HIPAA Compliant Phone ServiceVoIP Options for Practices

A VoIP phone service fits HIPAA only when the vendor signs a Business Associate Agreement (BAA) and the practice sets it up with the right safeguards. No phone service is HIPAA compliant on its own. We read guidance from HHS and the HIPAA pages of RingCentral, Nextiva, Zoom and Google on October 13, 2026. This guide covers what HHS says, which vendors offer a BAA, and what to check before patients call.

HIPAA phone service at a glance

• HHS says the HIPAA Security Rule does not apply to audio-only calls over a traditional landline.
• HHS lists VoIP technologies as electronic communication technologies, so the Security Rule applies to them.
• HHS says a covered entity "must enter into a BAA with a vendor that is more than a mere conduit for PHI."
• RingCentral, Nextiva, Zoom and Google each state on their own pages that they sign BAAs.
• The practice stays responsible for settings such as voicemail, recording and user access.

Are phone calls HIPAA compliant?

Phone calls can be HIPAA compliant, but the rules depend on the line. HHS published guidance on audio-only telehealth on June 10, 2022. It states: "The HIPAA Security Rule does not apply to audio-only telehealth services provided by a covered entity" over a standard landline, because the information is not electronic.

VoIP is different. HHS notes that landlines are being replaced with "electronic communication technologies such as Voice over Internet Protocol (VoIP)." HHS also says: "Covered entities using telephone systems that transmit ePHI need to apply the HIPAA Security Rule safeguards." Most modern practice phone systems are VoIP, so the Security Rule applies to most practices.

When does a phone vendor need a BAA?

A phone vendor needs a BAA when it does more than carry the call. HHS uses the term "conduit" for a vendor that transports information but does not access it "other than on a random or infrequent basis." HHS states: "a covered entity must enter into a BAA with a vendor that is more than a mere conduit for PHI."

HHS gives examples of technologies that go beyond a simple call:

• Communication apps on a smartphone or another computing device.
• VoIP technologies.
• "Technologies that electronically record or transcribe a telehealth session."
• "Messaging services that electronically store audio messages."

A practice phone system stores voicemail, call logs and often recordings. That makes the vendor more than a conduit. A practice should treat a BAA as required for any VoIP service.

Which VoIP providers sign a BAA?

We checked each vendor's own page on October 13, 2026. Vendors change plans and terms, so confirm the BAA in writing before you sign up.

For more on Google's setup, read our Google Voice guide.

What settings should a practice check?

A BAA covers the vendor. The settings cover the practice. RingCentral's HIPAA document states: "Customers that are subject to HIPAA regulations are ultimately responsible for complying with its requirements." Nextiva takes a different approach and turns off risky features on HIPAA accounts. Either way, check these items.

1. 1

   Sign the BAA first

   Get the signed BAA before any patient calls go through the system. Keep a copy with your HIPAA records.

2. 2

   Control voicemail delivery

   Turn off voicemail-to-email and voicemail-to-text unless the email system is also covered by a BAA.

3. 3

   Decide on recording and transcription

   HHS lists recording and transcription as electronic. Turn them off, or confirm they are covered and set a retention period.

4. 4

   Lock down user access

   Give each staff member their own login. Remove access the day someone leaves.

5. 5

   Add the system to your risk analysis

   List the phone system, the vendor and the BAA date in your HIPAA risk analysis.

Is a regular cell phone or landline OK?

A landline call is outside the Security Rule. HHS states the Security Rule "does not apply to audio-only telehealth services" on a standard telephone line. The Privacy Rule still applies, so staff must still verify who they speak with and avoid sharing PHI in a waiting room.

A smartphone is different. HHS lists "Communication applications (apps) on a smartphone or another computing device" as electronic. A clinician who calls patients from a personal phone app may create PHI on a device the practice does not control. A business VoIP app under a BAA keeps those calls inside the practice system. For text messages, read our guide on texting patients under HIPAA.

How Webpatch helps

Webpatch manages HIPAA compliance and security for healthcare practices. For phone systems, we:

• Review the vendor's BAA and your plan.
• Check voicemail, recording and user settings against HHS guidance.
• Add the phone system to your risk analysis and vendor list.
• Check that call-tracking scripts on your website do not send PHI to ad platforms.

We are not a law firm. We help practices put the technical safeguards in place. Talk to Webpatch about your phone setup.

This article is for education only. It is not legal advice and has no legal standing. Have a qualified professional review your situation before you act.