Every call a patient makes to your organization moves protected health information. The scheduler who pulls up a chart while on the line. The voicemail with a callback number and a prescription question. The video consultation where a clinician reviews test results. None of that is abstract data — it’s ePHI, and your communications infrastructure either protects it or it doesn’t.
HIPAA compliance is not a one-time certification event. It’s an ongoing operational standard, and your phone system, messaging platform, and contact center are all inside its scope. This article covers what the Security Rule actually requires from communications infrastructure, where most healthcare organizations have gaps, and what a compliant deployment realistically looks like.
For a broader view of how communications infrastructure fits into healthcare operations at Mitel, see our healthcare solutions overview. For a deeper look at the compliance and security posture of Mitel platforms, visit our security, compliance, and resiliency page.
What HIPAA Actually Requires From Your Communications System
The Health Insurance Portability and Accountability Act’s Security Rule covers electronic protected health information — ePHI. It applies to any system that creates, receives, maintains, or transmits it. That description covers far more than your EHR.
Phone calls that reference patient records are ePHI in transit. Voicemails containing patient details are ePHI at rest. Video consultations, contact center recordings, automated appointment reminders — all of it is in scope.
The Security Rule organizes requirements into three safeguard categories:
Administrative Safeguards
Govern policies, training, and risk assessments. Technology choices directly affect how achievable they are — a platform with detailed audit logs makes risk assessments measurable.
Physical Safeguards
Cover where hardware and data physically reside. For communications infrastructure, this is primarily a deployment model question: on-premises, private cloud, public cloud or hybrid deployment.
Technical Safeguards
Where communications platforms are most directly tested. Required controls: access controls, audit controls, integrity controls, and transmission security.
Any vendor whose platform touches ePHI must sign a BAA — including your phone system vendor, contact center provider, and telehealth platform. A BAA is not a compliance guarantee; it is a contractual obligation establishing shared responsibility. The controls still need to be there.
Where Most Systems Create Compliance Risk
Legacy phone systems and consumer communication tools share a common problem: they were not designed with ePHI in mind. That creates real exposure in several places.
-
Unencrypted voice transmission
Traditional PBX systems and early VoIP deployments often transmit voice without encryption. A call between a clinician and a patient discussing a diagnosis is ePHI in transit. Without SRTP for voice media and TLS for signaling, that data is readable to anyone on the path.
-
No per-user audit trail
If your system cannot tell you who placed or received a specific call, when, and for how long — with a record that cannot be altered — you cannot satisfy the audit control requirement. Shared lines, generic extension logins, and systems without call logging all create this gap.
-
Consumer video platforms
During the pandemic, many healthcare organizations adopted consumer video tools for clinical use. Without a signed BAA and the specific technical controls HIPAA requires, those platforms are not appropriate for patient consultations involving ePHI. Browser-based clinical video platforms built specifically for healthcare — such as Mitel’s Virtual Care Collaboration Service — provide encrypted video and audio with no patient-side download required, alongside audit logging and scheduling controls.
-
Unsecured messaging
Staff using personal SMS or consumer messaging apps to communicate about patients is one of the most common HIPAA exposure points in healthcare organizations. A communications platform that provides encrypted secure messaging within the same system used for voice gives clinical staff a compliant alternative that’s practical enough to actually use.
-
Contact center recordings without access controls
Call recordings frequently contain ePHI. If those recordings are stored without encryption, or accessible to anyone with access to the server, they represent both a compliance gap and a breach risk. Mitel CX provides role-based access controls and encrypted storage for contact center recordings.
Technical Safeguards: What to Require, Not Just Request
When evaluating a communications platform for HIPAA alignment, the right approach is to assess specific technical controls, not take a vendor’s marketing claims at face value. Here is what to verify:
-
Encryption in transit Voice media should use SRTP. Signaling should use TLS. This applies to every communication channel: voice, video, messaging, and chat. Confirm it is on by default, not an optional configuration.
-
Encryption at rest Voicemails, call recordings, and message archives containing ePHI must be encrypted when stored. Verify the encryption standard (AES-256 is the current benchmark) and confirm who holds the encryption keys.
-
Unique user authentication Every user should have a unique identifier, and the system should enforce role-based access. Automatic session logoff after a defined period of inactivity is a specific HIPAA requirement, not a nice-to-have.
-
Emergency access procedures The Security Rule requires that authorized personnel can access ePHI in an emergency, even when standard access controls cannot be followed. Your communications platform should support a documented break-glass procedure.
-
Audit logging Comprehensive, tamper-evident logs of system access, call activity, and configuration changes are required. These logs need to be retained for a minimum of six years and be readily accessible for compliance review.
-
BAA availability Confirm before selection that your vendor will sign a BAA. Reputable enterprise communications vendors provide this as standard. If a vendor is reluctant or makes it conditional, that is a signal worth taking seriously.
The State of Workforce Communicationin the AI Era
Why closing the gap between IT investment and worker experience is a security and business imperative.
Discover how your workforce measures up
Deployment Model Is a Compliance Decision
Where your communications infrastructure lives determines what compliance controls you can apply and what risks you carry.
On-Premises
Keeps voice infrastructure, call records, and data entirely within your physical environment. For healthcare organizations with strict data governance requirements, this remains the most straightforward path to meeting the physical safeguard requirements of HIPAA. MiVoice Business and the OpenScape platform family support full on-premises deployment.
Private Cloud
Moves infrastructure off your hardware but keeps it within a dedicated, single-tenant environment. You retain governance control over data location and access, with the operational benefits of a managed platform. This is the fastest-growing model for mid-to-large healthcare organizations that need flexibility without giving up data control.
Hybrid Deployment
Combines on-premises survivability with cloud flexibility — keeping clinical communications active even when cloud connectivity is unavailable. In healthcare, communications downtime is not just an operational inconvenience — it is a patient safety issue. Hybrid communications at Mitel are designed for environments where failure is not an acceptable operating state.
Beyond Voice: Video, Messaging, and the Contact Center
A HIPAA-compliant communications strategy covers every channel through which ePHI moves, not just inbound phone calls.
Browser-based telehealth platform requiring no patient-side download, with end-to-end encrypted video, audio, chat, and file transfer — alongside integrated scheduling and BAA availability as standard.
Omnichannel patient access with HIPAA-aligned controls for call recording, routing, and reporting. Role-based access controls and encrypted storage for contact center recordings.
Automated appointment reminders, prescription refill notifications, and billing outreach — removing the need for clinical staff to manually process routine patient communications.
Reliable, encrypted wireless voice for clinical environments without relying on general Wi-Fi infrastructure. Integrated with nurse call and clinical alerting systems.
HIPAA compliance, questions answered.
A HIPAA-compliant phone system is a communications platform that incorporates the technical safeguards required by the HIPAA Security Rule for handling electronic protected health information (ePHI). This includes encrypted voice transmission using SRTP and TLS protocols, unique user authentication with role-based access controls, tamper-evident audit logging of all call activity, encrypted storage of voicemails and call recordings, and automatic session timeouts. The system vendor must also be willing to sign a Business Associate Agreement (BAA), establishing their legal responsibility for the ePHI that passes through their platform.
It is worth noting that HIPAA does not certify or approve specific products. What HIPAA requires is that the controls are in place and documented. Healthcare organizations remain responsible for their own risk assessment and compliance posture, regardless of what their communications vendor provides.
Yes. Any vendor whose platform receives, stores, or transmits electronic protected health information on behalf of a covered entity is considered a Business Associate under HIPAA. That includes phone system vendors, contact center providers, telehealth platforms, voicemail services, and call recording systems.
A BAA establishes the vendor’s obligations to protect ePHI, including reporting requirements in the event of a breach. Without a signed BAA, the covered entity — the hospital or health system — carries the full compliance risk for that vendor relationship. Before selecting any communications platform for clinical use, confirm that the vendor will provide a BAA. A vendor who treats the BAA as a negotiation point rather than a standard commitment is a signal worth investigating further.
VoIP can be HIPAA compliant, but the protocol alone does not make it so. The compliance posture depends on how the VoIP system is configured and what security controls are in place.
A VoIP system that transmits voice using SRTP, secures signaling with TLS, provides role-based access controls, generates audit logs, and encrypts stored voicemails should meet the technical safeguard requirements of HIPAA. The practical test is not whether a system uses VoIP, but whether it encrypts ePHI in transit and at rest, controls who can access what, generates auditable records of system activity, and whether the vendor will sign a BAA.
Standard consumer or general-purpose enterprise video tools are not appropriate for patient consultations involving ePHI unless they have been specifically configured for HIPAA compliance and the vendor has signed a BAA.
Healthcare-specific telehealth platforms, such as Mitel’s Virtual Care Collaboration Service, are designed from the ground up for clinical use — with encrypted multi-modal communications, no patient-side download requirement, integrated scheduling, and BAA availability as standard.
Both on-premises and cloud deployments can be designed to meet HIPAA requirements, but they distribute compliance responsibility differently. With on-premises deployment, the healthcare organization controls the physical hardware, network infrastructure, and data storage. With cloud deployment, the infrastructure is managed by the vendor or a cloud provider — which is why a BAA and a thorough review of the vendor’s security posture are essential.
Hybrid deployment combines both approaches — maintaining on-premises infrastructure for core communications while extending cloud services where appropriate. This is increasingly common in multi-site health systems that need survivability in clinical locations but cloud flexibility for administrative functions.
Voicemails containing patient information — callback numbers, appointment details, prescription questions — are ePHI at rest under the HIPAA Security Rule. The same encryption, access control, and audit requirements that apply to call records also apply to voicemail storage.
A HIPAA-aligned phone system must encrypt stored voicemails using AES-256 or equivalent, restrict access by user role, and retain an audit log of who accessed each message and when. Shared voicemail boxes without individual user authentication do not meet this requirement.
HIPAA requires that covered entities retain documentation related to their security policies and procedures — including audit logs of communications system activity — for a minimum of six years from the date of creation or the date the record was last in effect, whichever is later.
This applies to call detail records, access logs, system configuration changes, and documentation of risk assessments or remediation activities. Individual state laws may impose longer retention requirements for certain clinical records, and those state requirements take precedence where they exceed the federal standard.
HIPAA’s Security Rule classifies encryption for transmission security as an “addressable” implementation specification — meaning covered entities must assess whether encryption is reasonable and appropriate for their environment. For internal clinical communications that reference patient information, encryption is the only defensible posture in practice.
Staff using personal SMS or consumer messaging apps to discuss patient information is one of the most frequently cited HIPAA exposure points in healthcare organizations. A communications platform that provides encrypted secure messaging within the same system used for voice gives clinical staff a compliant channel that is practical enough to replace the consumer tools.
Ready to assess your communications compliance posture?
Our team works with hospital systems, regional health networks, and medical groups on HIPAA-aligned communications deployments across on-premises, private cloud, and hybrid environments.
Connect with our Healthcare Team