Does a HIPAA compliant voice app have to encrypt the audio?

Encryption appears as an addressable implementation specification rather than a required one, under both access control and transmission security. Addressable means you assess it, and where it is not reasonable and appropriate you document why and use an equivalent alternative. For call media crossing the public internet there is rarely a defensible reason to skip it.

Can you build a calling app without a telephony provider?

Not realistically. You need a media path such as WebRTC or SIP, signalling, relay servers for connections that cannot be made directly, and a push path that wakes the app so it can ring on a locked phone. App builders do not include any of that, so you are integrating a provider and signing an agreement with them.

Should a clinical phone app record calls?

Only where there is a clinical or legal reason. A recording is a stored file with a retention schedule, an access list and a deletion job somebody has to run. State wiretap law applies alongside HIPAA, and some states require consent from every party on the call. If nobody will listen back, the safest recording is the one never made.

What should the app show on the lock screen when it rings?

As little as identifies a patient. A role, a ward or a case reference is usually enough for the person answering. The ring screen, the system recents entry and the push notification are three separate surfaces, and on iOS calls placed through CallKit can be written into recents unless you turn that off. Check each on a locked device before you ship.

Articles · App ExamplesUpdated September 2026

A HIPAA compliant phone app is judged by what the call leaves behind.

Q: Is an ordinary phone call covered by the HIPAA Security Rule?

The Security Rule covers electronic protected health information. The definition of electronic media at 45 CFR 160.103 says voice sent via telephone is not a transmission via electronic media if the information did not exist in electronic form immediately before it. Oral disclosures remain governed by the Privacy Rule. Once your app records, transcribes or logs the call, the data is electronic.

Encryption is the part everyone asks about, and it is rarely the part that fails. A HIPAA compliant phone app can protect the audio perfectly and still spill a case through a call log, a voicemail file, a transcript in a bucket, or a lock screen reading Incoming call from the oncology clinic. Most of it carries over from HIPAA compliant messaging apps, with one extra problem: the phone has a telephony stack of its own.

This page covers what the Security Rule asks of a calling app, why voice is a different build from text on both iOS and Android, where the protected data really lands, and what you add yourself because no app builder ships calling for free.

See what one call leaves behind

The short version

Encrypting the audio is the easy half, and everything the call writes down is the other one.

A call is a stream that vanishes. The records around it do not: who rang whom, when, for how long, the voicemail audio, the transcript, the missed call alert. The definition of electronic media at 45 CFR 160.103 says voice sent via telephone is not a transmission via electronic media if the information did not exist in electronic form immediately before it. Your app changes that.

So the real design question is not how to encrypt a call. It is which records a call is allowed to create, who can see each one, where it is stored and how long it lives.

What the Security Rule asks of a calling app

The technical safeguards live in 45 CFR 164.312, and they are shorter than most people expect. Access control means technical policies and procedures that allow access only to those persons or software programs granted access rights. Two of its implementation specifications are required: a unique name or number for identifying and tracking user identity, and a procedure for getting at necessary records during an emergency. Two more are addressable: automatic logoff after a predetermined time of inactivity, and a mechanism to encrypt and decrypt.

Then audit controls, which ask for mechanisms that record and examine activity in systems holding electronic protected health information. In a calling app that is the call log, which stops being a convenience feature and becomes evidence. Person or entity authentication asks you to verify that whoever seeks access is the one claimed. Transmission security covers data in transit, with integrity controls and encryption both addressable.

Addressable is not the same as optional. You assess whether the specification is reasonable and appropriate, document the answer, and put an equivalent alternative in place where that is reasonable. The one that catches a clinical phone app is required: unique user identification. A shared ward handset with a shared login cannot say which human placed the call, and an audit log that cannot name a person is worth little.

45 CFR 164.312, technical safeguards

Try it

What one call leaves behind

Switch on the pieces your app will create. Each one is a record you have to store, show to somebody and eventually delete.

3 records per call

Call detail records: Your audit trail. Worth little if the login is shared.
Voicemail audio: A stored file. It needs a home and a deletion rule.
Incoming call push: Readable on a locked screen by anyone nearby.

Why voice is a different build from text

An incoming message can be an ordinary push notification. An incoming call cannot, not if it has to ring on a locked phone and behave like a call. On iOS that means CallKit, which Apple describes as displaying the system calling UI for your app's VoIP services and coordinating them with other apps and the system. It shows the same interfaces as the Phone app and responds to Do Not Disturb. When a PushKit notification indicates an incoming call, you raise an action and CallKit presents the answering interface.

That native feel is the feature and the hazard at once. Calls placed through CallKit can be written into the system recents list unless you turn that off, and a Call Directory extension supplies caller ID from your service. Anything that surfaces a patient name outside your own screens is a disclosure nobody designed. A secure calling app for healthcare shows a role or a case reference instead, on every surface.

Android has its own version through the Telecom framework, where a stand-alone calling app registers self-managed connections rather than appearing inside the default phone app. Two platforms, two call stacks, and the same question on each: what does the system display when your app rings, and who else can see the screen.

Apple, CallKit documentation

Where the protected data actually lands

Write down every place one call can leave a trace, because the list is longer than the feature. The call detail record. The voicemail audio and whichever bucket holds it. Any automatic transcript, including the copy the vendor keeps. The recording, if you record. The push payload, which travels through Apple and Google infrastructure. Any contact sync that copies patient names into the device address book.

Recording deserves its own decision rather than a default. It turns a transient call into a stored file with a retention schedule, an access list and a deletion job somebody has to run. State wiretap law sits alongside HIPAA here, and some states require consent from every party rather than one. If nobody will listen back, not recording is a legitimate choice.

The same questions apply to the older channels a clinic still runs on, which is why a hipaa compliant fax app lands on the same list as the calling one. You have to know where the file sits, who can open it and what removes it. Minimum necessary is the test for every screen: a receptionist returning a call needs a callback number and a reason code, not the chart.

What you have to add to make an app ring

Here is the plain version. No AI app builder gives you voice calling, and Newly is no exception: it writes a React Native and Expo project, and its backend covers sign-in, an API service, a Postgres database and file storage. There is no telephony in it, no built-in calling and no built-in payments. If the app has to ring, the calling is something you bring and wire in yourself.

In parts, a HIPAA compliant voice app needs a media path, usually WebRTC or SIP. Signalling to set calls up and tear them down. A push path that wakes the app so it can ring, which is PushKit on iOS and a high priority message on Android. Registration with CallKit and the Android Telecom framework so the call looks like a call. Relay servers for connections that cannot be made directly. And a business associate agreement with whoever carries the media and stores the voicemail, usually discovered late, when procurement asks.

If the call carries video, a booked slot and a clinician at the other end, you have moved into telehealth app development, which stacks consent, state licensure and a waiting room on top. The calling layer gets more visible, not easier.

What each approach gives a clinical team

Approach	Rings like a real call	Call log you control	Voicemail you control	Fits your own workflow
Personal mobile, direct dial	Yes	No	No	No
Shared ward handset	Yes	no per user identity	No	No
Consumer VoIP or chat app	Yes	held by the vendor	held by the vendor	No
Healthcare communications platform	Yes	Yes	Yes	generic
A calling app you build	with a voice provider	Yes	Yes	Yes

Building one around your own service

Healthcare communications platforms are real products, priced for a hospital: per user per month, with directory integration and an on-call schedule in the box. A single clinic or an out of hours rota needs a narrow slice of that, plus one or two things the platform will not do. A rota that changes on Thursdays. A patient reference format that matches the practice management system.

Newly is an AI app builder. You describe the app in plain English and it writes a real React Native and Expo project you own, runs it on a cloud simulator while it builds, and ships iOS builds to TestFlight through App Store Connect using your own Apple Developer account. On Android the Deploy tab builds, signs and uploads to Google Play internal testing in one press, and it can also build a standalone release APK you install directly. Plans start at $25 a month and there is no free plan. Code comes out with npm i -g @newly/cli and then newly pull, so adding a voice SDK by hand is on the table.

The directory, the rota, the reason codes and the audit log are all things you can build. How a multi-party call is set up, held together and handed over is a different piece of engineering, and it belongs to the call itself rather than to the app wrapped around it.

Questions people ask about HIPAA compliant phone apps

No app is compliant on its own; the organisation using it is. The technical safeguards in 45 CFR 164.312 have to be satisfied around every part of the call: unique identification per user, an audit trail, authentication, and protection in transit. Add a signed business associate agreement with every vendor that touches the audio, the voicemail or the transcript.

Describe the calls your service actually makes

Write down who rings whom, what the person answering needs to see, and what the call is allowed to leave behind. Then build the app around that list.

Start building