Call recording consent for medical practices: greetings, state laws and patient data

A practice phone system can record calls with one setting. Call tracking tools, answering services and AI receptionists can record, transcribe and summarize each call without anyone on your team pressing a button. That is useful for training, for checking what a caller was told and for seeing which ads lead to booked visits. It also creates two questions that are easy to skip: did everyone on the call agree to be recorded, and who protects the recording once it exists?

This guide covers the consent rules for recording calls, wording for the recorded-line greeting, what to do when a caller says no, how to treat recordings and transcripts as patient information, and what changes when a tool writes an AI summary of the call. For tracking numbers and attribution, see our call tracking guide. For choosing who answers the phone, see our answering service vs AI receptionist guide and our AI receptionist guide. For what your team says on the call itself, see our new patient phone script. Testing your own phone lines with shopper calls is covered in our guide to mystery shopping your practice.

The federal rule: one party can consent

The federal wiretap law, 18 U.S.C. 2511, makes it a crime to intercept a wire, oral or electronic communication, with exceptions. The one that matters here is 18 U.S.C. 2511(2)(d): it is not unlawful for a person not acting under color of law to intercept a communication where that person is a party to the communication, or where one of the parties has given prior consent, unless the interception is for the purpose of committing a criminal or tortious act. Wiretap laws are also the basis for claims about website chat and session replay tools, which we cover in website chat, session replay and wiretap laws.

Read plainly, federal law lets a party to a call record it without telling the other side. That is the floor, not the answer. State recording laws also apply, and the examples below ask for more.

States that ask for consent from everyone on the call

Certain state laws require the consent of each party to a private call before it is recorded. Four examples, paraphrased closely from the state code text:

• California: Penal Code 632(a) makes it a crime to intentionally record a confidential communication, including one carried on by telephone, without the consent of all parties. The penalty in the text is a fine of up to 2,500 dollars per violation, jail or prison, or both, with higher fines after a prior conviction. Section 632(c) defines a confidential communication as one carried on in circumstances that reasonably indicate a party wants it confined to the parties, and excludes situations where the parties may reasonably expect to be overheard or recorded. Section 632(b) includes businesses and corporations in the definition of a person.
• Washington: RCW 9.73.030(1) makes it unlawful to record a private communication transmitted by telephone or other device without first obtaining the consent of all the participants. RCW 9.73.030(3) adds that consent is considered obtained when one party has announced to all other parties, in any reasonably effective manner, that the communication is about to be recorded, and that if the conversation is recorded, the announcement must also be recorded.
• Florida: section 934.03(2)(d) of the Florida Statutes makes it lawful for a person to intercept a wire, oral or electronic communication when all of the parties to the communication have given prior consent.
• Maryland: section 10-402(c)(3) of the Courts and Judicial Proceedings article makes it lawful for a person who is a party to the communication to intercept it where all of the parties have given prior consent, unless the interception is for a criminal or tortious purpose.

These are examples, not a full list, and we do not publish a state count because lists go out of date. Your callers may be in a different state from your office, and a call between two states can raise the laws of both. The simplest approach is to set up recording so it meets an all-party consent standard on each call, wherever the caller is. Washington’s wording shows what that looks like in practice: announce the recording at the start, and record the announcement too.

Wording for the recorded-line greeting

The greeting has one job: tell the caller, before anything sensitive is said, that the call may be recorded, and give them a way to continue without it. Sample wording, to adapt with your attorney:

• “Thank you for calling [Practice name]. This call may be recorded for quality and training. If you do not want this call recorded, press [key] or tell the person who answers.”
• “If you have a medical emergency, hang up and call 911.”
• For an answering service or AI receptionist: “You are speaking with an automated assistant for [Practice name]. This call is recorded.” Our AI disclosure guide covers when telling callers they are talking to an automated tool is required.

Use: the greeting at the very start, before the caller states their name, date of birth or reason for calling. Avoid: a greeting that plays only after a hold queue, or only on some lines. Calls transferred from a tracking number, an after-hours line or a forwarded mobile phone need the same greeting.

Outbound calls need the notice too

A recording setting can cover inbound and outbound calls the same way. A greeting on your main line does nothing for a call your team places to a patient from the same system.

• Use: a short spoken line at the start of a recorded outbound call: “This is [name] from [Practice name]. This call is recorded for quality. Is now a good time?”
• Use: a separate setting for outbound calls if you do not need them recorded at all.
• Avoid: leaving recording on for calls staff place from a personal phone through a practice app, unless the same notice is given.

Automated and prerecorded outbound calls raise separate consent rules under the Telephone Consumer Protection Act. Our answering service guide covers those.

When a caller says no

Plan for the caller who does not want to be recorded, because the greeting promises them a choice. Decide in advance how the choice works:

• Use: a key or spoken option that sends the call to a line or a person with recording turned off.
• Use: a front desk script for staff: “No problem. I have turned recording off for this call.” Only say this if the system lets staff do it.
• Use: a written note in your policy that recording is optional for callers and never a condition of booking care.
• Avoid: hanging up on a caller who objects, or asking them to call back another way without offering one.

Recordings and transcripts are patient information

Once a caller gives their name, date of birth, symptoms or insurance details, the recording and any transcript hold protected health information. The HIPAA sections cited in this guide do not name call recordings. The rules that apply to a covered entity’s other records apply to them too.

Safeguards. Under 45 CFR 164.530(c), a covered entity must have appropriate administrative, technical and physical safeguards to protect the privacy of protected health information, and must reasonably safeguard it from intentional or unintentional use or disclosure that violates the Privacy Rule. For recordings, that means deciding who can listen, from which devices, and how access is logged.

Access requests. Under 45 CFR 164.524(a)(1), an individual has a right to inspect and obtain a copy of protected health information about them in a designated record set, with listed exceptions. The definition in 45 CFR 164.501 includes the medical and billing records a provider keeps, and records used, in whole or in part, by or for the covered entity to make decisions about individuals. Whether a given recording falls in your designated record set depends on how you use it. A recording a clinician relies on for a care decision fits that wording more closely than one kept only for staff training. Decide this with your attorney before the first request arrives, and write the answer into your policy.

Vendors. A call tracking company, answering service or AI receptionist that stores recordings for you is handling patient information on your behalf. Ask each vendor in writing what they record, transcribe and store, where, for how long, and whether they will sign a business associate agreement that covers recordings, transcripts and summaries. Our call tracking guide lists the vendor questions.

How long to keep recordings

The federal sections cited in this guide do not set a retention period for call recordings. State medical record retention rules may apply to recordings that are part of the medical record, and other recordings may need a shorter schedule. A recording you do not keep cannot be lost, leaked or requested.

• Use: a written retention period for each kind of recording, such as training recordings, recordings tied to a complaint and recordings saved to a chart.
• Use: automatic expiry in the phone or tracking system, set to match the written period.
• Use: a hold process that stops expiry when a complaint, request or legal matter involves a call.
• Avoid: keeping each recording forever because nobody set the expiry.
• Avoid: downloading recordings to personal devices or shared drives for review.

AI summaries and transcripts

Tools that transcribe calls and write a summary into a ticket, an email or a practice management system move the call content into more places. Each copy is patient information, and each place it lands has its own access rules.

• Use: summaries that hold only what the next person needs, such as the caller’s name, callback number and the scheduling request.
• Use: a human check before a summary is saved to a chart. A transcription error in a medication name or a date of birth can follow the patient.
• Use: written answers from the vendor on whether call content is used to train their models, and whether you can turn that off.
• Avoid: summaries sent to email inboxes or chat channels that staff outside the front desk can see.
• Avoid: using a tool’s summary as the record of what a caller was told about their care.

When a patient records you

The same laws apply in the other direction. A patient may record a call with your office, or a visit, on their own phone. Under the federal one-party rule, a patient who is a party to the conversation can do this. State law may differ, as the examples above show.

• Use: a written policy on how staff respond when a patient asks to record, or when staff learn a call is being recorded, reviewed with your attorney.
• Use: the same calm, accurate wording on each call, as if it may be recorded, because it may be.
• Avoid: telling a patient that recording is illegal without legal advice for your state.

An illustration

This example is invented to show the process. It is not a client story. [Practice name], a family practice in one state, turns on call recording through its new tracking numbers. The default setting records each call with no greeting. A caller from a neighboring state asks the front desk about a lab result and later learns the call was recorded. Nobody on the team knows where recordings are stored, who can play them or when they expire.

The fix is a short project. The practice adds a recorded greeting to each tracking number and the main line, adds a no-recording option, turns off recording for outbound calls, sets recordings to expire on a written schedule, limits playback to two staff roles, and asks the vendor in writing what a business associate agreement covers. The attorney decides how recordings tied to care decisions are handled when a patient asks for a copy.

Checklist

• List each line and tool that can record: main line, tracking numbers, after-hours line, answering service, AI receptionist, staff mobile apps.
• Turn off recording anywhere you do not need it.
• Add the recorded-line greeting at the start of each recorded inbound call, recorded with the call.
• Add a spoken notice for recorded outbound calls.
• Give callers a way to continue without recording, and train staff on it.
• Set who can listen to recordings and read transcripts, and turn on access logs.
• Write a retention period for each kind of recording and set automatic expiry to match.
• Decide with your attorney how recordings fit your designated record set and access requests.
• Get vendor answers in writing on storage, retention, model training and what a business associate agreement covers.
• Have a health care attorney review the setup for each state your callers are in.

For texts rather than calls, see our guide to marketing texts from your practice, which covers consent, opt-outs and state telemarketing limits. For the consent, Do Not Call and calling hours rules on sales calls themselves, see our guide to marketing calls to patients.

How we help

We build websites, local search, Google Ads and lead generation and AI front desk tools for independent practices and health businesses. On calls, that means tracking numbers with a recorded-line greeting, recording turned off where it adds nothing, summaries limited to scheduling details and retention set on purpose. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules hub.

Sources

• 18 U.S.C. 2511: Interception and disclosure of wire, oral, or electronic communications prohibited
• California Penal Code 632: Eavesdropping on or recording confidential communications (Internet Archive copy of leginfo, September 20, 2026)
• Washington RCW 9.73.030: Intercepting, recording, or divulging private communication
• Florida Statutes 934.03: Interception and disclosure of wire, oral, or electronic communications prohibited
• Maryland Courts and Judicial Proceedings 10-402: Interception of communications
• 45 CFR 164.501: Definitions, including designated record set
• 45 CFR 164.524: Access of individuals to protected health information
• 45 CFR 164.530: Administrative requirements, including (c) Safeguards

More in Physician specialty marketing