HIPAA-Compliant Phone Systems: What Qualifies and How to Choose

No phone system is "HIPAA certified," because HIPAA does not certify products or vendors. A phone setup is acceptable when every vendor that stores or transmits protected health information (PHI) for your practice signs a business associate agreement (BAA), and your practice configures and uses the service with appropriate safeguards. This applies to voicemail, call recordings, transcripts, texts and faxes. This guide explains how HIPAA treats calls compared with stored data, gives a vendor checklist, and checks the BAA status of Google Voice, RingCentral and Grasshopper. It is general information, not legal advice. Confirm decisions with your privacy officer or counsel.

Are phone calls HIPAA compliant? The short answer

Discussing PHI on a phone call is permitted. A front desk coordinator can call a patient to confirm an appointment, and a biller can call a payer about a claim. The question is how the call is carried and what gets stored afterward.

HHS guidance has distinguished between traditional landline calls and calls carried over electronic communication technologies such as VoIP and cellular apps, which can bring the Security Rule into play. In practice, the risk sits less in the live conversation and more in what the system keeps:

• Live calls: a conversation that is not recorded or stored.
• Voicemail: a stored audio file that often contains names, dates of birth and reasons for calling.
• Call recordings: stored audio, sometimes kept for months.
• Transcripts and voicemail-to-text: stored text, often processed by an AI service.
• Texts (SMS/MMS): stored messages on vendor servers and on devices.
• E-fax: stored documents such as referrals, lab orders and records requests.

The conduit exception and its limits. HHS treats entities that only transmit data, such as the postal service or a telephone carrier, as "conduits" rather than business associates, provided they store PHI only transiently. A VoIP vendor that stores voicemail, recordings, transcripts, texts or faxes is doing more than transmitting. Such vendors are generally treated as business associates and need a BAA.

Is VoIP HIPAA compliant? VoIP itself is neither compliant nor non-compliant. It is a way of carrying calls. Whether a VoIP service is suitable for PHI depends on two things: the vendor's willingness to sign a BAA covering the features you use, and how your practice configures access, retention and devices.

For related topics, see our healthcare communication and HIPAA guides.

What a HIPAA-compliant phone service needs

1. A BAA signed before PHI is handled. Sign the BAA before the first voicemail lands. Many vendors offer a BAA only on specific plans, as a paid add-on, or after a request to sales. Read the scope. Some BAAs cover voice and voicemail but exclude SMS, fax or AI features.

2. Encryption in transit and at rest. Ask which data is encrypted and where it is stored: call signaling and media, voicemail files, recordings, transcripts, texts and faxes. If you get only a general answer, ask for the vendor's security documentation. The Security Rule's technical safeguards are the reference point.

3. Access controls and audit logs. Check for these:

• Unique logins for every staff member. A shared front desk password does not meet this bar.
• Two-factor authentication.
• Admin roles that separate who can change call routing from who can listen to recordings.
• Fast offboarding. When a medical assistant leaves on Friday, their app access and voicemail access should end on Friday.
• Logs showing who accessed or downloaded recordings and voicemail.

4. Retention and deletion settings. Recordings and voicemails pile up quickly. Set retention to match your written policy, and confirm the vendor can delete data automatically and on request. HIPAA's six-year retention requirement applies to required policies and documentation. Medical record retention is set by state law, so map phone data to both.

Vendor question checklist (print this)

#	Question to ask the vendor	Answer
1	Will you sign a BAA? On which plans or add-ons?
2	Which features does the BAA cover: voice, voicemail, recordings, transcription, SMS/MMS, fax, AI features?
3	Which features are explicitly excluded?
4	Where is data stored (country/region), and which sub-processors handle it?
5	Is voicemail, recording, transcript and fax data encrypted at rest?
6	Do you support SSO or 2FA, and role-based admin permissions?
7	Are access logs available for recordings and voicemail?
8	Can we set automatic retention and deletion periods?
9	Is AI transcription or summarization covered by the BAA? Is call data used to train models?
10	What happens to our data when we cancel?

Use this alongside the practice-wide HIPAA compliance checklist for clinics.

Phone apps, numbers and cell phones

Are cell phones HIPAA compliant? A device is never compliant by itself. What matters is how it is secured and which apps handle PHI on it. A staff phone used for work should have:

• A passcode or biometric lock with a short auto-lock time.
• Device encryption turned on and confirmed in the phone's settings.
• Remote lock and wipe, ideally through mobile device management (MDM) for practice-owned or enrolled devices.
• Current OS updates.
• A written policy on which apps may be used for patient-related work.

Why personal numbers and native SMS are a risk. When a nurse texts a patient from a personal number, the message sits on the device and with a carrier that has no BAA with your practice. When that nurse leaves, the thread and the patient's number leave with them. A business phone app with a separate practice number and a BAA keeps calls, voicemail and texts inside a managed account you can audit and shut off.

For therapists. Solo and group-practice therapists often use one phone for scheduling calls, voicemail and sometimes audio sessions. Look for:

• A BAA that covers voice, voicemail and any texting you plan to use.
• A separate business number on your existing phone.
• A voicemail greeting that doesn't invite clients to leave clinical detail.
• Recording turned off by default.

If you are unsure whether HIPAA covers your practice at all, start with does HIPAA apply to therapists. We don't rank a "best" app. The right one is the one whose BAA covers the features you actually use.

Free and cheapest options. Free tiers and consumer versions of phone apps usually do not include a BAA. Low-cost business plans may include one or may require an upgrade or add-on. Per-user pricing varies by vendor and plan, so check each vendor's current pricing page. Compare on BAA scope first, then on price.

Phone and fax, texting and call tracking

Phone and fax. E-fax services receive and store documents that are almost always PHI: referrals, prior authorization forms, lab results. The fax provider needs a BAA. If you buy phone and fax from the same vendor, confirm whether one BAA covers both or whether fax is a separate product with separate terms. Also check where inbound faxes are routed. A fax-to-email setup carries over whatever risk your email has.

Texting from the business number. SMS features are often excluded from BAAs or limited to specific plans, partly because carriers outside the vendor's control carry the messages. Appointment reminders that contain only the date and time are lower risk than messages that mention a diagnosis or a test result. Our guide to HIPAA-compliant texting rules covers consent and content in detail. For other written channels, see HIPAA-compliant email, HIPAA email disclaimer examples and HIPAA-compliant live chat for websites.

Call tracking for marketing. Call tracking assigns unique numbers to ads or web pages, records calls, and passes caller data to analytics or ad platforms. For a practice, a call from a "knee replacement consultation" ad can reveal health information, especially when caller numbers or recordings are sent to an ad network. HHS issued a bulletin on online tracking technologies that addresses this kind of data flow. Parts of it have been challenged in court, so check its current status with your counsel.

Criteria for a HIPAA-compliant call tracking provider:

• A signed BAA covering tracking numbers, recordings and caller data.
• Recording controls: off by default, redaction options, and retention limits.
• No PHI sent to ad or analytics platforms that have not signed a BAA. Conversion data stripped of health details.
• Access logs and role controls for marketing staff and agencies.

Ask each provider for its BAA and confirm the scope in writing.

AI phone systems, transcription and voicemail-to-text

AI receptionists, call summaries, voicemail-to-text and sentiment analysis all process call audio, which means they process PHI. Before turning them on:

• Confirm the BAA explicitly covers the AI features, not just core calling.
• Ask which sub-processors, such as speech-to-text or language model providers, handle the audio, and whether they are covered.
• Ask whether call audio or transcripts are used to train models, and whether you can opt out.
• Ask where processing happens and how long transcripts are retained.

An AI receptionist that books appointments also needs clear limits on what it says and when it hands off to staff. For the broader rules, see HIPAA and AI tools.

Vendor checks: Google Voice, RingCentral, Grasshopper

These checks state BAA availability only. Vendor terms change, so every cell below must be confirmed against the vendor's current documentation with a date.

Google Voice. Google's BAA is part of its Google Workspace terms, so any coverage applies only to Google Voice used through a Workspace account, not to the free consumer version tied to a personal Google account. Check Google's current included-services list to see which Voice editions and features, such as calls, voicemail and SMS, are covered. Edition pricing varies, so check Google's current Workspace pricing page.

How to make Google Voice HIPAA compliant (verify each step against Google's current documentation):

1. Use Google Voice through a Google Workspace account, not a personal Google account.
2. Review and accept Google's BAA in the Admin console.
3. Confirm that the Voice features you plan to use, especially SMS and voicemail transcription, are within the BAA's scope.
4. Enforce 2FA, limit admin roles, and set retention for voicemail and call history.
5. Turn off or restrict any features outside the BAA's scope.

RingCentral. Check RingCentral's current HIPAA documentation for whether a BAA is offered, which plans it requires, and whether RingCentral Fax and SMS/texting are in scope. Get the answer in writing before handling PHI.

Grasshopper. Check Grasshopper's current statement on HIPAA and whether it offers a BAA. Get the answer in writing before handling PHI.

Vendor	BAA available	Plan required	Voice	Voicemail	Fax	SMS	Source	Date verified
Google Voice	Confirm with Google	Google Workspace account (confirm edition)	Confirm	Confirm	Confirm	Confirm	Google Workspace BAA included-services list	Record date checked
RingCentral	Confirm with RingCentral	Confirm	Confirm	Confirm	Confirm	Confirm	RingCentral HIPAA documentation	Record date checked
Grasshopper	Confirm with Grasshopper	Confirm	Confirm	Confirm	Confirm	Confirm	Grasshopper's HIPAA statement	Record date checked

For other vendors, see more HIPAA tool checks.

Hospital and multi-location phone systems: choosing for your practice

Selection criteria for a practice with several sites:

• Locations and extensions: how many numbers, extensions and departments, such as scheduling, billing and referrals.
• Call routing: after-hours routing, overflow between locations, and hunt groups for the front desk.
• Fax volume: a practice receiving 200 referral faxes a week needs routing to the right site queue, not one shared inbox.
• Integrations: caller ID lookup in scheduling or EHR systems. Check whether those integrations fall under the BAA.
• Mobile staff: managers and providers who move between sites need the app, not a desk phone.
• BAA scope: one BAA covering every feature in use, at every location.

Hospital telephone systems usually combine an enterprise PBX or unified communications platform with a separate clinical communication platform for care teams. That is a different category from a practice phone system. For an overview, see clinical communication platforms.

A business phone system and a team chat do different jobs:

Need	Business phone system	Staff team chat
Patient and payer calls	Yes	No
Inbound/outbound fax	Yes (with fax BAA)	No
Practice phone numbers, routing	Yes	No
Internal staff questions and follow-ups	Possible but slow	Yes
Announcements to all locations	No	Yes
Assigned tasks with owner and deadline	No	Yes (in tools that include tasks)

Where internal staff calls and coordination fit

Many "quick calls" in a practice are not patient calls at all. The front desk calls the office manager about a double-booked room. One location calls another to ask whether a supply order arrived. A biller calls the clinic manager to chase a missing signature. These calls tie up phone lines, leave no record, and end without a clear owner for the follow-up.

Chanty is internal team communication for staff, not a business phone system. It brings staff chats, in-app voice and video calls, voice messages, announcements, files and assigned tasks into one workspace, used alongside your phone system and clinical systems. Free includes unlimited 1:1 calls. Business adds group calls and screen sharing. Any message can become a task with an owner and a due date, so "can someone check on this?" ends with someone assigned to check. HIPAA compliance with a signed BAA is available on the Business and Enterprise plans, not on Free. Your practice still configures roles, access and staff policies. The BAA does not cover third-party integrations or external AI models connected to the workspace. See HIPAA-compliant chat for staff.

To be clear about what Chanty is not: it does not provide phone numbers, PSTN calling, call routing, patient calls, call tracking or fax. Fax is planned and not available today. It is not for telehealth or therapy sessions.

FAQ

Are phone calls covered by HIPAA?

Yes. PHI discussed on calls is protected, and HIPAA permits these conversations with reasonable safeguards. Calls over VoIP and apps can bring the Security Rule into play, and anything stored afterward is stored PHI. This includes voicemail, recordings and transcripts.

Is VoIP HIPAA compliant?

VoIP is a technology, not a compliance status. A VoIP service can be used with PHI when the vendor signs a BAA covering the features you use and your practice applies access, retention and device safeguards.

What makes a phone service HIPAA compliant?

A signed BAA with clear scope, encryption for stored data, unique logins and 2FA, role-based admin access, audit logs for recordings, and retention and deletion controls. Your practice's policies and training complete the picture.

Is Google Voice HIPAA compliant, and does the free version have a BAA?

Google's BAA is part of its Google Workspace terms, so any coverage applies only to Google Voice used through a Workspace account, not to the free consumer version. Check Google's current included-services list for which Voice features are covered.

How do I make Google Voice HIPAA compliant?

Use it through a Google Workspace account, accept Google's BAA, confirm the Voice features you use are in scope, enforce 2FA and admin limits, and set retention.

Is RingCentral HIPAA compliant, including fax and texting?

Check RingCentral's current HIPAA documentation for whether a BAA is offered, which plans it requires, and whether RingCentral Fax and SMS are in scope, and get the answer in writing before using it with PHI.

Is Grasshopper HIPAA compliant?

Check Grasshopper's current statement on HIPAA and whether it offers a BAA, and get the answer in writing before using it with PHI.

Are cell phones HIPAA compliant, and how do I secure staff phones?

No device is compliant by itself. Require a passcode, encryption, auto-lock, OS updates and remote wipe, ideally through MDM. Keep patient-related calls and texts in business apps covered by a BAA rather than on personal numbers.

What is the best HIPAA-compliant phone app for therapists?

There is no single best app. Choose one whose BAA covers voice, voicemail and any texting you use, that gives you a separate business number, and that lets you turn off recording and control retention.

Is there a free HIPAA-compliant phone number?

Free tiers and consumer phone apps usually do not include a BAA. Without a BAA, a free number should not be used for PHI.

Can voicemail and call recordings contain PHI?

Yes, and they often do. Patients leave names, dates of birth and symptoms in voicemails. Treat voicemail, recordings and transcripts as stored PHI, covered by the BAA and your retention policy.

Is call tracking HIPAA compliant?

It can be, if the call tracking provider signs a BAA, recordings are controlled, and no PHI is passed to ad or analytics platforms without a BAA. Review the HHS tracking technologies guidance and its current legal status.