Mystery shopping your own medical practice: secret shopper calls, visits and the rules

A practice can pay for ads and search and still lose the patient on the phone. The call rings out, the person who answers cannot say whether the practice takes a plan, or the caller is put on hold and hangs up. An owner who is in clinic all day may never hear these calls. A mystery shopper, someone who calls or visits as if they were a new patient and reports back, is one way to find out what a caller actually hears. The idea is simple. The details are where practices get into trouble: recording the call, staff who reveal real patient information to a stranger, shoppers who post reviews, and ads that quote shopper results as proof.

This guide is for practice owners and office managers who want to test their own phones, web forms and front desk. It covers what to test, how recording rules apply to test calls, what HIPAA asks when a shopper hears about real patients, why shopping a competitor needs care, and what you can and cannot say in ads afterward. The consent rules for recording patient calls in depth are in our call recording consent guide. Measuring which ads produce calls is covered in our call tracking guide, and following up when a visitor starts a form and leaves is covered in our guide to abandoned appointment requests.

The short version

• Test what a new patient meets: the phone, the web form, the callback, the front desk and the follow-up.
• Federal law allows recording with one party’s consent (18 USC 2511(2)(d)). California, Washington and Florida ask for consent from all parties. We recommend a recorded-line notice on test calls wherever the call lands.
• A shopper is not a patient, but staff can still reveal real patient information to them. Treat that as a privacy finding and fix it with training and safeguards (45 CFR 164.530(b), (c)).
• A shopper firm that receives recordings with patient information on your behalf can be a business associate under 45 CFR 160.103.
• Never have a shopper ask a competitor about a real patient. Obtaining health information under false pretenses is a federal crime (42 USC 1320d-6).
• Shoppers do not write reviews of your practice. Ad claims built on shopper results need a reasonable basis before they run.

What a shopper program tests

Pick a few questions you want answered, and design the calls around them. A shopper program that tries to grade the whole office at once produces a long report and no change. Useful questions for an independent practice:

• Is the phone answered during posted hours, and how long does the caller wait before a person or a useful message?
• Can the person who answers say which insurance plans the practice is in network with, or say who can?
• Does a self-pay caller hear a price range, and are they told about the good faith estimate?
• Does the caller get offered a specific appointment time, or only told someone will call back?
• After hours, does the voicemail or answering service say what to do in an emergency (911) or a mental health crisis (988)?
• When a web form is sent, how long until someone calls or emails back, and does the reply match what the form promised?
• At the desk, is the caller treated the same whether they ask in English or need language help?

Write a short scenario for each call: who the shopper is pretending to be, what they ask, and what a good answer sounds like. Score against your own written standard, not a feeling. Keep the scenarios free of real patient names, dates of birth or conditions taken from your records.

Recording test calls: federal and state rules

Under 18 USC 2511(2)(d), a person who is a party to a call, or who has the prior consent of one party, may record it, unless the recording is made to commit a criminal or tortious act. A shopper who records their own call to your office is a party. That is the federal floor, and it is not the end of the question.

States set their own rules, and a number of them ask for consent from all parties to the call. California Penal Code 632(a) bars recording a confidential communication without the consent of all parties. Washington RCW 9.73.030(1)(a) bars recording a private telephone communication without first obtaining the consent of all the participants. Florida Statutes 934.03(2)(d) makes interception lawful when all of the parties have given prior consent. Your front desk staff are parties to these calls, so a secret recording of them can raise the same issue as a secret recording of a patient.

No federal rule requires a particular greeting for a test call. We recommend that the practice’s own recorded-line notice play on each inbound line, including the line a shopper calls, and that staff sign a written acknowledgment that calls are recorded and that test calls happen. A shopper firm that records from its own side should tell you, in writing, how it gets consent in all-party states. Our call recording consent guide has greeting wording.

When a shopper hears about a real patient

A shopper is not your patient, so their invented story is not protected health information. The risk runs the other way. A test call is the moment you find out whether staff will confirm that a named person is a patient, read an appointment time back to a stranger, or discuss a chart with someone who has not been verified.

Under 45 CFR 164.502(a), a covered entity may not use or disclose protected health information except as the Privacy Rule permits or requires. A disclosure to a stranger posing as a family member is not one of the permitted ones. 45 CFR 164.530(c) requires administrative, technical and physical safeguards and asks the practice to reasonably safeguard information from intentional or unintentional disclosure. 164.530(b) requires training of the workforce on the practice’s privacy policies, and 164.530(e) requires sanctions applied to workforce members who do not follow them.

Reviewing calls to improve service fits the Privacy Rule’s definition of health care operations in 45 CFR 164.501, which includes quality assessment and improvement and evaluating performance and training. So the test itself is a normal operations activity. What matters is what you do when a test exposes a gap. We recommend these steps:

• Design shopper scenarios that ask about a made-up person, never a real patient.
• If staff disclose real patient details anyway, stop the review there, log it, and route it to your privacy officer, who decides whether it is a breach to assess.
• Retrain the person, and fix the script or the identity check that failed.
• Keep shopper recordings with patient details under the same access limits as your other call recordings.

Hiring an outside shopper firm

Under 45 CFR 160.103, a business associate is a person who, on behalf of a covered entity, creates, receives, maintains or transmits protected health information for a regulated function, and the definition lists quality assurance. A firm that only places calls and sends you a score may never touch patient information. A firm that records calls, transcribes them, or receives your own call recordings to grade can. Ask before you sign, and get the answer in writing.

We recommend that the contract say which calls the firm will place, from which states, how it handles recording consent, where recordings and transcripts are stored, who can hear them, how long they are kept, and that shoppers will not post reviews or other content about your practice.

Mystery shopping a competitor

Calling another practice to hear how it handles a new patient call is a way to see how your own office compares. Keep it to public information: hours, whether they are taking new patients, how fast they answer, and the self-pay price range they quote to the public. Three lines not to cross:

• Never ask about a real person. Under 42 USC 1320d-6(a), a person who knowingly obtains individually identifiable health information in violation of the HIPAA rules commits an offense, and under 1320d-6(b)(2) the penalty is higher when it is committed under false pretenses: a fine of up to 100,000 dollars, up to 5 years in prison, or both.
• Do not record the competitor’s staff in a state that asks for consent from all parties. 18 USC 2511(2)(d) also does not protect a recording made to commit a tortious act.
• Do not book and hold a real appointment slot you will not use. No federal rule addresses this, but it takes a slot from a real patient, and we recommend ending the call before booking.

Shoppers and online reviews

A shopper has been to your office or on your phone line, so it can feel natural to ask them for a review. Do not. Under 16 CFR 465.2(a), a business may not write or create a consumer review that misrepresents the reviewer’s experience, and 465.2(b) bars buying a review that does. Under 465.5, reviews by officers and managers need a clear and conspicuous disclosure of their relationship, and testimonials by employees or agents carry the same duty. A shopper you pay has a material relationship with your practice, so a review from them is not an ordinary customer review.

Google’s policy on user contributed content for Maps lists content based on a conflict of interest, including a contractual relationship, and reviews that have been paid for, directly or in kind, as content it removes. We recommend a contract term that bars shoppers from posting about your practice or any competitor.

Using shopper results in your ads

Shopper scores can make a practice want to advertise them: we answer within three rings, a person picks up after hours, faster callbacks than other practices in town. Under 15 USC 45(a)(1), deceptive acts in commerce are unlawful. The FTC Policy Statement Regarding Advertising Substantiation says advertisers must have a reasonable basis for objective claims before they are disseminated.

A month of test calls is a sample, not proof of how the office performs on a holiday week. No federal rule sets a number of test calls that substantiates a claim. We recommend keeping ad claims to things the practice controls and can show on any day, such as posted hours or online booking, and keeping the test data, dates and method on file if you do make a speed or comparison claim. A comparison with named or implied competitors needs data on them that would hold up too.

Questions to ask a shopper firm

• Will you place calls only, or will you also record, transcribe or receive our call recordings?
• If you receive patient information, will you sign a business associate agreement?
• How do you handle recording consent when the call reaches an all-party state?
• Do your scenarios ever use real names or details, and who writes them?
• Do your shoppers post reviews or content about the businesses they test?
• Where are recordings and reports stored, for how long, and who at your firm can access them?

Use and avoid

Use: written scenarios with made-up people, a scoring sheet, a recorded-line notice on each inbound line, staff acknowledgment that test calls happen, privacy findings routed to your privacy officer, and ad claims you can show on any day.

Avoid: scenarios built from real patient records, secret recordings in all-party states, shopper reviews, asking a competitor about a real person, booking and abandoning competitor slots, and advertising a speed or comparison claim from a handful of calls.

An illustration

This example is invented. [Practice name], a two-clinician integrative practice, hires a shopper to place ten calls over two weeks, half after hours. The scenarios are written by the office manager and use a made-up caller. The report shows four calls reached voicemail with no callback within a day, and on one call the staff member, asked by the shopper posing as a spouse, confirmed that a named person had an appointment that week. The name was a real patient, because the shopper used a name they knew. The office manager stops the review of that call, sends it to the privacy officer, retrains the staff member on identity checks, and adds a contract term that scenarios use only names supplied by the practice from a made-up list. The practice adds a callback rule for voicemails, retests in a month, and does not put a callback time in its ads.

Checklist

• Written goals and scenarios with made-up people.
• Recorded-line notice on each inbound line, and staff acknowledgment of recording and testing.
• Shopper firm contract covering recording consent, storage, retention and no reviews.
• Business associate agreement if the firm handles patient information.
• Privacy findings routed to the privacy officer, with retraining and sanctions per 45 CFR 164.530.
• Competitor calls limited to public information, unrecorded, no real names, no held slots.
• Ad claims from shopper data kept on file with dates and method, or not made.
• State recording and employment law reviewed by a health care attorney.

How we help

We build practice websites, local SEO, Google Ads and lead generation and an AI front desk for independent practices. For shopper programs, we help set up recorded-line greetings, call tracking that shows where calls are missed, and web form callbacks you can test. Our tools are built with HIPAA in mind. We confirm in writing what a BAA covers before any patient information flows through a tool, and if it is not covered, we do not route patient information through it. We are not a healthcare provider and we do not give legal or medical advice. For the wider rules, see our healthcare marketing rules guide.

Sources

• 18 USC 2511: Interception and disclosure of wire, oral, or electronic communications prohibited
• California Penal Code 632
• Washington RCW 9.73.030: Intercepting, recording, or divulging private communication
• Florida Statutes 934.03
• 45 CFR 164.502: Uses and disclosures of protected health information, general rules
• 45 CFR 164.530: Administrative requirements
• 45 CFR 164.501: Definitions (health care operations)
• 45 CFR 160.103: Definitions (business associate)
• 42 USC 1320d-6: Wrongful disclosure of individually identifiable health information
• 16 CFR part 465: Use of consumer reviews and testimonials
• Google Maps: Prohibited and restricted content
• 15 USC 45: Unfair methods of competition unlawful
• FTC Policy Statement Regarding Advertising Substantiation (1984)

More in Phones, front desk and patient messages