HIPAA-compliant phone systems and VoIP: vendors with a BAA compared

Of six phone vendors compared here, five offer a BAA only for named plans or products, and only once it is signed: Google Voice, Dialpad, Nextiva, RingCentral and Vonage. Grasshopper does not offer one. A phone system touches PHI through voicemail, recordings, transcripts, SMS and fax. So the useful question is not "is the vendor compliant" but "does the BAA cover this feature on my plan."

This page reports published BAA terms. It is not legal advice and not an audit of any vendor.

Quick answer: which phone vendors offer a BAA

Browse other tool types in HIPAA-compliant software by category.

Vendor	Verdict	BAA from plan	How to get it	Pricing from
Google Voice	conditional	Google Voice for Google Workspace (Starter, Standard, Premier licenses) on a Workspace account whose administrator has accepted the Google Workspace BAA	Workspace super administrator accepts the BAA in the Admin console	$10 per user/month (Starter), in addition to a Workspace subscription
Dialpad	conditional	All paid Dialpad accounts (Connect Standard, Pro, Enterprise; Dialpad Support; Dialpad Sell)	Company Admin signs online in the Admin Portal	$15 user/month (Connect Standard)
Nextiva	conditional	Nextiva HIPAA-compliant ("HC") offerings designated on the quote	Through Nextiva sales	Not published by the vendor
RingCentral	conditional	Paid RingEX plans	Request through the RingCentral sales or account team	Not published by the vendor
Vonage	conditional	Vonage Communications APIs, Enterprise accounts (Video, Voice, Messages, Verify)	Contact your Vonage account manager or sales representative	Not published by the vendor
Grasshopper	no	No BAA offered	Grasshopper points customers to GoTo's healthcare products	Not published by the vendor

"Conditional" means a BAA exists, but only for named plans or services and only after it is signed. It does not mean every feature on that plan is covered.

Disclosure: this directory is published by Chanty, Inc. Chanty is not a phone vendor and is not in this table. Placement in any table here never depends on payment or on Chanty's interest.

What counts as PHI in a phone system

Each of these can be PHI when tied to a patient:

• Voicemail audio and its transcript.
• Call recordings.
• SMS and MMS threads.
• Faxes.
• Caller logs, such as a number matched to a patient record.

Picture a front desk that returns a voicemail from a patient asking about lab results. The audio file, the auto-generated transcript, the voicemail-to-email copy and the missed-call notification on a phone lock screen all hold PHI.

The vendor must sign a BAA that covers those features on your plan. SMS to patients is often excluded or needs a separate agreement. The most common exclusions are SMS, call recording and AI transcription features. A signed BAA for "voice service" does not automatically extend to them.

For background, read what a business associate agreement covers and what "HIPAA compliant" actually means. The second explains why this directory writes "BAA available on plan X for services Y" and never "vendor X is HIPAA compliant." The HIPAA requirement for business associate contracts sets the required contract content.

BAA by vendor and plan

Each entry gives the plan or product covered and how the BAA is signed. For vendors beyond phone systems, see Is it HIPAA compliant? All vendors.

Google Voice. Covered: Google Voice for Google Workspace on Starter, Standard and Premier licenses, on a Workspace account whose administrator has accepted the Google Workspace BAA. A super administrator reviews and accepts it in the Admin console (Account settings > Legal and compliance) before any PHI is used. Pricing starts at $10 per user/month for Google Voice Starter, on top of a Workspace subscription. Google lists "Google Voice (managed users only)" as Included Functionality under the BAA. It does not break out individual Voice features such as voicemail, transcription or SMS, so coverage of those is unknown.

Dialpad. Covered: all paid accounts (Dialpad Connect Standard, Pro, Enterprise; Dialpad Support; Dialpad Sell). The Company Admin signs online: Admin Portal > choose office > Privacy and Legal > Business Associate Agreement for HIPAA > Sign and Review > Accept. Connect Standard starts at $15 user/month.

Nextiva. Covered: only the HIPAA-compliant ("HC") service offerings designated on your quote. These are NextivaONE, Nextiva Contact Center, NEXT, XBert AI, and the Core / Engage / Power Suite (NextivaCx). You obtain an HC offering through Nextiva sales and enter into a BAA. Pricing is not published by the vendor.

RingCentral. Covered: paid RingEX plans. RingCentral makes its BAA available to paying Covered Entity customers; request it through your sales or account team. Pricing is not published by the vendor. RingCentral's HIPAA document lists Fax, RingEX, RingCX, Contact Center, Engage Digital (third-party channel communications excluded) and named AI products (AI Conversation Expert, AI Quality Management, AIR Pro, AI Receptionist, AI Supervisor Assist, AI Agent Assist) as covered. It does not mention SMS, call recordings or voicemail, so coverage of those is unknown.

Vonage. Covered: Vonage Communications APIs on Enterprise accounts (Video, Voice, Messages, Verify). You contact your account manager or sales representative to review and sign the BAA. HIPAA features are then activated per API, and covered numbers are designated. This is an API BAA. It should not be read as covering Vonage Business Communications products. Vonage's HIPAA page describes only the programmable Video, Voice, Messages and Verify APIs, applies BAA coverage to U.S. traffic only, and does not mention Vonage Business Communications. Pricing is not published by the vendor.

Grasshopper. No BAA. Grasshopper directs customers who require one to contact support and to GoTo's healthcare products. GoTo's Business Associate Addendum forms part of the customer's Agreement with GoTo and takes effect when the customer signs an Order incorporating it or uses the Services after it is posted. It does not list covered products, so it does not by itself show that Grasshopper is covered.

Controls compared where vendors publish them

"Not published by the vendor" means the vendor's BAA and trust pages do not state it. It does not mean the control is absent.

Vendor	Encryption at rest	Audit log	SSO	SOC 2	Data residency
Google Voice	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
Dialpad	Yes	Not published by the vendor	Yes	Yes	Not published by the vendor
Nextiva	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor
RingCentral	Yes	Yes	Not published by the vendor	Yes	Not published by the vendor
Vonage	Yes	Yes	Not published by the vendor	Not published by the vendor	U.S.-based region selectable for storing and processing PHI
Grasshopper	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor	Not published by the vendor

Points worth noting:

• Vonage lets you select a U.S.-based region for storing and processing PHI.
• Dialpad publishes SSO and SOC 2.
• RingCentral publishes an audit log and SOC 2.

A control listed here does not prove that the feature you plan to use is inside the BAA. A vendor can hold SOC 2 and still exclude SMS or AI transcription from its agreement.

HIPAA-compliant voicemail and voice messages

No vendor's published BAA terms state whether the agreement covers voicemail audio, voicemail transcription or voicemail-to-email. For those features the verdict is unknown until you read the agreement or its service list.

For shared or group-practice voicemail, such as a front-desk box several staff can open, settle these before go-live:

• Access: who can listen, and whether a departing employee's access ends the same day.
• Retention: how long audio and transcripts are kept, and whether you can delete them.
• Forwarding: whether audio is emailed to a mailbox, and whether that mailbox is under its own BAA.

Checklist for the boundary:

1. Voicemail-to-email: does an attachment or transcript leave the phone vendor's BAA scope?
2. Transcript storage: where is the text kept, and is transcription a separate feature in the agreement?
3. Mobile notifications: do push previews display message text on a locked phone?
4. Personal devices: is voicemail played on unmanaged phones?
5. Voice-message features in chat or collaboration apps: are they covered by that vendor's BAA?

Unified communications, call monitoring and conversation intelligence

Unified communications. A suite name is not a scope. Confirm in writing that the BAA covers each module you will turn on: voice, video, messaging and contact center. Nextiva shows why: its BAA applies to designated HC offerings. Vonage's applies to specific APIs.

Call monitoring and recording. Recordings are PHI when tied to a patient. Notice and consent rules vary by state. If you route high-volume lines through a contact center, compare HIPAA-compliant call center vendors as well.

Conversation intelligence and AI call auditing. These tools analyze recordings and transcripts. Ask whether the AI feature itself and any third-party model are inside the BAA scope. If the vendor's published terms do not say so, the verdict for that feature is unknown. A tool that handles PHI on your behalf is generally a business associate and needs its own BAA.

PCI is separate. HIPAA and card-data rules are different regimes. A BAA does not address payment card handling, which matters if the same recordings capture card numbers during billing calls.

How to evaluate a vendor yourself

1. Get the BAA text, not the marketing page.
2. Match the covered services in it to the features you will actually use: voicemail, transcription, recording, SMS, AI.
3. Check the plan. Dialpad covers paid accounts, RingCentral covers paid RingEX plans, and Google Voice depends on the Workspace BAA being accepted.
4. Confirm exclusions in writing.
5. Record the vendor, plan, BAA date, covered services and exclusions in your vendor inventory.

Under shared responsibility, the customer configures access, trains staff, offboards users and manages devices. Signing the BAA before PHI enters the system is also the customer's job.

Questions for sales:

• Is SMS to patients covered, or does it need a separate agreement?
• Are call recordings and their storage covered?
• Is AI transcription or summarization covered, and which third-party models or subprocessors process the audio?
• Which regions store PHI?
• Can we get the subprocessor list and notice of changes?

Related categories and the team-chat question

Adjacent PHI paths have their own tables: HIPAA-compliant online fax services and HIPAA-compliant answering services.

Internal staff messaging is a different category from phone systems. Chanty, which publishes this directory, offers a signed BAA from its Business plan for staff communication only. The Free plan has no BAA. Chanty is not a phone system or a patient messaging tool, and a BAA alone does not make an organization HIPAA compliant. Its BAA coverage of AI agents, external models and third-party integrations is not documented. Chanty's healthcare page states that HIPAA compliance and a signed BAA are included from the Business plan, with Enterprise adding a negotiated MSA alongside the BAA.

For a deeper explainer on the lead topic, see the HIPAA phone systems guide, published by Chanty.

FAQ

Is there a HIPAA-compliant voicemail service?

Several vendors above offer a BAA for paid plans, but no vendor's published terms confirm that voicemail audio and transcripts are covered. Treat voicemail as unknown until the BAA's service list says so.

Does a BAA cover voicemail transcription and call recording?

Not automatically. SMS, call recording and AI transcription are the features most often excluded or placed under separate terms. Read the covered-services list for your plan.

Can I text patients from a VoIP system under a BAA?

Only if the BAA covers SMS on your plan. It is often excluded or needs a separate agreement. RingCentral's HIPAA document does not state whether SMS is covered, so confirm SMS coverage in your BAA. Separately, TCPA consent rules apply to text messages as well as voice calls. Those rules govern patient consent, not BAA coverage.

Is Google Voice HIPAA compliant?

Does Grasshopper sign a BAA?

Verdict: no. Grasshopper directs customers who require a BAA to contact support and to GoTo's healthcare products.

Do I need a BAA for call monitoring or conversation intelligence tools?

Generally yes, if the tool receives or processes recordings or transcripts containing PHI on your behalf. Also confirm whether the vendor's own BAA covers its AI features and any third-party model.

What does "conditional" mean in the verdict?

A BAA exists, but only for named plans or services and only once signed. Features outside that scope, such as SMS or AI, may still be excluded.

Sources and last verified