HIPAA Compliant Phone Systems and VoIP: Who Signs a BAA

A HIPAA compliant phone service is one whose provider signs a business associate agreement (BAA) covering the call recordings, voicemails and messages it stores for you: RingCentral, Weave and Nextiva say they sign one, Dialpad signs on all paid accounts, Google Voice is covered for managed users in Google Workspace, and Quo offers a BAA on its Business and Scale plans. A carrier that only connects the call needs no BAA, because HHS says it is "acting merely as a conduit for the PHI" (HHS). To see which ads drive calls, Curve Compliance receives call outcomes from call tracking tools and credits each to the original ad click, under the BAA it signs on every plan.

Book a call. Calls are often the main conversion for a clinic, and a phone BAA does not tell your ad platforms which campaigns drove them. Curve Compliance sends those conversions server-side with PHI stripped before data reaches an ad platform, and signs a BAA on every plan. Curve's team does the setup. Book a call with Curve.

When a phone provider is a business associate

HHS answered this in its audio-only telehealth guidance. A covered entity "using a telephone to communicate with patients is not required to enter into a BAA with a TSP that has only transient access to the PHI it transmits," because the telecom provider is "acting merely as a conduit for the PHI." The answer changes when the vendor keeps data: "However, a covered entity must enter into a BAA with a vendor that is more than a mere conduit for PHI." HHS's example is an app that stores recordings or transcripts, which "would not be providing mere data transmission services and would instead also be creating, receiving, and maintaining PHI" (HHS).

Business phone systems often store call recordings, voicemail, transcripts or texts, which is why their BAA matters. The Security Rule question turns on the line type. HHS says "The HIPAA Security Rule does not apply to audio-only telehealth services provided by a covered entity that is using a standard telephone line, often described as a traditional landline," but "The HIPAA Security Rule applies when a covered entity uses such electronic communication technologies," meaning VoIP and mobile. Its examples include "VoIP technologies" and "Messaging services that electronically store audio messages" (HHS). See what a business associate is.

Which phone systems sign a BAA?

Each row comes from the provider's own page, fetched October 26, 2026, and the rows are in no order of preference. A row marked Specific plans means the BAA is offered only on the plans or users named.

Provider	Signs a BAA?	What it covers	How you get it	Source
RingCentral	Yes, for paying customers	Paying covered entity customers; listed services include RingEX, RingCX and RingCentral Fax	Ask RingCentral for its BAA	RingCentral and HIPAA
Weave	Yes	A Business Associate Addendum that supplements Weave's Terms of Service with each client	Part of the client agreement	Weave
Dialpad	Specific plans	All paid Dialpad accounts	A Company Admin accepts it in the Admin Portal under Privacy and Legal	Dialpad Help
Google Voice	Specific plans	Managed users in Google Workspace	A Workspace administrator accepts Google's BAA	Google; Workspace Help
Quo	Specific plans	Business and Scale plans; texting is not a Covered Service	Existing customers request it from Quo	Quo
Nextiva	Yes, covered services	The services its BAA names	Ask Nextiva for its BAA	Nextiva
Grasshopper	No	None; Grasshopper says it is not HIPAA compliant	Its page says to contact support if you require a BAA, and points customers who need a HIPAA compliant product to GoTo	Grasshopper Support

Where a provider has a BAA Directory entry, its name links to it, with the vendor's own words.

Provider by provider

RingCentral. "RingCentral makes available a business associate agreement (BAA) for our paying Covered Entity customers in alignment with HIPAA requirements." Its list of covered services starts "RingCentral Fax, RingEX, RingCX, RingCentral Contact Center" (RingCentral). See is RingCentral HIPAA compliant.

Weave. Weave publishes a Business Associate Addendum that "supplements the underlying agreement, including the Terms of Service" between Weave and its client (Weave).

Dialpad. "Online BAA signing is available on all paid Dialpad accounts," and "Company Admins are the only users who can sign BAAs" (Dialpad).

Google Voice. Google's list of Workspace services covered by its BAA includes "Google Voice (managed users only)" (Google), and Google says "Administrators must review and accept a BAA before using PHI in Google services" (Google). A personal Google Voice account outside your Workspace is not on that list.

Quo. Quo says "To use Quo in a HIPAA-compliant way, your organization must sign a Business Associate Agreement (BAA)," which is "available for Business and Scale plans" (Quo).

Nextiva. Nextiva's healthcare page says "We sign Business Associate Agreements (BAAs) for covered services" (Nextiva).

Grasshopper. Grasshopper's support page says "At this time, Grasshopper is not HIPAA compliant," and that its support team "must have access to the account settings and information," including messages "like text messages, faxes, and voicemails." It adds "If you require a Business Associate Agreement (BAA), please use the Contact Support option in this article," and points customers who need a HIPAA compliant product to GoTo (Grasshopper).

What a phone BAA leaves out

• Texting, on some plans. Quo says "Text messaging (SMS/MMS) is not a Covered Service under the Quo BAA due to technical limitations that prevent full HIPAA compliance" (Quo). See which texting apps sign a BAA.
• Integrations. Quo says connected services, "including CRM systems, email delivery services, messaging platforms, analytics tools, or similar integrations," are not Covered Services (Quo).
• Third-party channels. RingCentral covers Engage Digital with "third party channel communications excluded" (RingCentral).
• The patient's own phone. HHS says "an individual receiving telehealth services may use any telephone system they choose and is not bound by the HIPAA Rules when doing so" (HHS).

Phone systems versus call tracking

A phone system runs your lines, voicemail and recordings. Call tracking is a separate tool that assigns tracking numbers to ads and pages so you can see which marketing drove each call, and it needs its own BAA. See HIPAA compliant call tracking software and call tracking architecture for healthcare.

Measuring calls from ads without PHI

A caller's number tied to an ad click about a condition can be PHI; see is a phone number PHI. The safe pattern sends ad platforms a conversion that a call happened, with a neutral event name and a fixed list of fields, instead of the caller's details or the reason for the call. For Google Ads call reports, see Google Ads call reporting for clinics, and for what a recording may capture, what call tracking can record. Which rules apply depends on your setup, so talk to your counsel.

How Curve Compliance helps

Your phone BAA covers your calls and recordings. Curve Compliance covers what your ad platforms learn from those calls, under the BAA it signs on every plan. Curve receives outcomes from call tracking tools through incoming webhooks and credits each to the original ad click. Conversions go server-side to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn; each platform receives only a fixed list of fields, events can use neutral names, contact identifiers are off by default on Meta, Google Ads and TikTok, and Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform.

Campaign Reporting puts Meta and Google Ads spend next to those conversions per campaign, and Event Logs show what Curve sent to each platform and what the platform accepted. Curve is SOC 2 Type II, and Curve's team does the setup, typically live in about a week. See which ad platforms sign a BAA.

Sources, checked October 26, 2026: HHS guidance on audio-only telehealth; HHS FAQ on treatment communications; FCC, Voice Over Internet Protocol; RingCentral and HIPAA; Weave Business Associate Addendum; Dialpad, Sign a Business Associate Agreement; Google's list of HIPAA covered services; HIPAA Compliance with Google Workspace and Cloud Identity; Quo HIPAA compliance; Nextiva healthcare; Grasshopper, Is Grasshopper HIPAA compliant?.

Frequently Asked Questions

What is a HIPAA compliant phone service?

A phone service whose provider signs a BAA covering the recordings, voicemails and messages it stores for you, used with the Security Rule safeguards HHS expects for VoIP (HHS). RingCentral, Weave and Nextiva say they sign one, and Dialpad, Google Voice and Quo offer one on specific plans or accounts.

Are phone calls HIPAA compliant?

Yes, with reasonable safeguards. HHS says treatment communications "may occur orally or in writing, by phone, fax, e-mail, or otherwise" (HHS). A traditional landline is outside the Security Rule, while VoIP and mobile calls fall under it, and a phone vendor that stores recordings or messages needs a BAA (HHS).

Can I make my phone HIPAA compliant?

For a practice phone system, yes: use a provider that signs a BAA for the services that store recordings, voicemail or messages, and apply the safeguards HHS lists, such as requiring authentication to access the device or app and locking it after a period of inactivity (HHS).

What is a VoIP phone?

The FCC says "Voice over Internet Protocol (VoIP), is a technology that allows you to make voice calls using a broadband Internet connection instead of a regular (or analog) phone line." A VoIP call can be made "directly from a computer, a special VoIP phone, or a traditional phone connected to a special adapter" (FCC).

Why would someone use VoIP instead of cell phone?

The FCC says "Some VoIP services offer features and services that are not available with a traditional phone," and notes that "Some VoIP services don't work during power outages" (FCC). For HIPAA the rule is the same for both: HHS says the Security Rule applies to VoIP and mobile technologies, and any vendor that stores the calls or messages needs a BAA (HHS).

Are phone calls HIPAA compliant for therapy?

HHS says "HIPAA covered entities can use remote communication technologies to provide telehealth services, including audio-only services, in compliance with the HIPAA Privacy Rule." If the app or phone system records or transcribes sessions, the vendor is a business associate and needs a BAA (HHS).

Is Dialpad HIPAA compliant?

Dialpad says "Online BAA signing is available on all paid Dialpad accounts," and a Company Admin accepts the BAA in the Admin Portal (Dialpad). Your own settings and safeguards still apply.

Is Nextiva HIPAA compliant?

Nextiva's healthcare page says "We sign Business Associate Agreements (BAAs) for covered services" (Nextiva). Ask Nextiva which services its BAA covers on your account.

Talk to Curve Compliance

Book a call. Your phone BAA covers your calls. Curve Compliance credits calls from call tracking tools to the original ad click and sends conversions server-side, with PHI stripped before data reaches an ad platform, under the BAA it signs on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.