Every HIPAA certification is different because there are no government guidelines to say what exactly a certification must include. We provide a BAA that covers our hosted PBX and we also provide guidance to ensure that you use the phone system in a way that does not violate HIPAA. For example, you cannot use FAX over email unless you have a fully encrypted email solution. HIPAA covered entities also should not keep voicemail to email.