HIPAA and Your Phone System: What Actually Applies

There are no HIPAA phone system requirements in the sense most buyers expect, because HIPAA does not certify products. It regulates covered entities and their business associates. The questions that matter are where protected health information comes to rest in your phone system, who can reach it, and whether a signed agreement covers the vendor holding it.

Is there such a thing as a HIPAA-compliant phone system?

No. Compliance is a property of an organization and its practices, not of a product you buy.

A vendor can support your compliance program — by signing a business associate agreement, by limiting who can access stored recordings, by not routing your data through parties you have no agreement with. A vendor cannot confer compliance on you, and a provider whose marketing says "HIPAA-compliant phone system" is describing an aspiration rather than a legal status.

That framing makes the useful question narrow and answerable: which parts of my phone system hold PHI, and what is my agreement with whoever holds them? None of what follows is legal advice — your privacy officer or counsel makes these calls.

Does my phone provider need a business associate agreement?

If the provider creates, receives, maintains, or transmits PHI on your behalf, HHS treats it as a business associate and a BAA is required.

There is a narrow carve-out — the conduit exception — for entities that only transport information without accessing it, the way a courier or an ISP does. HHS has been clear that it does not cover services storing data on behalf of a covered entity, even when the storage is incidental and the data is never read.

That lands hard on phone systems, because a phone system stores things. Voicemail recordings sit on a server; call recordings sit on a server. The conduit argument covers the call path far better than it covers what the system retains around it.

Ask any provider two questions, in this order. Will you sign a BAA? And which subprocessors touch our data, and are they covered by it? The second determines your exposure, and it is the one most vendors answer vaguely.

Where does PHI live in a phone system?

Not in the call — in what the system keeps.

Two observations. The highest-volume PHI in a small practice's phone system is almost always voicemail, not recordings — and voicemail is the component people forget. And voicemail-to-email moves PHI into your email system, which changes the question from "is my phone provider covered" to "is my email provider covered."

Access control is the other half. Signal supports client-side user roles — owner, admin, agent, and read-only — so who can play back voicemail in the portal is a decision you make rather than a default. Make it deliberately and revisit it when staff change. The voicemail box setup guide covers per-box PINs, and the security reference covers access and encryption on our side.

Can I use AI voicemail transcription in a medical practice?

Our position, stated plainly: if your practice handles PHI, leave AI transcription and AI call summaries off until a BAA is in place with the providers involved.

Here is the mechanism, so you can evaluate it rather than take our word. Signal's transcription runs on Whisper and our summaries run on large language models, and both send audio or text to third-party providers — OpenAI and Anthropic. Signal holds no business associate agreement with either. That is why both ship off by default on every client account, and why we do not enable them for a healthcare client as a convenience.

The features are genuinely useful. Reading a voicemail is faster than listening, summaries with action items save real time, and red-flag detection surfaces a call that went badly before it becomes a review. In a business without PHI they are among the most valuable things on the platform. In a practice, the default should be off.

If your privacy officer reaches a different conclusion for a specific non-clinical use, that is a decision for your practice to document, not one we will make for you.

What about call recording?

Two separate obligations, and neither one is HIPAA.

The first is consent. Signal records inbound calls with a consent announcement that plays to the caller. In two-party-consent states that announcement is what makes the recording lawful, not a courtesy, and it stays on. Call recording laws by state covers where the lines fall.

The second is retention. A recorded clinical call is PHI in storage, and unbounded storage is a liability that grows on its own. Decide how long recordings are kept and why, write it down, and apply it. Many practices land on recording only administrative lines. That is a defensible answer.

What should a practice actually configure?

A short list that covers most of the exposure:

1. Set per-box voicemail PINs instead of sharing one across the office.
2. Decide where voicemail-to-email lands — a role mailbox your organization controls, not a personal address.
3. Assign user roles deliberately, so not everyone can play back every message.
4. Leave AI transcription and summaries off while PHI is in scope, and confirm the setting rather than assuming it.
5. If you record, keep the consent announcement on and set a retention period you can state out loud.
6. Write the voicemail script so staff and patients know what gets left in a message — see voicemail in a medical office.
7. Review access the day staff leave, alongside the rest of offboarding.

Does HIPAA prohibit leaving voicemail for patients?

No. The Privacy Rule permits leaving messages, with a limit: disclose the minimum necessary. Name, practice, callback number, and a request to call back is the standard shape. Test results, diagnoses, and clinical detail are not.

Patient preference matters here too. If someone asks you to use a different number or not to leave messages, honor and record that request — reasonable accommodation of confidential-communication requests is part of the rule, not a favor.

Frequently asked questions

Is there such a thing as a HIPAA-compliant phone system?

No. HIPAA regulates organizations, not products, and no vendor makes you compliant by selling you something. A provider can support your program by signing a BAA and controlling access to stored data. Treat "HIPAA-compliant phone system" in marketing copy as a claim that cannot be true as written.

Does my phone provider need a business associate agreement?

If it stores PHI on your behalf — voicemail recordings, call recordings, transcripts — generally yes. The conduit exception is narrow and covers transmission rather than storage. Ask two questions: will you sign a BAA, and which subprocessors touch our data under it.

Where does PHI live in a phone system?

Mostly in voicemail. Patients state names, symptoms, and callback numbers, and those recordings persist. Call recordings and any AI-generated transcripts or summaries also hold PHI. Live call audio is transient, and routing configuration holds none.

Can I use AI voicemail transcription in a medical practice?

Not while handling PHI without a BAA. Signal's transcription and summaries send data to third-party model providers we hold no BAA with, so both are off by default on every account and should stay off for a practice in scope. Voicemail, routing, and reporting are unaffected.

Does HIPAA prohibit leaving voicemail for patients?

No. A message is permitted if it discloses only the minimum necessary — your name, the practice, a callback number, nothing clinical. Honor any patient request for confidential communication by an alternative method, and record that preference where staff will see it.

Want a straight conversation about what to enable and what to leave off? Tell us how your front desk handles voicemail today, and we will configure the phone side around your privacy program rather than around a feature list.