Important call center compliances when outsourcing

Looking for any third-party call center services provider will probably overwhelm you with the number and variety of options out there.  Choosing among onshoring, nearshoring, and offshoring is already a tough decision in itself. How difficult would it be to consider other factors such as price, scalability, management, services, and most of all, quality?

Businesses, specifically outsourcing providers, need to adhere to legal compliances. This is to ensure that they are providing a safe working environment and their operations are conforming to legal standards. 

Types of compliances you should look for

• PCI DSS Compliance
• TCPA Compliance
• HIPAA Compliance
• ISO 27001 – Information Security Management
• ISO 27701 – Private Information Management
• System and Organization Controls 2 Audit (SOC2)

Compliance is the ability to heed to a set of rules. Compliance standards are regulated by the legislation of the country where the business operates, as well as the jurisdiction of the customers that these call centers serve.

Further, the sections that call centers need to adhere to are the following:

PCI DSS Compliance

The PCI Security Standards Council aims to continuously enhance global payment account data security. The council helps keep systems secure, as they constantly work to monitor data security threats. 

The council regularly improves its Payment Card Industry Data Security Standard (PCI DSS). PCI DSS is an information security standard that determines the rules and regulations on how to properly process, store, transmit, and protect customers’ credit card information. Organizations that accept credit cards as a form of payment in any transaction must follow this PCI Compliance.

Your customers’ confidential credit card information needs the utmost protection. To protect your customers, you have to hire outsourcing providers who are PCI DSS Compliant. The good news is most Philippine business process outsourcing (BPO) companies like SixEleven BPO adhere to this standard, so there’s nothing to worry about in this area.

TCPA Compliance

The Telephone Consumer Protection Act 47 U.S.C. § 227 or TCPA regulates telemarketing calls, auto-dialed calls, pre-recorded calls, text messages, and unsolicited faxes. It extends to all aspects of outbound telemarketing.

The TCPA was created to stop unwanted telemarketing phone calls to consumers. It aims to eliminate excessively intrusive calling practices. However, it doesn’t completely block out the telemarketing practice. Aside from the above mentioned regulations, TCPA and the Federal Communications Commission (FCC)’s provisions under this compliance are the following:

• It prohibits solicitors from calling residences before 8 a.m. or after 9 pm, local time.
• Solicitors need to maintain a company-specific “do-not-call” (DNC) list of consumers who asked not to be called; and callers must honor the DNC Registry.
• Callers shall introduce themselves and the entity on whose behalf the call is being made.

Working with a TCPA Compliant call center is not only ethical, it will also get you on your prospects’ good side.

HIPAA Compliance

The Health Insurance Portability and Accountability Act (HIPAA) sets the regulations to ensure protection of sensitive patient data. Having a HIPAA Compliance means that a company adheres to a series of regulatory standards that outline the lawful use and disclosure of protected health information (PHI).

Covered entities include:

• Anyone in the healthcare sector (those providing treatment, processing payment, and running operations); and
• Their business associates who have access to confidential patient information.

If you’re in the healthcare industry, make sure that your outsourcing provider is HIPAA compliant.

ISO 27001 – Information Security Management

ISO 27001 is the international standard that ensures organizations’ data security and legal compliance through the adoption of an Information Security Management System (ISMS).

This compliance sets the standards needed to prevent cyber security breaches. It also covers the following information security attacks:

• cyber crime;
• fire/damage;
• misuse;
• personal data breaches;
• vandalism/terrorism;
• theft;
• and viral attacks.

Call centers need to meet the requirements and passed the standards set by ISO to be recognized as ISO 27001 certified. This is to ensure that they’re fully qualified to manage the assets provided by third-party clients, such as intellectual property and employee details.

ISO 27701 – Private Information Management

ISO 27701 is an extension of the abovementioned ISO/IEC 27001. However, this compliance focuses on privacy, adding privacy protection guidelines to manage personal information and comply with regulations across the globe.

This compliance further clarifies the roles and responsibilities that call centers need to follow to ensure utmost privacy protection. Since call centers have access to customers’ private details (including full name and credit card number), being ISO 27701-compliant assures clients that their data will be handled properly.

If you’re a business looking for an outsourcing provider to handle sensitive data, make sure that they’re ISO 27701-compliant. To be able to obtain an ISO 27701 certification, businesses will need to have the ISO 27001 certification first.

System and Organization Controls 2 Audit (SOC2)

The System and Organization Controls 2 Audit, more commonly known as SOC2, is an auditing compliance that makes sure that your trusted data providers and third-party vendors securely manage your data. Unlike other types mentioned in this article like PCI DSS and HIPAA, the SOC 2 compliance is unique to every organization.

The compliance, developed by the American Institute of CPAs (AICPA), will access organizations’ systems and processes and how they comply with the following trust principles:

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy