Last updated: September 12, 2026
Treat everything below as a summary of federal regulation rather than legal advice. Check anything here against the current text and your own counsel.
What HIPAA requires when you record calls
HIPAA governs protected health information in any medium, sets no call recording mandate, and runs no certification program for software. A recording that holds PHI is PHI, so a vendor storing it acts as a business associate under a signed agreement. Who inside your building can open that audio follows the minimum necessary standard.
The compliance question in this market usually gets answered with a badge, so throw the badge out first. No federal body certifies software as HIPAA compliant, which makes a certification seal a receipt for a purchase rather than evidence about your audio.
What exists in place of it is a relationship. A medical practice is a covered entity, a company handling its patient information is a business associate, and the agreement signed between them is the document carrying legal weight. Ask for that agreement and the question becomes answerable: where the audio lives, and who can open it.
A recording that carries PHI is PHI
A caller gives her name and her reason for calling on a line your operator answered in a dermatology practice's business name. Under 45 CFR 160.103 that is individually identifiable health information received on behalf of a provider, and the definition reaches any form or medium. The audio file inherits every obligation the typed message carries.
Most services treat the message as the record and the recording as a byproduct. That reading holds up on the day of the call and stops once the audio sits in a searchable archive with a year of history behind it. A call that never names a diagnosis still carries a name, a callback number, and the reason somebody phoned a doctor at 2 a.m.
Scrubbing the name out of a transcript does not make the file anonymous. The safe harbor list at 45 CFR 164.514(b)(2)(i) runs to eighteen identifiers, and item (P) reads "Biometric identifiers, including finger and voice prints." A recording is a voice print with a conversation attached.
Nothing in HIPAA tells you to record the call in the first place. CMS does require that of Medicare marketing organizations, which is CMS call recording requirements, and announcing the recording is state wiretap law, which is your recording disclosure script.
The minimum necessary standard inside your own building
45 CFR 164.502(b) asks for "reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose." The Security Rule backs it with access authorization at 164.308(a)(4) and technical access control at 164.312(a)(1).
Say you answer for nine medical accounts sending 1,200 calls a month between them. Keep the audio a year and that is roughly 14,400 recordings. If every supervisor login opens all of them, the answer to who has access is everybody, and the QA archive has quietly become a larger exposure than the message queue ever was.
Scoping that is a policy decision before it is a software setting. Roles in a product do nothing when the admin role goes to nine people because reading the permissions page took too long.
Business associates and the agreement that binds them
45 CFR 160.103 defines a business associate as a person who creates, receives, maintains, or transmits protected health information on behalf of a covered entity for a regulated function. A QA vendor that stores your audio, transcribes it, and holds the transcripts lands inside that without much argument.
For an answering service the chain has a middle link. Your service is the business associate of the practice, and a vendor you hire becomes a subcontractor, which 45 CFR 164.504(e) pulls under the same restrictions through a written agreement. Obligations you took on for a client travel down to anybody you hand the audio to, which surprises operators who have emailed recordings to a scoring vendor for years.
Under 45 CFR 164.502(e)(1)(i) a covered entity may disclose PHI to a business associate once it "obtains satisfactory assurance that the business associate will appropriately safeguard the information," documented in a written contract meeting 164.504(e). That contract carries specific terms: use limited to what it permits, appropriate safeguards, breach reporting, subcontractors bound to the same conditions, and return or destruction of the PHI at termination.
A signed BAA does not make either side compliant. It allocates obligations and gives you a named party and a written standard for the day something goes wrong, which a seal on a pricing page does not. The medical account rows in an answering service scorecard ask it at the call level, and HIPAA compliant answering service is the version your clients are reading about you.
There is no HIPAA certification for software
HHS answered this one directly years ago. No standard or implementation specification requires a covered entity to certify compliance with the Security Rule, and the department does not endorse or recognize private organizations' certifications. The periodic evaluation at 164.308(a)(8) runs against your own environment, and a vendor cannot run it for you.
Third party attestations are a different object, and a real one. A firm reviews a set of controls against a framework and issues a report with a scope and a date on it, which is useful evidence once you read the scope. SOC 2, ISO 27001, and HITRUST work that way, and none is a federal license.
A badge costs less to buy than a BAA costs to sign, which is why more vendors display one. When a compliance page has an image where the agreement should be, ask for the agreement.
The questions to ask any recording vendor
Five questions, in the words you would use on the call. A vendor who cannot answer them inside a minute has not thought about your audio as carefully as you have.
Where does the audio live, and whose infrastructure is it? You want a named environment and region, since recordings pooled in shared storage with other customers' calls carry a different risk from a silo of your own.
Who can open a recording, under which role, and is that access logged? Audit controls at 45 CFR 164.312(b) are a required implementation specification for systems holding electronic PHI, so logging is fair to ask about, and so is the role list.
Will you sign a business associate agreement, and what does it cover? Yes is the floor rather than the finish, so read the subcontractor clause and the termination clause, which decides where your audio goes.
What happens to the audio while it is being processed? Transcription and scoring move the file somewhere, so ask whether it leaves the environment it is stored in and what is retained after.
Does any outside model see the audio or the transcript? Most scoring products call a public model API, which puts a caller's name and her reason for calling into a third party system under that provider's terms.
How CallSniper answers those five questions
Audio stays inside Trinsic's cloud, in a private silo for your organization. Trinsic has run its own infrastructure in Austin for twenty years, so the hosting answer is a place we can name.
The model is Trinsic's own, it runs on CPU inside that same environment, and no public LLM sits anywhere in the path. Transcription and scoring happen without the recording leaving.
Users are scoped by role across Agent, Supervisor, and Admin, so a supervisor works inside the accounts they own instead of the whole archive.
Trinsic typically requires a business associate agreement with each CallSniper customer, because recorded calls can carry protected health information.
Two limits belong here. Access logging is not a claim we make on this page, so treat it as a question for your implementation call rather than something to take our word on. A BAA from us also does nothing about who inside your building opens a recording, the half no vendor solves for you. Demonstrations run on sanitized calls, or on your own audio once an agreement is in place.
What the datacenter certifications cover and what they do not
Datacenter certifications cover the building. Power feeds, physical access, environmental controls, and the practices of the people on that floor are real things to audit.
None of that reaches the software, and none of it says anything about who at your company can open a recording. The distinction is worth stating out loud on a sales call before a prospect's compliance officer states it for you.
What is still open
SOC 2 Type A was expected about a month after August 27, 2026, and the report is not in hand as of this writing, so treat any SOC 2 language about this product as pending until it exists with a date on it.
Frequently asked questions
Is call recording HIPAA compliant?
Recording is neither required nor forbidden under HIPAA. Compliance attaches to the handling: where the file sits, who can reach it, and whether every company touching it signed a business associate agreement. A recording holding patient information is treated as PHI.
Can a company be HIPAA certified?
No federal certification program exists, and HHS does not recognize private certifications as compliance. Audit firms sell attestations reviewing controls against a framework, and those reports are evidence with a scope and a date rather than a license. What binds a vendor handling your PHI is the business associate agreement.
Do you need a BAA for a call recording vendor?
Where the recordings contain PHI, yes. 45 CFR 164.502(e) requires satisfactory assurance documented in a written contract, and 164.504(e) sets the terms that contract has to carry. A vendor working on behalf of a business associate sits downstream as a subcontractor under the same requirement.
How long do you have to keep HIPAA call recordings?
HIPAA sets no retention period for recordings. The six year figure people cite comes from 45 CFR 164.316(b)(2)(i), which covers required documentation such as policies and agreements. Retention for the audio comes from state law, client contracts, and sector rules, covered in call recording retention requirements.
Can an answering service record calls for a medical office?
Yes, and the service generally acts as a business associate of the practice under a signed agreement. Recording and quality scoring are permitted uses when the agreement covers them, and any vendor the service brings in sits downstream as a subcontractor on the same terms.
What to ask before you send anyone your audio
Read these to whoever holds your recordings today, including us.
- Where does the audio live, and whose infrastructure is it?
- Who can open a recording, under which role, and is that access logged?
- Will you sign a business associate agreement, and what does it cover?
- What happens to the audio while it is being processed?
- Does any outside model see the audio or the transcript?
Ours, in the same order: the audio stays in Trinsic's cloud, roles run across Agent, Supervisor, and Admin, we sign the agreement, processing happens without the file leaving that environment, and no outside model sees it. Access logging is the one we leave to the implementation call, and how CallSniper handles your audio is the site level version.
Put the answers in writing next to the BAA, since a vendor who answers cleanly in September can answer differently in March once the architecture has moved. Everything stays inside your own silo during a call review, scored against your own account scripts, at a fixed pilot price.
Sources
- 45 CFR 160.103, definitions of protected health information, individually identifiable health information, and business associate. Cornell LII, 2026-09-12. Confirm on eCFR before publish.
- 45 CFR 164.502(b) minimum necessary and 164.502(e) disclosures to business associates. Cornell LII, 2026-09-12.
- 45 CFR 164.504(e), required business associate contract terms. Cornell LII, 2026-09-12.
- 45 CFR 164.514(b)(2)(i), the eighteen identifier safe harbor list, including voice prints at item (P). Cornell LII, 2026-09-12.
- 45 CFR 164.308(a)(4) and (a)(8), plus 164.312(a)(1) and (b). Cornell LII, 2026-09-12.
- 45 CFR 164.316(b)(2)(i), six year documentation retention. Cornell LII, 2026-09-12.
- HHS FAQ on certifying compliance with the Security Rule. Located by search 2026-09-12, page not retrieved because hhs.gov returned 403. Wording unverified.
- callsniper.ai datacenter line, read 2026-09-12. Conflicts with this page and is flagged for the editor.
- Trinsic feature sheet and call notes, 2026-08-27 through 2026-09-10. Verified internally, with role based access conflicting between the two.
- SOC 2 Type A status. Unconfirmed as of 2026-09-12.
- Access control and audit controls, 45 CFR 164.312. Read via the Cornell LII mirror on 2026-09-12 because hhs.gov and ecfr.gov both refused the request. Open on eCFR before publish.