Recording patient calls: consent, retention and who may listen

Most business phone systems and call-handling services can record and transcribe calls with one switch. For a dental practice, that switch affects patient privacy and, in some states, criminal law. This post covers what to settle before you record anything: whose consent you need, what HIPAA expects of the vendor that keeps the files, how long to keep them and who may listen.

Consent: know your state and your callers’ states

Recording laws differ by state. Some let you record a call when one person on it agrees. These are often called one-party consent states. Others require everyone on the call to agree. Florida is in the second group. Its statute makes intercepting a communication lawful when all parties have given prior consent, and a violation can be a felony ¹. The rules can also differ by the state a patient calls from. A caller in another state may bring that state’s rules with them. Plan for the strictest rule among the states your callers use.

Before you record or transcribe anything, answer four questions. Write the answers down, because your team will need them the first time a caller objects. Which states do your callers call from? What does the caller hear first, and when? Must the caller agree, or only be told? What happens to the call if a caller says no?

Transcripts and audio each raise their own questions

A transcript of what the caller asked for helps the front desk every morning. A full audio recording holds more: the caller’s voice, background conversations and anything said before they realized the line was live. Both are records of the call. For each one, decide who may read or play it and how long you keep it. Many practices find a transcript is all the front desk needs, and then audio never has to exist. Also check whether the consent rules that apply to you treat a transcript the same as audio.

What HIPAA asks of the vendor that keeps them

A recording or transcript of a patient call is protected health information. A carrier that only connects the call needs no business associate agreement (BAA). A vendor that stores recordings or transcripts does ². Before you switch recording on, make sure the phone system, answering service or voice agent that will hold the files has signed a BAA with your practice.

The breach rules apply to these files. Your practice must notify affected people without unreasonable delay, and no later than 60 calendar days after discovering a breach ³. The fewer recordings you keep, and the shorter you keep them, the less you have to lose. Files you deleted on schedule cannot be part of a breach.

Who may listen

HIPAA’s minimum-necessary standard asks you to limit access to protected health information to what each role needs ⁴. For call recordings, write that as a short access rule:

• Name the roles that may play audio, for example the office manager and the owner-dentist, and the reason they may, such as a complaint or a quality review.
• Keep transcripts available to the front desk for the work they support, such as the morning callback list.
• Keep a log of who opened which recording and when, and review it. Check it every month, so a pattern shows up early.
• Decide whether the vendor’s own staff may ever listen, and get the answer in writing. “Only with our permission, for a named reason” is a good answer. “Sometimes, for quality” is not.

Retention: pick a number and automate it

No federal rule sets one retention period for call recordings, and state record-keeping rules vary. Decide which recordings, if any, become part of a patient’s record. Set a period for the rest and let the system delete them automatically. A number in your policy, enforced by software, is easy to stand behind. “We keep everything” is not. Pick a short period for audio and a longer one for transcripts, and write both down.

Patients also have a right to see their own health information. A practice must act on a request within 30 calendar days, with one 30-day extension ⁵. Decide before a patient asks whether a given recording or transcript falls under that right.

A one-page recording policy

Put these decisions on one page, then sign and date it. Give a copy to every person who answers the phone or opens a recording. It should answer six questions:

1. What is recorded: transcripts, audio, or neither, and on which lines.
2. What the caller hears first, and what happens if they decline.
3. Which vendor stores the files, and where its signed BAA is kept.
4. Which roles may read transcripts and which may play audio, and how access is logged.
5. How long each kind of file is kept, and how deletion happens.
6. Who handles a patient’s request for a recording, and within what time.

A note on outbound calls

Everything above is about calls patients make to you. Calls you place with an automated or AI-generated voice follow different rules. In February 2024 the FCC confirmed that the federal limits on artificial or prerecorded voices cover AI voices too. Those calls need the called person’s prior express consent unless an exemption applies ⁶. Treat automated outbound calling as its own project, with its own consent records and its own opt-out list.

← All posts