering service for a medical office is a service that answers patient calls your front desk can't — after hours, at lunch, during a rush, on weekends and holidays — takes a structured message or books the appointment, routes anything urgent to your on-call provider, and does it while protecting protected health information (PHI). The job is simple to state and hard to do well: never let a patient call die in voicemail, and never mishandle the one call that's an emergency.
The real cost of a missed patient call
Most practices lose patients not at the front desk but in the gaps around it — the lunch hour, the after-hours window, the weekend, the moment when both lines ring and one rolls to voicemail. A missed call from an established patient is a no-show waiting to happen; a missed call from a new patient is usually a patient who books with whoever picks up next.
The numbers behind that are well documented in service research, even if every practice's are different. Industry research suggests most callers won't leave a voicemail and won't call back a second time — they move down the list. Studies of inbound leads report that the odds of converting a new inquiry drop sharply when the response is delayed; one widely cited analysis found roughly an 80% fall-off in conversion once a response slips past about five minutes. A medical office feels this twice: as lost revenue from the empty slot, and as a care gap when the patient who needed to be seen simply gives up.
The honest math is not 'answer faster.' A front desk can only hold so many lines, and nights and weekends are unstaffed by design. The fix is coverage that's always on, answers on the first ring, and can actually do something with the call — book it, route it, escalate it — instead of just recording it for someone to deal with tomorrow.
What a medical answering service actually is
A medical answering service answers calls on behalf of a healthcare practice and handles them to the practice's instructions: greet the caller, identify why they're calling, take a structured message or book an appointment, and escalate anything urgent to the on-call provider. It is a messaging and routing service — it collects and forwards, and it does not give clinical advice. That boundary is the whole point: the service makes sure the right information reaches the right person fast, and stays out of the practice of medicine.
One disambiguation, because it trips people up in search: 'Medical Answering Services' is also the name of a specific company that brokers non-emergency medical transportation for Medicaid in New York. That is a transportation broker, not a phone-answering service. This page is about the latter — the service that answers your practice's phone.
A modern version of this is an automated medical answering service: instead of a room of human operators reading from a script, an AI voice agent answers the call, holds a natural conversation, follows your routing rules exactly, and books straight into your calendar. The patient-facing job is identical. What changes is that it answers every call on the first ring, never has a hold queue, costs the same whether you get 40 calls a month or 4,000, and follows the script the same way at 3 a.m. as at 3 p.m.
Answering service vs. virtual receptionist vs. AI agent vs. in-house
Four ways to cover the phone, and they are not interchangeable. A legacy answering service takes messages; a human virtual receptionist is a person handling your calls remotely; an AI agent holds the conversation and acts on it; an in-house front desk does everything but only during staffed hours. Here is how they actually compare.
| Legacy answering service | Human virtual receptionist | MapleVoice AI agent | In-house front desk | |
|---|---|---|---|---|
| Answers 24/7 | Yes, but often with a hold queue at peak | During contracted hours; after-hours costs more | Yes — every call, first ring, no queue | Only during staffed office hours |
| Books appointments live | Usually takes a message for callback | Yes, if given calendar access | Yes — reads live availability and writes the booking back | Yes |
| Routes urgent calls | Yes, per your escalation list | Yes | Yes — recognizes red flags and escalates per your standing orders | Yes |
| Cost model | Per-minute or per-call — bills climb with volume | Per-seat or per-minute, plus after-hours premiums | Flat monthly, no per-minute meter | Salary, benefits, turnover, and training |
| Handles call spikes | Hold times grow; some callers drop | Limited by the number of agents on shift | Every concurrent call answered at once | Lines stack up; calls roll to voicemail |
| Consistency | Varies by operator and shift | Varies by person and day | Same script, same routing, every call | Strong, until the desk is busy or short-staffed |
| Done-for-you setup | You write the scripts and account profile | You onboard and manage the relationship | We build, tune, and run it — live in about 48 hours | You hire, train, and manage |
Why most answering services frustrate patients (and how we fix it)
Ask around — patients have opinions about answering services, and most of them are complaints. Long holds before a human picks up. An operator who can only take a message and can't actually book anything. Details garbled between the call and the message that lands on the practice's desk. Being told 'the office is closed, please call back during business hours' when the whole reason they called after hours was that they couldn't call during them. None of this is the operator's fault; it's the model's.
The early answer to that — replacing operators with a robotic phone tree or a bot that hangs up the moment a caller goes off-script — made it worse, not better. Industry research consistently finds that a large share of callers dislike talking to obviously automated systems, and a meaningful fraction will simply hang up on a bot that can't understand them. A medical office is exactly the wrong place to lose those callers.
We build for the opposite. The agent answers on the first ring, so there's no hold. It books appointments and answers routine questions itself, so most callers are done in one call rather than waiting for a callback. It captures details into a structured message, so nothing gets garbled in translation. And when a caller wants a person, or the call is urgent, it hands off cleanly — with everything the caller already said — instead of making them start over. The goal isn't to sound human for its own sake; it's to actually resolve the call.
How MapleVoice sets it up for you
This is done-for-you. You don't build prompts or wire up software — you tell us how your practice answers its phone, we build and test the agent, and you approve it before a single patient hears it. Most practices are live in about 48 hours.
Tell us how your front desk works
In onboarding we map your appointment types, providers, hours, scheduling rules, and — most importantly — your escalation logic: what counts as urgent for your specialty, who the on-call provider is, and exactly how an after-hours emergency should reach them. If PHI is involved, we sign a BAA before any of this goes into production.
We build, script, and test it
Our team scripts the greeting (including a clear AI disclosure), the booking flow, the red-flag recognition, and the handoff triggers, then tests it against real call scenarios for your specialty. You review and approve the script and the routing before it goes live.
Connect your number and scheduler
You can port your existing number or simply forward your line to the agent — for all calls, after-hours only, or on overflow when your desk is busy. We connect your scheduler so the agent books real open slots and writes confirmed appointments straight back.
Go live, and we keep tuning it
From day one the agent answers around the clock — booking, routing, and escalating on its own, and handing complex calls to your team with context. We monitor real calls and keep refining the scripts and escalation rules as part of the service, not as a paid add-on.
What a real patient call sounds like
Here's an illustrative after-hours call: a routine booking that turns into a possible urgent symptom, and a clean handoff to the on-call provider. Notice the agent discloses it's an AI assistant up front, books what it can, recognizes a red flag, and never gives clinical advice — it escalates per the practice's standing orders.
Illustrative example, not a recording of a real patient. Scripts and escalation rules are configured per practice.
After-hours, weekend, and overflow coverage
Most practices don't need the phone answered 24/7 by a person — they need it answered the moment their own desk can't. The agent slots into whatever gap you have: nights and weekends, the lunch rush, the holiday closure, or every call that comes in while both your lines are busy.
After-hours answering service
Forward your line after closing and on weekends and holidays. The agent books routine requests for the next open slot and pages your on-call provider for anything urgent, so patients never hit a 'call back during business hours' message.
Overflow on busy lines
Roll calls to the agent only when your front desk is already on the phone. Patients who'd have hit voicemail get answered and booked instead — without you hiring another receptionist for the rush.
Lunch and short-staffed days
Cover the midday gap and the days you're down a person. The agent answers on the first ring while your team steps away, then hands back anything that needs them with the details already captured.
Full 24/7 coverage
If you'd rather the agent be the primary line, it can answer every call around the clock and escalate to your team or on-call exactly as your routing rules specify. One flat monthly price covers all of it.
AI, human, or hybrid — the honest answer
We're not going to tell you AI is always the right answer. It isn't. The honest framing is that calls fall into three buckets, and a good service knows which is which.
AI handles the high-volume, well-defined calls best: booking and rescheduling, confirming details, answering routine 'are you open / where are you / do you take this' questions, capturing a structured message, and screening for urgency. It does these on the first ring, on every concurrent line at once, identically at 3 a.m. and 3 p.m., for the same flat price whether the volume is light or heavy. That's the majority of an answering service's job, and it's where human operators get expensive and inconsistent.
A human is the right answer when the call needs judgment, empathy in a hard moment, or a clinical decision. That's why the agent transfers to a person — your staff or your on-call provider — with the full context of what the caller already said, rather than trying to be something it isn't. Many practices run this as a hybrid by design: the AI is the always-on front line that resolves most calls, and people handle the calls that genuinely need people.
And there are things the AI must never do, by design: it does not diagnose, it does not give medical advice, it does not promise prices or coverage, and it does not pretend to be a human. Those guardrails aren't limitations we're apologizing for — they're the point. An answering service's job is to route and capture accurately, not to play doctor.
Transparent pricing: flat monthly, no per-minute meter
Most medical answering services bill by the minute or the call, which means your best months — the busy ones — produce your worst bills, and a single long call or a bad month of spam can blow the budget. Here's the landscape, and where MapleVoice sits.
| Pricing model | How it works | Cost predictability |
|---|---|---|
| Per-minute | You're billed for every minute of every call, often rounded up, sometimes with a monthly minimum. | Low — costs rise with volume and call length; spam and long calls hit the bill directly. |
| Per-call / tiered | A bundle of calls or minutes per month, with overage charges once you pass the tier. | Medium — fine until a busy month pushes you into overages or a higher tier. |
| Flat monthly (MapleVoice) | One predictable monthly price for the agent, regardless of how many calls or minutes it handles. | High — the busy months cost the same as the quiet ones; no per-minute surprise. |
| In-house staff | Salary, benefits, and overhead for front-desk coverage, plus the cost of nights and weekends going uncovered. | Medium — predictable as payroll, but doesn't scale to after-hours or call spikes without more hires. |
MapleVoice is a flat monthly price with no per-minute meter, so a busy month never produces a surprise bill. We don't publish a fabricated number here — see /pricing for current plans, and ask us for a quote against your call volume.
HIPAA done right: BAA, encryption, access controls, audit trails
If a service answers calls for your practice, takes messages, books patients, or connects to your scheduler, it is handling PHI — which makes it a Business Associate under HIPAA, not a neutral 'conduit.' The conduit exception (45 CFR 160.103) is narrow: it covers carriers that merely transmit data, like the phone company or the postal service, and does not cover a service that creates, receives, or stores PHI on your behalf. So the first question to ask any answering service is simple: will you sign a BAA? MapleVoice does. A signed BAA is required before any production use involving PHI, and our standard BAA is available for review on request at info@maplevoice.ai.
One myth to retire: there is no official 'HIPAA certified' status. The HHS Office for Civil Rights certifies no one — any vendor claiming to be 'HIPAA certified' is describing a third-party assessment, not a government seal. What actually matters is whether the four required safeguard pillars are in place, backed by a real BAA. Here's what we mirror from our HIPAA Compliance Statement.
A real BAA
A signed Business Associate Agreement is required before any production use with PHI, following the minimum required elements under 45 CFR 164.504(e). It's available for review before you sign. PHI is not used to train general-purpose or shared AI models.
Encryption
TLS 1.3 in transit for all platform traffic and AES-256 at rest for stored recordings, transcripts, and records — so PHI is protected both on the wire and on disk.
Access controls
Role-based access limited to the minimum necessary, unique user IDs, strong authentication and MFA for personnel, and automatic session timeouts — consistent with the minimum-necessary standard (45 CFR 164.502(b)).
Audit trails
Comprehensive, tamper-evident audit logging of access to PHI, plus a documented incident-response and breach-notification process aligned with the HIPAA Breach Notification Rule.
Sources: Conduit exception / business-associate definition (45 CFR 160.103) · BAA required elements (45 CFR 164.504(e)) · Minimum-necessary standard (45 CFR 164.502(b))
Read our full HIPAA compliance statement →Urgent and on-call triage: the tiered model
Good answering services don't treat every call the same — they sort by urgency and route accordingly. We configure a tiered model with your practice so the agent recognizes what's urgent for your specialty and escalates per your standing orders. Important boundary: this is symptom-based screening and routing to the right person, not licensed nurse triage. The agent collects and escalates; it does not diagnose or advise. (Practices that want true clinical telephone triage typically use protocols like Schmitt-Thompson, staffed by licensed nurses — a separate capability from a standard answering service.)
Tier 1 — Emergency
Life-threatening red flags (e.g., chest pain, trouble breathing, signs of stroke, severe bleeding). The agent advises the caller to hang up and call 911 if it's an emergency, and immediately pages the on-call provider per your standing orders.
Tier 2 — Urgent, same-day
Symptoms that need a provider soon but aren't 911 calls. The agent captures the details and reaches your on-call line within the window your protocol defines, rather than holding the message until morning.
Tier 3 — Routine clinical
Refill requests, results questions, non-urgent symptoms. The agent takes a structured message and routes it to the right queue for the next business day, or books a visit if that's the right next step.
Tier 4 — Administrative
Scheduling, directions, hours, paperwork, billing hand-offs. The agent handles what it can on the call and routes the rest to the right person — keeping these off your on-call provider entirely.
Does an answering service give medical advice?
No — and a good one is built so it can't. A standard answering service, human or AI, collects information and routes it. It does not diagnose, interpret symptoms, recommend treatment, or tell a patient what their condition is. The reason is both legal and clinical: giving medical advice is the practice of medicine, it carries real liability, and it belongs to your licensed providers, not to the service answering the phone.
Our AI agent has this boundary wired in as a guardrail. When a caller asks 'is this serious?' or 'what should I take?', the agent does not answer the clinical question. It screens for urgency using the questions your practice configured, captures the details, and either routes the message or escalates to your on-call provider — and it tells the caller plainly that it can't give medical advice and is connecting them to someone who can. For anything that sounds like an emergency, it directs the caller to 911.
This is also where AI is, frankly, safer than a tired human operator improvising at 2 a.m.: it never freelances clinical opinions, never gets pulled into giving advice it shouldn't, and follows the same escalation logic on every call. If your practice does want true clinical telephone triage — a licensed nurse working a standardized protocol like Schmitt-Thompson — that's a distinct service, and we'll tell you so rather than blur the line.
Works with your EHR, scheduler, and phone system
An answering service is only as useful as where the information lands. The agent connects to the systems you already run so a booking becomes a real appointment and a message reaches the right inbox — no re-keying, no message pads, no calendar drift.
For scheduling, we connect directly to practice-management and booking systems we support — including Jane and SimplePractice, which clinics use to run their calendars — so the agent reads live availability with the right practitioner and writes the confirmed appointment straight back during the call. We also connect general schedulers like Google Calendar, Calendly, Acuity, and Mindbody. Where we don't have a native connection to a specific EHR or practice-management system, we deliver structured messages and booking details where your team already works — a secure inbox or portal, your scheduling queue, or SMS — and write back where an integration exists. We name a system only when the integration genuinely exists; we won't claim a connector we don't have.
On the phone side, you keep your number. Port it to us or forward your existing line — all calls, after-hours only, or on overflow — and route transfers to your staff or on-call provider exactly as your rules specify. For the current list of supported integrations, see our integrations directory.
Missed-call → instant text-back
Some patients don't want to talk — they called, didn't get through, and would happily handle the rest by text. So when a call can't be completed or a caller drops, the agent can fire an instant text back: a short, friendly message acknowledging the call and offering to book, answer a quick question, or take a callback request. Industry research is blunt about why this matters — most callers won't leave a voicemail and won't call twice, so the practice that follows up in seconds keeps the patient the practice that waits until morning loses.
The text-back is configured to your rules and stays inside the lines: it doesn't include clinical content, it honors opt-outs, and it's sent under the same TCPA framework described below. It's a recovery net, not a marketing blast — aimed at the patient who was already trying to reach you.
Booking, reminders, and fewer no-shows
The most valuable thing an answering service can do isn't take a message — it's end the call with an appointment on the books. The agent books live against your real availability, confirms the details before the caller hangs up, and can follow up so fewer of those appointments quietly evaporate.
Live booking, not callbacks
The agent reads your real open slots, books the right appointment type with the right provider, and writes it straight back to your scheduler — so the call ends with a confirmed appointment, not a message that needs a callback.
Confirm before hanging up
Every booking is read back and confirmed with the caller on the call, so the details they agreed to are the details on your calendar. Fewer wrong durations, fewer wrong providers, fewer surprises at check-in.
Reminders that cut no-shows
Appointment reminders are well-studied: industry research reports they can reduce no-shows by roughly 25–35%. The agent can send confirmations and reminders within your TCPA settings, so booked slots are more likely to actually show.
Reschedules instead of empty slots
Patients can call any hour to move an appointment, and the agent finds a new time and updates your scheduler on the spot — turning a would-be no-show into a rebooking instead of a hole in the day.
Patient texts & callbacks, inside the TCPA rules
HIPAA isn't the only rulebook in play. The moment your service texts or auto-calls patients — reminders, confirmations, missed-call text-backs — you're in the Telephone Consumer Protection Act (TCPA), which governs automated and texted contact. The good news for medical offices is that the TCPA includes a treatment exemption: certain healthcare messages about a patient's own care — appointment reminders, confirmations, pre-op and post-discharge instructions — can be sent without the prior express written consent that marketing requires, provided they meet the conditions (the message is about the recipient's treatment, sent to the number the patient gave the provider, free to the recipient, kept short and infrequent, and includes an easy opt-out).
The lines that matter: the exemption is for treatment and healthcare messages, not marketing — a 'book your next cleaning, 20% off' text is marketing and needs separate consent. And the exemption never overrides an opt-out: if a patient says stop, contact stops. We configure the agent's texting and callbacks to stay inside these conditions, honor opt-outs automatically, and keep clinical content out of plain SMS. As always, your practice owns the consent and contact policies; we build the agent to operate within them, not to make legal determinations for you.
Answering-service playbooks by specialty
What's urgent, what's routine, and what 'after hours' should mean are different for a dental office than for a hospice. We tune the script and escalation logic per specialty. These are illustrative playbooks — your standing orders always define the actual thresholds, and the agent screens and routes; it does not diagnose.
Dental →
Common calls: New-patient and recall booking, Reschedules and cancellations, Insurance and cost questions (routed, not answered), After-hours pain and trauma calls.
Tier-1 red flags: Facial swelling spreading toward the eye or neck, Difficulty breathing or swallowing, Knocked-out permanent tooth (time-critical), Uncontrolled bleeding after extraction.
After-hours: Most calls book for the next available slot; true dental emergencies page the on-call dentist and the caller is directed to the ER for airway-threatening swelling.
Family practice & physician offices →
Common calls: Sick visits and routine appointments, Refill and results questions (messaged to the right queue), Provider and hours information, After-hours symptom calls screened for urgency.
Tier-1 red flags: Chest pain or pressure, Trouble breathing, Signs of stroke (face droop, arm weakness, slurred speech), High fever or lethargy in an infant.
After-hours: Routine requests are booked or messaged for the next business day; urgent symptoms reach the on-call provider, and emergencies are directed to 911.
Behavioral health
Common calls: New-client intake and screening calls, Session scheduling and reschedules, Routine refill and paperwork requests.
Tier-1 red flags: Active suicidal or homicidal ideation, Self-harm in progress, Acute crisis or inability to stay safe.
After-hours: Crisis calls are escalated immediately and the caller is directed to 988 (Suicide & Crisis Lifeline) or 911; routine intake and scheduling are handled with extra care around privacy.
Home health & hospice
Common calls: Family questions about a patient's care, Visit scheduling and coordination, Symptom and comfort-care calls, Equipment and supply requests.
Tier-1 red flags: Uncontrolled pain or distress, New shortness of breath, Signs of active dying the family isn't prepared for, A fall or safety emergency in the home.
After-hours: Hospice and home-health lines are essentially always 'on' — the agent pages the on-call clinician for symptom and comfort calls and handles coordination calmly at any hour.
OB/GYN
Common calls: Prenatal and well-woman appointment booking, Pregnancy-related symptom calls, Results and refill questions.
Tier-1 red flags: Heavy vaginal bleeding, Severe abdominal pain, Decreased fetal movement, Signs of preeclampsia (severe headache, vision changes, swelling), Possible labor or ruptured membranes.
After-hours: Pregnancy-related red flags page the on-call provider immediately; routine prenatal and gynecologic requests are booked or messaged.
Urgent care
Common calls: Wait-time and walk-in questions, Hours, location, and services, Whether to come in or go to the ER (screened, not advised).
Tier-1 red flags: Chest pain or trouble breathing, Severe injury or heavy bleeding, Signs of stroke, High-acuity symptoms beyond urgent-care scope.
After-hours: The agent shares hours and wait expectations, and for anything that sounds beyond urgent-care scope, directs the caller to 911 or the nearest ER rather than booking a visit.
Veterinary →
Common calls: Appointment and recheck booking, Prescription and food refill requests, After-hours owner questions, Emergency vs. wait-until-morning screening.
Tier-1 red flags: Trouble breathing or collapse, Bloat / distended abdomen (GDV), Toxin ingestion (chocolate, xylitol, antifreeze, etc.), Hit by a car or major trauma, Seizures that won't stop.
After-hours: Routine requests are booked; true emergencies are routed to the on-call vet or referred to the nearest emergency animal hospital per the clinic's instructions.
Med spa
Common calls: Treatment and consultation booking, Pricing and package questions (routed, not promised), Reschedules and cancellations.
Tier-1 red flags: Severe reaction after a procedure (swelling, blistering, signs of infection), Unexpected severe pain, Vision changes after a facial filler.
After-hours: Most calls are routine bookings; post-procedure complications are escalated to the clinical contact, and anything emergent is directed to urgent care or 911.
Physical therapy
Common calls: Evaluation and follow-up scheduling, Plan-of-care and visit questions, Reschedules and cancellation policy.
Tier-1 red flags: New numbness, weakness, or loss of bladder/bowel control, Severe unexplained pain or swelling in a limb, Chest pain or shortness of breath during or after exercise.
After-hours: PT calls are largely scheduling, handled around the clock; red-flag symptoms are routed to the supervising clinician or directed to urgent care as appropriate.
For small and part-time practices
Solo and small practices feel the missed-call problem most sharply, because there's no spare person to grab the second line. When the provider is with a patient, there's often no one to answer at all — so calls go to voicemail, and a meaningful share of those callers don't call back. A flat-rate AI answering service is built for exactly this: it's a full-time front line that doesn't need a salary, benefits, or a desk, and it costs the same whether you take 30 calls a week or 300.
Part-time and concierge practices get a different but related win: coverage that matches an irregular schedule. The agent answers on the days and hours you don't, books patients into the slots you do offer, and routes urgent calls to you without tying you to the phone. You stay reachable to patients without being on call to the phone itself.
The honest caveat we give every small practice: if your call volume is genuinely tiny and your patients are happy booking through an online link, you may not need this yet. AI answering earns its keep when the phone is a real channel — when missed calls mean missed patients. If that's you, a flat monthly price is usually far less than the lost bookings, and far less than hiring for nights and weekends.
Switching from your current answering service
Changing answering services sounds disruptive and usually isn't. We've structured the migration so the new line is tested and proven before it ever carries a real patient call, and so PHI is handled correctly on the way out of your old vendor.
Sign the BAA first
Before any PHI moves, we execute a BAA. Nothing involving patient information goes live until that's signed — that's the non-negotiable starting point for switching any service that touches PHI.
Rebuild your scripts and escalation logic
We translate your current account profile — greetings, routing, on-call list, urgency thresholds — into the agent's scripts, and improve on the parts that frustrated patients with your old service. You review and approve before anything is live.
Port or forward your number
Keep your existing number. Port it to us, or simply forward your line — which means you can switch with zero number changes and zero downtime for patients.
Cut over after-hours first
We typically go live on the after-hours and overflow window first, so the agent proves itself on real calls while your front desk still handles daytime. Once you're confident, you can expand its coverage as far as you want.
Dispose of PHI with the old vendor
When you leave your previous service, instruct them to return or securely destroy any PHI they hold under your BAA with them — call recordings, message logs, and account data — and confirm it in writing. We'll help you build the checklist.
Transparent AI: your patients always know
We don't try to trick patients into thinking they're talking to a person. The agent discloses that it's an AI assistant at the start of the call — clearly and in plain language — and tells the caller what it can do: book, take a message, or reach a provider for an urgent issue. Patients overwhelmingly prefer knowing, and disclosure is the honest default, not a feature we bury.
The guardrails are explicit and configured before go-live. The agent does not diagnose or give medical advice. It does not promise prices, coverage, or outcomes. It does not pretend to be human, and it hands off to a person the moment a caller asks or the call needs one. And before it reads back anything that could be PHI, it verifies identity the way your front desk would — confirming who it's speaking with — so patient information isn't disclosed to the wrong caller.
Behind all of it sits the compliance posture above: a signed BAA for production PHI use, encryption in transit and at rest, minimum-necessary access, and audit logging. Transparency with the patient on the phone and rigor in how their data is handled aren't separate goals — they're the same standard, applied at both ends of the call.
Frequently asked questions
Live in about 48 hours
We build, tune, and run it for you — flat monthly price, no per-minute meter. A signed BAA is available for any production use involving PHI.