Legal & compliance
How to Leave a HIPAA Compliant Voicemail
Key takeaways
- What ringless voicemail is: A non-intrusive messaging method that delivers a prerecorded message directly to a recipient’s voicemail inbox without ringing their phone, allowing them to listen at their convenience. Covered entities often use it for appointment reminders, prescription refill notices, and telehealth follow-ups.
- Top 3 HIPAA-compliant voicemail best practices: Avoid leaving protected health information (PHI) or sensitive medical details in voicemail messages, and follow the minimum necessary standard by sharing only what the call requires. Always include a callback number so patients can securely return the call for additional information. Use clear, professional voicemail scripts (and a privacy-friendly voicemail greeting) that protect patient privacy while improving communication.
- Compliance reminder: Healthcare providers and vendors handling patient communications must follow HIPAA regulations, including the HIPAA Security Rule, safeguard patient information, and obtain a Business Associate Agreement (BAA) when required.
- Next steps: Review sample HIPAA-compliant voicemail scripts, evaluate your current patient communication process, schedule regular staff training, and explore secure voicemail delivery solutions, such as a HIPAA-compliant voicemail system with encryption and audit logs, that help support compliance and patient engagement.
First Things First: What is Protected Health Information?
You may hear the phrase “protected health information” a lot as you seek out the best ways to handle HIPAA compliance. So the first thing we have to do is define exactly what it means.
Also known as PHI, protected health information tends to fit the following definitions:
- Information containing identifiable data that might connect the health status of an individual to their name
- Information that would be included in medical records such as diagnoses, treatments, medical test results, and prescriptions are all considered PHI. When this information is stored or transmitted electronically, such as in an EHR, an email, or a recorded voicemail, it’s called electronic protected health information (ePHI)
- Demographic information, such as the birth date, gender, or ethnicity of the individual that might serve to identify them
- Patient information protected by HIPAA that has not received the express written permission to be shared from the patient in question. In some cases, a duly signed waiver may allow a doctor to reveal information to third parties, such as lawyers
What Does HIPAA Compliance Mean?
Next, we have to ask what HIPAA compliance means. HIPAA refers to the Health Insurance Portability and Accountability Act. This is legislation that regulates the way healthcare professionals and healthcare organizations communicate and disseminate information. It applies to covered entities (healthcare providers, health plans, and healthcare clearinghouses) and their business associates, and it’s enforced by the U.S. Department of Health and Human Services (HHS). With this federal law, privacy is guaranteed to anyone who wants to keep it. That applies whether you’re using VoIP, text messages, fax, or simply using the phone system of your medical practice.
In the bullet points above, we explored what not to say. You’re not supposed to give out any identifying information that links a patient with their medical history. But what does it specifically mean when we talk about HIPAA compliance via voicemail? It comes down to two things: what you say in the message, and how the system that stores it protects ePHI. HHS allows providers to leave messages on a patient’s answering machine as long as they follow the minimum necessary standard. Meanwhile, the HIPAA Security Rule requires technical safeguards for any system that stores voicemails. These include access controls (such as unique user identification, automatic log-off, and emergency access procedures), audit controls that create audit trails of who accessed each message, and encryption.
Are Slybroadcast Voice Messages HIPAA Compliant?
Simply put, yes!
Slybroadcast is a HIPAA Compliant Ringless Voicemail Service giving you the security and safeguards you need when dealing with patients. When comparing any HIPAA-compliant voicemail system, look for encryption in transit (such as TLS) and at rest, or end-to-end encryption where available, along with detailed audit logs and a signed BAA. If you are looking for more information around HIPAA voicemails, you can visit this link.
What Information Should Not Be Left on an Answering Machine?
When leaving a voicemail message on voicemail systems, healthcare professionals typically stick to the basics: who’s calling, and how to call them back. The reason they do this is to avoid the potential for anyone else intercepting the information and to maintain patient privacy. It would then make that healthcare professional liable for the HIPAA violation. Disclosures like this are among the most preventable data breaches in healthcare.
What can be said on a HIPAA-compliant voicemail message? All sensitive information/medical information should be left out. Instead, the person receiving the message should get a call-back number so that any identifying medical information can be given to them directly upon call-back. For example, appointment reminders can include the patient’s first name, the practice name, and a callback number, but never the reason for the visit. The same applies to other forms of communication—such as SMS—which can easily be used by someone who is not the intended recipient.
Smart phones have introduced some complications into the world of voicemail systems. But the more you read up on HIPAA regulations, HIPAA privacy rules, and what not to say, the more you’ll find that it’s easy to know how to manage medical information. It should be kept 100% private, leaving nothing to chance. That’s why ongoing staff training matters: everyone who leaves or retrieves messages should know what counts as PHI. Your own voicemail greeting can help too, by asking callers to leave only their name and number. Knowing that the forms of communication you use can impact the way you reveal confidential medical information is integral to understanding the best way to go about it.
Do you have questions or require a business associate agreement (BAA)? Email us at support@slybroadcast.com.
