I was looking at RingCentral but they won't sign a BAA. They have something that they call a HIPAA Conduit that they claim is all you need. But they won't do a BAA.
I've been looking at 8X8 who does do a BAA, but Ring Central has features that I like for instance voicemail to email transcription. Google voice does that too.
Easy enough to roll a call headed for VM off into Google Voice for example, use their business apps so that you get the security config, then don't forward out the transcription, but read it with the app.