Is any VoIP provider 'HIPAA certified'?

No such certification exists for phone service. Compliance is a shared process: a provider who signs a Business Associate Agreement (BAA) plus your correct configuration of features like voicemail, recording and SMS. Beware any vendor marketing 'HIPAA certified' phones.

Do we need a BAA for the phone system if we never discuss patient details on calls?

If PHI could touch the system — voicemails left by patients, caller ID logs, SMS confirmations — treat it as in scope and get the BAA. The cost of a BAA is zero at providers who offer one; the risk of skipping it isn't.

HIPAA-Compliant VoIP for Healthcare

Written by Ivan Elias, Founder & Principal Advisor · Published September 15, 2026

No fee · no obligation

“Is your phone system HIPAA compliant?” is the wrong question — compliance is a configuration and agreement, not a feature badge. Here’s what healthcare practices and their IT teams actually need, in order.

1. A provider who will sign a BAA

A Business Associate Agreement is the legal foundation. Several major providers offer BAAs on request — including Nextiva, RingCentral, Intermedia and 8x8 (see our healthcare ranking). If a provider won’t sign one, they’re out — regardless of feature list.

2. The configuration that makes it compliant

The same platform is compliant or not depending on setup:

Voicemail: PHI lands in voicemail constantly (“calling about my test results”). Require PIN access, encrypted storage, and retention aligned to your policy.
Call recording: disable by default. If recorded (front-desk QA), retention controls and access restrictions apply — and record announcements per your counsel’s guidance.
SMS/texting: appointment reminders with PHI details are a common violation. Use template-based reminders without condition details, via the BAA-covered messaging feature (not staff’s personal phones).
Mobile apps: enforce PIN/biometric lock and remote wipe via MDM so a dropped phone in a parking lot isn’t a breach event.
Auto-attendants and hold messages: review scripts so they don’t disclose patient information to whoever’s in the waiting room.

3. The access and audit layer

Unique logins per staff member (no shared desk passwords), role-based access, and SSO where possible.
Turn on audit logging and actually review it — access logs are the first thing an auditor (or breach investigator) requests.
Annual workforce training: most healthcare phone “breaches” are a staff member texting PHI from a personal phone.

4. The contract details

BAA term must match (or exceed) the service term; renegotiate it at renewal.
Exit plan: recording/voicemail export and certified deletion when you leave.
Sub-processor transparency: which cloud regions store your data.

The practice-size reality check

A 3-provider dental office needs: a BAA, PIN-protected voicemail, SMS reminders without condition details, and staff training — roughly one hour of setup on the right platform. A multi-site medical group adds retention policies, MDM, SSO and audit review — where an advisor-led rollout earns its keep. Either way, competing quotes on BAA-capable platforms typically save more than the compliance setup costs.