HIPAA-compliant voicemail

From the healthcare operations glossary. "HIPAA-compliant voicemail" is not a legal category or a certification. Practices use the phrase to describe how they store, open and leave voicemail that contains patient information. Whether a setup qualifies depends on both the vendor and the staff who use it.

What HIPAA-compliant voicemail means

HIPAA-compliant voicemail is a voicemail setup where recordings containing PHI are protected by Security Rule safeguards, covered by a vendor BAA and handled under clinic policy.

The term comes from industry usage. No product is "HIPAA certified," and a voicemail system only supports compliance when it is configured and used correctly. Three building blocks are involved:

• Protected storage and access. Recordings and transcripts sit behind individual logins, with access limits and activity logs.
• A signed BAA with the vendor that holds the recordings. This covers wherever the audio and any transcripts are stored.
• Staff rules about message content. These set what goes into outbound messages, who retrieves inbound ones and how long recordings are kept.

In practice at a clinic or small practice

Inbound messages. Patients leave voicemails with their name, date of birth, medication names or questions about a test. The front desk or office manager retrieves them from a shared mailbox, a desk phone, or a voicemail-to-email or app transcript. The practical questions are:

• Who can open the mailbox?
• Does everyone share one PIN, or does each person log in?
• Do transcripts land in someone's personal email or on a personal phone?
• How long are recordings kept before they are deleted?

A shared four-digit PIN taped to the front desk and transcripts forwarded to a personal Gmail account are common gaps.

Outbound messages. Nurses and front desk staff leave messages on patients' phones. Clinic policy should set the minimum detail to leave. A typical example is "Please call the office at this number" rather than results or diagnoses. Staff should also honor the patient's preferred contact method recorded at intake. When a voicemail needs action from someone else, such as a billing question or a refill request, the handoff to the right staff member should be tracked so the message doesn't sit unanswered in one person's inbox.

Not to be confused with

• HIPAA-compliant messaging. This covers secure text or chat, including written messages and voice notes between staff or with patients. Those messages are held in a messaging platform, not in a phone system's mailbox.
• Internal staff voice notes. In a staff chat app, a voice note goes to colleagues, not to a patient-facing mailbox. For example, in Chanty, voice notes are covered by the BAA on Business and Enterprise plans, and there is no BAA on Free. This is internal staff communication. It is not voicemail or a phone system. See how Chanty handles HIPAA and the BAA.

What the rules say

• No legal definition. No statute or HHS rule defines "HIPAA-compliant voicemail." It is industry shorthand.
• Recordings can be PHI. A voice recording that identifies a patient and relates to their health or care is protected health information (PHI). When it is stored electronically, it is ePHI.
• Technical safeguards apply. Under the HIPAA Security Rule, the technical safeguards apply to stored voicemail. These include access control, audit controls, integrity and transmission security. Some are "addressable" rather than "required," which means the practice assesses whether they are reasonable and documents its decision.
• Storage vendors need a BAA. A vendor that stores voicemail containing PHI is generally a business associate and needs a business associate agreement (BAA). The narrow "conduit" exception covers transmission only, not ongoing storage.
• Leaving messages is permitted. Practices may leave messages for patients if they use reasonable safeguards and limit the content to the minimum necessary information.

Related reading

• Business associate agreement (BAA): what a BAA with a voicemail or phone vendor should cover before any recordings are stored.
• Protected health information (PHI): how to tell whether a given voicemail or transcript counts as PHI.
• HIPAA-compliant messaging: how the same safeguards apply when staff use text, chat or voice notes instead of a mailbox.