HIPAA compliant phone systems

Calls, voicemail and fax. Voicemail transcription and text messaging are frequently outside scope even when calling is covered.

Voice is generally the safest thing a phone vendor will cover, and texting is generally the most exposed. Several providers in this category cover calling while placing text messaging outside the agreement entirely, on the grounds that messages travel across carrier networks they do not control. That is backwards from how a front desk actually works, because texting is what patients prefer and what staff reach for the moment a call goes unanswered.

Around the edges sit voicemail transcription, call recording, AI receptionists and automated call summaries. Each one turns a spoken symptom into a stored, searchable, machine-processed record. Add the consumer version of the same brand, which staff already have on their personal phones and which is usually outside any agreement, and a single conversation has three separate routes to somewhere you did not intend.

Can be used with patient information

Each of these requires a signed agreement and, usually, specific settings. Open an entry for the exact conditions.

Google Voice

Conditional

Yes, if you use Google Voice inside a paid Google Workspace account with licenses assigned to the staff who handle patient information, and your administrator accepts Google's amendment first — the free consumer version cannot be used with patient information.

OpenPhone (now Quo)

Conditional

Yes for calls if you are on the Business or Scale plan and sign the agreement — but text messaging is explicitly excluded from it, so anything you text a patient sits outside the agreement entirely.

RingCentral

Conditional

Yes, if you are a paying customer, ask RingCentral for their business associate agreement and sign it, and keep patient information within the specific services that agreement names.

What to check before you adopt one

Ask directly whether SMS and MMS sit inside the agreement or are excluded from it, and take the answer from support documentation rather than a sales page.
Check whether voicemail transcription, call recording and automated call summaries are covered, and how long each of those recordings is kept by default.
Confirm that AI receptionist and agent-assist features are named as covered services rather than assumed to inherit coverage from the phone system around them.
Verify that staff are using the business account under your agreement, not the free consumer app of the same brand on a personal number.
Ask how quickly the system logs an idle user out on a mobile device, because some default timeouts run to days rather than minutes.

The expensive mistake

Texting patients appointment details on a system where calling is covered but messaging is not. The app makes texting a one-tap action from the same screen as the call, so nobody notices the boundary. If your vendor excludes messaging, either switch texting off for patient contact or build a documented consent and minimum-necessary process around it first.

Tracking which of these your organization uses?

The vendor and BAA register keeps every tool that touches patient information, its agreement status and its renewal date in one place — seeded from this research. See pricing.

Information, not certification and not legal advice. Each entry reflects that vendor’s published documentation as read on the date shown on its page. Vendors change terms without notice — confirm anything you rely on directly with them.