HIPAA for Healthcare Calls: What Your Phone Team Needs to Know

What HIPAA is

HIPAA is the Health Insurance Portability and Accountability Act, a federal law. Its rules protect people’s health information and give patients rights over that information. The Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services enforces it.

For a contact center, three parts of HIPAA matter most:

• The Privacy Rule covers who can see or hear health information, and when.
• The Security Rule covers how electronic health information is protected, including recordings and computer systems.
• The Breach Notification Rule covers what you must do if information gets out.

Who has to follow it

HIPAA applies to two groups.

Covered entities. These are healthcare providers such as doctors, dentists, hospitals, clinics, and pharmacies. Health plans and healthcare clearinghouses are also covered entities.

Business associates. These are outside companies that handle health information on behalf of a covered entity. This group includes:

• Answering services and outsourced call centers
• Scheduling and appointment reminder companies
• Medical billing and collections companies
• Phone system, cloud contact center, and call recording vendors that store patient calls
• AI transcription, chatbot, and call summary tools that process patient conversations

A business associate is directly responsible for following HIPAA, not just its client. If you run a call center that serves healthcare clients, HIPAA applies to you.

What counts as protected health information

Protected health information (PHI) is any health-related information that can be linked to a specific person. On a phone call, that includes more than people expect:

• Names, addresses, phone numbers, and dates of birth when they’re tied to care or payment
• Appointment dates and the reason for a visit
• Test results, diagnoses, prescriptions, and treatment
• Insurance and billing details
• Call recordings, transcripts, and agent notes about any of the above

Even the fact that someone is a patient at a particular clinic can be PHI.

Rule 1: Verify the caller first

Before you discuss any PHI, confirm that you’re speaking with the patient or with someone allowed to receive the information.

• Ask for at least two identifiers, such as full name and date of birth, or name and address.
• Ask the caller to give you the information. Don’t read it out and ask them to confirm it.
• If the caller can’t verify, offer general help only, or arrange a callback to the number on file.
• Write down how the caller was verified.

Family members and caregivers. HIPAA allows you to share relevant information with family members or others involved in a patient’s care. The patient must agree, or at least not object. When the patient can’t respond, staff may use professional judgment. Check the patient’s file for a list of approved contacts or a personal representative, such as a parent of a minor or someone holding a healthcare power of attorney. When in doubt, don’t share.

Rule 2: Share only what’s needed

HIPAA’s minimum necessary standard means agents should use and share only the information needed for the task. A scheduler doesn’t need to see a full medical history, and a billing agent doesn’t need test results.

Set up your systems so each role sees only what it needs. Train agents not to read more of the record aloud than the caller asked about.

Rule 3: Be careful with voicemails

Leaving messages is allowed. Keep them short and general:

“This is a message for Maria from Riverside Clinic. Please call us back at 555-0100. Thank you.”

Avoid test results, diagnoses, medication names, and the type of appointment. A specialty clinic’s name can reveal something on its own, so some practices use a general name in voicemails. Follow any request the patient has made about how to contact them. Patients have the right to ask for confidential communications, such as “only call my cell phone.”

Rule 4: Watch what others can hear

HIPAA accepts that some incidental disclosures happen, such as someone nearby overhearing part of a call, as long as you take reasonable precautions. Reasonable precautions include:

• Spacing agents apart or using headsets with noise-canceling microphones
• Speaking at a normal, low volume
• Locking screens when stepping away
• Applying the same care for remote agents. Calls should be taken in a private space, not a coffee shop, and with smart speakers turned off nearby.

Rule 5: Secure recordings, transcripts, and notes

If you record healthcare calls, the recordings are PHI. So are transcripts, AI-generated summaries, and screen recordings. Under the Security Rule you must:

• Control who can access them, with individual logins and no shared accounts
• Keep logs of who accessed what
• Encrypt them when stored and when sent
• Set retention periods and delete files on schedule
• Include them in your regular risk analysis

Remember the other rules covered on this site. Call recording consent laws still apply, and if you take card payments, PCI rules apply too. See our guides on call recording consent and taking payments by phone.

Rule 6: Get a Business Associate Agreement from every vendor

A Business Associate Agreement (BAA) is a contract in which a vendor promises to protect PHI and follow HIPAA. A healthcare organization must have a signed BAA with every business associate before sharing any PHI with it. Business associates must also have BAAs with their own subcontractors that handle PHI.

Contact center vendors that often need a BAA:

• Cloud phone or contact center platform
• Call recording and quality management tools
• CRM or ticketing system
• AI voice agents, chatbots, transcription, and call summary tools
• Texting and appointment reminder services
• Email providers used to send patient information
• Outsourced or overflow call centers

A common mistake is turning on a new AI feature, like call summaries or a chatbot, without checking whether the vendor will sign a BAA for that feature. Some vendors cover only certain products or plan levels. Get it in writing before patient information goes in.

Patients’ rights you may handle by phone

Patients may call to use their HIPAA rights. Agents should know how to route these requests:

• Access: getting a copy of their records, which generally must be provided within 30 days
• Amendment: asking to correct their records
• Confidential communications: asking to be contacted a certain way
• Accounting of disclosures: asking who their information was shared with
• Complaints: filing a privacy complaint

Have a clear process and a named privacy contact for each request.

If something goes wrong

A breach is when PHI is accessed or disclosed in a way HIPAA doesn’t allow. Examples include sending results to the wrong patient, a lost laptop, or a hacked recording system.

• Report suspected breaches inside your organization right away.
• Covered entities must notify affected individuals without unreasonable delay, and no later than 60 days after discovering the breach. Larger breaches also require notice to HHS and sometimes to the media.
• Business associates must notify their healthcare client.

Penalties are tiered by how careless the organization was. They range from modest fines for honest mistakes to large fines and possible criminal charges for willful neglect or intentional misuse. Many state laws add their own requirements, and some are stricter than HIPAA.

Changes on the horizon

In January 2025, HHS proposed a major update to the HIPAA Security Rule. It would require multi-factor login, encryption, annual testing, and written incident response plans, among other changes. As of mid-2026, the final rule was expected no earlier than July 2027.

Many of these steps are already considered good practice, so starting now puts you ahead. Check HHS.gov for the latest status.

A simple starting checklist

1. List every phone, recording, CRM, AI, and texting tool that touches patient information.
2. Confirm that you have a signed BAA for each one.
3. Write a caller verification script and train every agent on it.
4. Set voicemail rules and a sample script.
5. Limit system access by role.
6. Set retention periods for recordings and transcripts.
7. Complete or update your risk analysis.
8. Train staff when they’re hired and every year after, and keep records of the training.
9. Name a privacy and security contact, and set up a breach reporting process.

Questions to ask vendors

• Will you sign a Business Associate Agreement, and which products and features does it cover?
• Is call data encrypted when stored and when sent?
• Can we limit access by role and see access logs?
• Where is our data stored, and how long do you keep it?
• Do your AI features use our patient data to train models?
• How and when will you notify us of a breach?

This guide is general information, not legal advice. HIPAA requirements depend on your role and your situation, and state laws may add more. For specific questions, consult a healthcare privacy attorney or your compliance officer.