BAA signed with every voice vendorUCaaS, CCaaS, transcription, recording vendors all need BAAs.

PHI retention policy for recordingsRetention period matches broader HIPAA policy, not longer.

Voicemail content treated as PHIVMs containing patient info are encrypted and access-controlled.

Encryption at rest on all recording storageAES-256 minimum.

Encryption in transit (SRTP, TLS)All SIP signaling and media flows are encrypted.

Access controls on recordingsRBAC; audit log of who listened to what recording.

Minimum necessary disclosure in IVR promptsIVR does not read back PHI to anyone the caller has not authenticated.

Breach notification path definedEscalation runbook if PHI is accidentally exposed via voice.

Patient authentication before disclosing PHIAgents verify identity before sharing any PHI.

Secure fax / secure messaging for follow-upsIf you still fax, it goes to a secure endpoint.

Workforce training records currentAll voice-touching staff trained on HIPAA annually.

Risk assessment covering voice channelsVoice is explicitly in the HIPAA Security Rule risk assessment.