Genesys Cloud CX for healthcare contact centres

In the UK, data concerning health is special category data under UK GDPR, which the ICO explains carries significant risks to people's fundamental rights and freedoms if misused. The ICO notes that its guidance is under review following the Data (Use and Access) Act, so we check the current position with your data protection team at the start of every project. In a contact centre, health data appears in more places than people expect: what callers say, what an IVR collects, what an agent's script shows, what a recording keeps, what an analytics tool transcribes and what an integration sends to another system.

We map that path in discovery and design each step on purpose. Data actions fetch only the fields a journey needs, scripts show only what the agent needs, recordings follow agreed policies, and integrations are documented as contracts so your information governance team can see exactly what crosses each boundary. Genesys Cloud CX can be deployed in its London region for UK organisations, and in US regions for US organisations, so data stays where your obligations say it should.

In the United States, the HIPAA Privacy Rule sets national standards for protecting certain health information, and the Security Rule sets the administrative, physical and technical safeguards that covered entities and their business associates must put in place for electronic protected health information. HHS explains that a covered entity needs satisfactory assurances, in a written contract known as a business associate agreement, from any business associate that creates, receives, maintains or transmits protected health information on its behalf.

Genesys states that every HIPAA Genesys Cloud organisation requires a valid business associate agreement with Genesys, that HIPAA compliance is available in its AWS US East and US West regions, and that there is no HIPAA certification for a cloud services provider. Genesys also notes that its agreement does not extend beyond Genesys Cloud, and that some channels, such as ACD email and SMS, are excluded. We design around those boundaries: which channels carry protected health information, which integrations need their own agreements, and how the contact centre is configured once the HIPAA setting is enabled.

In England, all organisations that have access to NHS patient data and systems must use the Data Security and Protection Toolkit to provide assurance that they handle that data well. A contact centre that supports NHS-funded services, or a supplier's service desk that handles NHS patient information, is part of that picture, so its access controls, recording, retention and integrations are designed with the toolkit's expectations in mind and documented for your next submission.

The Accessible Information Standard requires providers of NHS and publicly funded adult social care to identify, record, flag, share and meet people's information and communication needs, and to review them. A contact centre can make that real: data actions can read a recorded communication need so the IVR offers a different route and the agent's script shows it before the conversation starts, and messaging and callbacks give people alternatives to waiting on the phone.

Many healthcare calls follow a pattern: when is my delivery, can I book it, what does my plan cover, where is my claim. Self-service that answers them safely frees clinical and support teams for the conversations that need a person. The design challenge is identifying people securely, using only the data each journey needs, and handing over gracefully, with context, whenever the caller needs help.

For a UK healthcare services provider, our Phase 1 lets patients be identified from their number, check their prescription and order, choose from up to three delivery dates and book the order in the IVR, with a two-hour delivery window for orders already on their way. For a US health benefits provider, we rebuilt an immense IVR on Genesys Cloud CX with eight voice bots and 17 back-end APIs, so members and providers check eligibility, benefits and claims and receive summaries by fax or email.

We muster a multidisciplinary team from our own bench, with leadership in contact centre technology since 1984, and every delivery team member holds, or is completing, Genesys Cloud certification. Discovery brings in your clinical leads, information governance, data protection and security teams alongside operations, so requirements reflect how care is actually delivered. We are comfortable working in phases: going live with a minimum viable product when integrations are late, then adding self-service once the systems behind it are ready.

Every release is built and tested in a development organisation before it reaches patients or members, and every go-live follows a written method statement. We work directly with healthcare organisations and through global systems integrators and reseller partners, and we are a Genesys referral partner, not a reseller.