The moment a patient says why they're calling, your phone line is handling protected health information. Most offices have never examined what that means — for voicemail, for the answering service, or for anything with AI in the name.
Is call recording allowed under HIPAA? Yes. HIPAA does not ban recording patient phone calls. But a recording that captures a patient's identity and health details is protected health information (PHI), so it has to be secured, limited to the people who need it, and covered by a Business Associate Agreement with any vendor that records or stores it. Whether the caller has to consent is a separate question answered by state law, and in all-party consent states such as Massachusetts, a clear "this call may be recorded" notice at the start of the call is how practices typically handle it.
In practice, three things should be true of any system that answers your practice's phone:
Most practices have never checked all three.
The front-desk phone is usually the least-examined system in a medical or dental office. The charts live in a records system with logins and audit trails. The imaging is locked down. The email has been through at least one security conversation. And then there's the phone, which takes in more raw patient information on a given Tuesday than anything else in the building, and which nobody has looked at since it was installed.
This isn't negligence. A phone just doesn't feel like a database.
Protected health information isn't confined to charts. It's any health information tied to an identifiable person. So the moment a caller says "this is David Alvarez, I cracked a molar and I'm in a lot of pain, can someone see me today," you are holding PHI. It doesn't matter that it arrived as sound rather than a form.
That has a practical consequence. Anything that captures, stores, or passes along that call (a voicemail box, an answering service operator, a transcription tool, an AI receptionist) is handling PHI on your behalf. Under HIPAA, that generally makes them a business associate, not just a vendor. The format doesn't grant an exemption: a voicemail with a patient's name and symptoms contains PHI, and so does the transcript that gets emailed to the front desk.
HIPAA doesn't mention call recording by name. Neither the Privacy Rule nor the Security Rule bans recording a phone call, and neither requires it. What they do is govern protected health information no matter what form it takes. A recording of a patient describing their symptoms is PHI in audio form, and once it is stored digitally, it is electronic PHI.
That brings a recording under the same expectations as the rest of your patient data:
Two more points are easy to miss. First, patients have a right to access much of the health information a practice keeps about them, and depending on how your office uses recordings, a request could reach them. Ask your counsel how your recordings should be classified. Second, a recording that ends up somewhere it shouldn't, such as a lost laptop or a forwarded email, can raise the same breach questions as a misplaced chart.
A Business Associate Agreement is the contract that says a vendor understands it's handling PHI, will protect it, will limit who can see it, and will tell you if something goes wrong. It is the single clearest test of whether a phone vendor has actually thought about healthcare, or is simply selling you a general-purpose product that happens to have clinics as customers.
This is where a lot of setups quietly fail. Many traditional answering services are built to handle plumbers, law firms, and dental offices with the same operators and the same software. Many mainstream voicemail-to-text and call-transcription tools are consumer or general-business products. Some will sign a BAA. Plenty won't, or have never been asked.
It also helps to know that the obligation travels. A business associate is expected to have its own agreements with the subcontractors that touch your patients' data, such as its cloud host or transcription provider. And it applies even when nothing about your phone number changes. If you keep your number and forward calls to an AI receptionist, the moment those calls reach the vendor, the vendor is handling PHI.
The uncomfortable version of the question: if a patient's recorded description of their symptoms is sitting in a vendor's system right now, do you have a signed agreement covering it? If you don't know, that's the finding.
People often collapse "is this allowed under HIPAA" and "can I record this call" into one issue. They're different. HIPAA governs how health information is protected. Whether you may record a conversation in the first place is governed by wiretap and eavesdropping laws, and those vary by state.
There are two broad models:
Massachusetts is generally treated as an all-party consent state. Its wiretap statute (Massachusetts General Laws chapter 272, section 99) is known for prohibiting secret recording, so a practice recording calls in Massachusetts should make sure callers are told clearly and early. That's why you hear "this call may be recorded" at the start of so many calls. It's how notice is given before anything sensitive is said. In many places, a caller who continues after a clear notice is commonly treated as having consented, but how that applies to your office is a question for your attorney.
New England is not uniform. The neighboring states don't all follow the same rule as Massachusetts, and a practice with offices in more than one state shouldn't assume the rules match. Patients also travel and move: your caller may be in a different state than your office, and when a call crosses state lines, it isn't always obvious which state's rule applies. Many organizations simply give the same clear notice on every call. For certainty about your own state, confirm it with counsel.
One more practical point: the notice only works if the caller understands it. If a meaningful share of your callers speak Spanish, it's worth thinking about how the greeting and recording notice reach them too. We cover that in our guide to bilingual English and Spanish phone reception.
There's a newer question layered on top: if the voice answering the phone isn't human, should the caller be told?
Our position is that they should, plainly, at the start, in the first breath of the call. Not because it's clever, but because a patient deciding whether to describe a health problem deserves to know who or what they're describing it to. It's also the direction regulation has been moving. An AI receptionist that lets a patient believe they're talking to a person at the front desk is solving the practice's problem by creating the patient's.
Is AI reception riskier than a human answering service? Not inherently. A purpose-built clinical system with a BAA, disclosure, controlled access, and logging can be easier to defend than an unexamined general-purpose service. The design and the paperwork are the variable, not the technology.
A call handled carefully and then dumped into an unprotected inbox isn't handled carefully. The tail end of the process deserves the same scrutiny:
A voicemail box has no concept of access control, and a message pad on the counter has no audit log.
You don't need a consultant to find the obvious gaps. Five questions:
If several of those produce a shrug, that's not unusual. It's the normal state of a phone system nobody has revisited. And "our answering service has been fine for years" isn't evidence either way: the absence of a known incident isn't the same as having the agreement, the disclosure, and the access controls in place if something does go wrong.
Once you know where the gaps are, this is the list an office manager can work through. It applies whether you run a dental practice in Boston, a medical office, or a physical therapy clinic.
Catchsera is built with HIPAA safeguards, and we sign a Business Associate Agreement with every practice. At the top of each call, the agent identifies itself as an AI assistant for your practice and notes that the call may be recorded. It's the first thing it does.
After the call, the summary and full transcript appear on your practice's live dashboard rather than in a shared inbox. The platform runs on Microsoft Azure, data is encrypted, sign-in uses two-factor authentication, each person gets the right level of access, and every action is recorded in an audit trail. When a caller needs to share sensitive details, Catchsera can text them a secure intake form with your practice's logo, so those details don't have to be spoken over the phone at all. It answers in English and Spanish.
This article is general information, not legal advice. It comes from a vendor that builds phone reception for clinics, and we are not your attorneys. Recording law and HIPAA obligations depend on your state, your specific setup, and facts we don't have. Use this to ask better questions, then confirm your obligations with qualified counsel.
Yes. HIPAA does not prohibit recording patient calls. A recording that contains a patient's identity and health information is PHI, so it must be protected with safeguards, access limits, and a BAA with any vendor that stores it.
If the recording ties health information to an identifiable person, such as a name and a reason for the visit, it is protected health information. Once it's stored digitally, it's electronic PHI and falls under the HIPAA Security Rule.
That depends on state law, not HIPAA. One-party consent states allow recording when one participant agrees. All-party consent states, such as Massachusetts, require everyone on the call to consent, which is why a clear recording notice at the start of the call matters.
Massachusetts is generally treated as an all-party (two-party) consent state, and its wiretap law prohibits secret recording. Practices there typically tell every caller at the start that the call may be recorded. Confirm the details for your office with your attorney.
HIPAA does not set a specific retention period for call recordings. Retention generally depends on state record-keeping rules, payer contracts, and your own written policy. Choose a period with your counsel, document it, and delete recordings on schedule.
Generally, yes. If a vendor can hear, store, transcribe, or transmit protected health information on your behalf, HIPAA treats it as a business associate, and a signed Business Associate Agreement is expected. Ask before assuming, because many general-purpose phone tools are not set up to sign one.
Catchsera answers every call for your practice with a setup built with HIPAA safeguards, a BAA on every account, clear AI and recording disclosure, and a live dashboard where your team — and only your team — sees what came in.
Get a free demo →
