A medical office phone system is not an IT purchase. It is a compliance decision that happens to ring. Pick the wrong system and you inherit HIPAA violations, TCPA exposure, and state consent-law problems that your practice carries for years.
This is written for the practice manager at a 3 to 15 provider practice or a multi-specialty clinic. It covers the compliance foundation, the intake workflow, and the five things vendors hedge on when you ask.
The Compliance Foundation
Four things sit underneath every other decision. Get these right and the rest of the system is negotiable. Get these wrong and nothing else saves you.
HIPAA Requires Safeguards On PHI Handling
Protected Health Information includes anything that identifies a patient tied to a medical condition, appointment, insurance detail, or treatment. The moment your staff says "Mrs. Gonzalez, we have your lab results" on the phone, you are handling PHI. HIPAA requires administrative, physical, and technical safeguards on every system that touches that conversation.
A phone system in a medical practice is, by definition, a PHI-handling system.
Recording Calls That Discuss PHI Requires A Signed BAA
The moment a call that contains PHI is recorded and stored by a vendor, that vendor is a Business Associate under HIPAA. They need a signed Business Associate Agreement with you. No BAA, no recording. If your current vendor will not sign one, you either stop recording or switch vendors.
Most mainstream VoIP providers will sign a BAA, but only at their enterprise tier. That is a pricing trick, not a compliance rule. HIPAA does not require enterprise pricing. A BAA is a standard document. A vendor that refuses to sign one at a normal seat price is telling you something about their priorities.
State Consent Laws Vary
Federal wiretap law requires one-party consent. That is the floor. States can require more.
New York is one-party. You can record calls if the practice is party to the call and has disclosed the recording.
California, Florida, Illinois, Pennsylvania, Washington, and several others are two-party (technically all-party). Every participant has to acknowledge the recording.
If your practice has any patient population in a two-party state, your recording system has to prompt for consent before the conversation starts. Not after. Not once per patient. On every call.
HIPAA Recording Retention Is Typically Six Years
HIPAA requires retention of documents related to compliance, disclosures, and certain communications for six years. Recorded patient calls generally fall under this window. Many state medical boards require similar or longer retention for specific categories.
Your phone system needs to store recordings for at least six years, accessibly, with the ability to produce them if subpoenaed or audited. Most consumer-grade VoIP systems cap retention at 30 or 90 days unless you pay more.
The Intake Workflow Reality
Medical office calls are long and heavy with context. A new patient call is rarely under eight minutes. It covers demographics, insurance, reason for visit, referring provider, preferred provider, preferred appointment window, special accommodations, and often a verbal history the staff has to transcribe into the EMR.
Referrals come through the phone. Specialty practices get most of their new patients via a referring physician's office calling in. Those calls have to be captured, not missed.
Insurance verification happens live. Staff call the insurer, stay on hold, and verify coverage before the patient arrives. Those calls are long and blocking.
Reminder SMS saves revenue. A 10% no-show rate becomes a 3% no-show rate when reminders are on. But SMS to a patient about an appointment is a Protected Communication under both HIPAA and TCPA. Opt-in handling matters.
After-hours calls need pager-style escalation. An on-call provider has to be reachable for emergencies. The answering service model is expensive and slow. A proper phone system can handle on-call rotation natively.
The Five Problems Vendors Hedge On
1. BAA At Normal Pricing
Ask every vendor if they will sign a BAA at the seat price they quoted you. Not at an enterprise tier. Not at a negotiated corporate rate. At the quote you were just given. Watch the sales rep's face. If they say they have to "check with legal" or "bump you up a tier," that is a no.
2. Recording Consent In The Greeting
The consent prompt has to be in the greeting, and it has to be configurable. Different lines may need different prompts. Your main line might say "This call may be recorded for quality and compliance." Your billing line might need an explicit acknowledgment in a two-party state.
If the system only lets you set one prompt for the whole account, it is not flexible enough for a multi-specialty practice.
3. Staff Handoff Mid-Call
Intake staff transfer calls to billing. Billing transfers to the clinical team. Every transfer loses context unless the system surfaces the patient record to whoever picks up next. Most systems do not. The caller has to re-explain who they are three times.
4. Reminder SMS And TCPA
A reminder SMS is a Protected Communication under TCPA. If the patient has not opted in, and you texted them anyway, you have a potential violation. Fines run $500 to $1,500 per text.
Opt-in handling has to be automated. The system should track opt-in status per patient, surface it in the record, and refuse to send if consent was revoked.
5. Multilingual Intake
Most urban practices take intake in at least two languages. Spanish is near-universal. Mandarin, Russian, Korean, Arabic, Haitian Creole, and others depend on the neighborhood. A phone tree with English-only prompts is a friction point that costs the practice patients. Ask vendors how they handle language routing.
What To Look For In A Vendor
A Provider Who Signs BAAs By Default
Not as an upsell. Not as a custom contract. As part of onboarding for anyone who asks.
Configurable Recording Consent Prompts Per Line
Set different prompts for your main line, billing line, clinical line, after-hours line, and specialty-specific lines. Configure the prompt to match the state consent law where that line's callers live.
Call Recording Retention Configurable By State Rule
Six years minimum for HIPAA. Longer for specific state requirements. Your compliance officer should be able to set the window and have it enforced automatically.
AI Summaries That Do Not Leak PHI To Third-Party LLMs
This is where most vendors have a problem they do not advertise. Ask specifically.
- Is the raw audio sent to OpenAI, Google, Anthropic, or another third-party model provider?
- Where does transcription run? Is it on the vendor's own servers or in a third-party cloud?
- What exactly goes into the prompt that generates the summary?
- Is the third-party data handling agreement covered by the BAA, or is it a separate vendor the practice would need its own BAA with?
A lot of vendors quietly pipe patient call audio to OpenAI or Google Cloud Speech. Those relationships may or may not be covered by appropriate BAAs. A vendor that cannot answer these questions clearly is a vendor you do not trust with PHI.
HIPAA-Compliant SMS With Opt-In Handling
Opt-in tracked per patient. STOP and HELP keywords handled automatically. 10DLC registration handled by the vendor. PHI not included in the SMS body. An appointment reminder can say "Your appointment is tomorrow at 10am." It cannot say "Your appointment with Dr. Goldstein for your diabetes follow-up is tomorrow."
Multi-Line Hunt Groups For Doctor-On-Call Rotation
After-hours routing should rotate through an on-call list. Provider 1 Monday, Provider 2 Tuesday, and so on. Configurable by the practice manager, not by a support ticket.
A HIPAA Compliance Checklist For Vendor Calls
When you demo a vendor, ask every one of these out loud. Record the answers. Compare.
- Do you sign a HIPAA BAA? At what price?
- Can I set different recording consent prompts per line?
- What is the maximum retention window for call recordings?
- Where are recordings stored? AWS, Google Cloud, your own datacenter? Which region?
- Does your AI transcription run in-house or on a third-party service?
- What exactly is sent to a third-party LLM when an AI summary is generated?
- Do you handle 10DLC registration for SMS?
- How do you handle opt-in and opt-out for SMS reminders?
- Can the greeting on a specific line be localized to a language?
- What does your breach notification process look like? Have you had a breach in the last 24 months?
On AI Transcription Privacy
This section is worth pausing on because it is where the industry has gotten sloppy.
A lot of VoIP providers added "AI call summaries" in the last two years. For most of them, the architecture is the same. The audio is uploaded to OpenAI Whisper or Google Cloud Speech for transcription. Then the transcript is sent to GPT-4 or Gemini for summarization. Then the result is stored back in the VoIP platform.
This means patient call audio, containing PHI, has been processed by at least one third-party LLM provider. Those providers have data handling agreements. Some of them will sign a BAA. Some of them will not. Some of them sign one but only under enterprise contracts that the VoIP vendor is not paying for.
The practice manager rarely knows any of this. The sales rep does not bring it up. The BAA the vendor signed with the practice does not cover downstream processors unless it is specifically negotiated.
The safe architecture looks different. Transcription runs on the vendor's own GPUs, inside the vendor's own environment, covered by the vendor's own BAA.
Only a short written summary is ever sent to a third-party model, and only with narrow prompts that do not leak patient identity or detail. If the vendor cannot draw you that architecture diagram, do not record on their system.
What Not To Pay For
An "AI receptionist" that tries to book appointments autonomously. Medical intake is too specific. Insurance verification, new-patient history, chief complaint routing. Humans handle these well. AI scheduling for medical practices remains a sales deck, not a working product.
A call-center-grade contact center suite. You are a practice, not a 400-seat BPO. Hunt groups and after-hours rotation are enough.
Video telehealth bundled into the phone system. You already have a telehealth vendor that is integrated with your EMR and credentialed for billing. Do not replicate that inside your phone bill.
How Vocatech Handles This
We serve a lot of medical practices. Here is the short version of how the compliance posture works.
HIPAA BAA signed at our standard price. $29.95 per seat includes the BAA. No enterprise tier required.
AI transcription on our own GPUs. The raw audio from your patient calls never touches OpenAI, Google, or any third-party speech model. We run the transcription inside our own stack, on hardware we own.
Summaries go through OpenAI GPT-4o-mini with narrow prompts. We want to be specific about this. The short written summary, after transcription is complete, is passed through GPT-4o-mini with a minimal prompt that focuses on action items and topics.
It does not send the full transcript or patient identity wholesale. This is the tradeoff we chose because GPT-4o-mini produces better summaries than anything we could run on in-house hardware at reasonable cost, and the narrow prompt keeps PHI exposure minimal. We are honest about this rather than claiming a fully air-gapped architecture we do not actually have.
Configurable retention per line. Six years default for HIPAA. Adjustable up. Dual-channel SIP recording stored in Google Cloud Storage under our BAA. Accessible through a web portal.
Recording consent prompts configurable per line. Different greetings for different lines. Two-party-state prompts where you need them.
Textdock for HIPAA-compliant SMS. Opt-in and opt-out handled. STOP and HELP keywords wired. 10DLC registration handled by us. SMS body does not include PHI by default.
On-call rotation in the hunt group configuration. Practice manager can update the rotation through the admin portal. No tickets.
Pricing And The Switch
$29.95 per seat, flat. Everything above is included. Month-to-month. Free port-in. Free trial through the end of the month. No tier, no add-ons, no enterprise negotiation.
We have been running on Cisco BroadWorks in Brooklyn since 2008. Over a thousand customers. 97% retention. Medical practices are one of our largest segments, and the compliance posture reflects what those customers have asked for over the years.
Start a trial at vocatech.com/contact or see the medical solution detail at vocatech.com/solutions/medical.