Guide

The practice line: VoIP, BAAs, and never your cell number

Summary

By Gale Editorial · Updated 2026-07-27. Every figure cited to a dated source. How we write.

What phone setup does a practice need?

A solo practice needs a dedicated business phone line — a VoIP number separate from the owner's personal cell — routed through a vendor willing to sign a business associate agreement if voicemail transcription, call recording, or an answering service will touch any message that could contain protected health information. Any vendor creating, receiving, maintaining, or transmitting PHI on the practice's behalf, including a voicemail-to-text or answering service, is a business associate requiring that signed BAA before the line goes live 1Ref 1HHS Office for Civil Rights (2026).Business Associates.That a voicemail-to-text or answering-service vendor handling content that could contain PHI is a business associate requiring a signed BAA..

Publishing a personal cell number on intake paperwork or a website, rather than the dedicated line, is one of the most common setup mistakes in a new solo practice — it collapses the boundary between the practice and the owner's personal life the moment a patient calls or texts that number directly, and it can't be handed off or changed later without changing a number patients and referral sources already have memorized.

Why the practice needs its own number, separate from a cell phone

A dedicated practice number, whether a VoIP line or a traditional business line, keeps patient contact routed through a system the practice actually controls — one that can forward to voicemail, add an answering service, or transfer to a new owner if the practice is ever sold, none of which a personal cell number can do cleanly. It also protects the clinician's personal number from ending up in a patient's contacts or a call routed to a device with no practice coverage plan behind it.

A VoIP number is also portable in a way a number tied to a specific carrier plan often isn't, which matters if the practice relocates, changes carriers, or the clinician eventually brings on a second provider and needs calls to route differently than they did as a solo operation.

The BAA question: voicemail, transcription, and answering services

Voicemail transcription services and answering services routinely handle messages that name a patient and the reason for their call, which places them squarely inside the business-associate definition the moment that content could contain PHI — the vendor needs a signed BAA before the practice routes a single call through it. A basic VoIP dial tone with no transcription or answering-service layer carries a smaller BA footprint, but the moment any add-on feature converts a voicemail to text, stores a recording, or routes calls to a live answering service, that feature's vendor needs its own signed agreement, even if the base phone service already has one.

Reading the vendor's BAA coverage feature by feature, rather than assuming one signed agreement blankets every add-on the vendor sells, avoids discovering after the fact that the transcription feature specifically was carved out of what the base agreement actually covers.

Securing the line itself

A VoIP line lives on the same network as the rest of the practice's technology, so the access controls, encryption, and account security that protect the EHR and practice email need to extend to the phone system too — a password-protected voicemail box and a locked-down admin portal are the baseline, not an afterthought bolted on later. A VoIP line also depends entirely on the practice's internet connection, so what happens when the internet drops mid-session matters for phone reliability as much as it does for telehealth video.

HHS's 405(d) program publishes a cybersecurity baseline sized specifically for a small practice, useful for deciding what a reasonable phone-system security setup looks like without hiring an IT consultant 2Ref 2HHS 405(d) Program (2026).HHS 405(d) — Aligning Health Care Industry Security Approaches.That HHS's 405(d) program publishes a small-practice cybersecurity baseline useful for scoping a reasonable phone-system security setup., and ONC and OCR's free Security Risk Assessment tool is built for exactly this kind of solo-scale review 3Ref 3Office of the National Coordinator / ASTP (2026).Security Risk Assessment Tool.That ONC/OCR publish a free Security Risk Assessment tool sized for a small practice, usable to review a phone system's PHI exposure.. The Security Rule's administrative, physical, and technical safeguards apply to a phone system carrying PHI the same way they apply to any other system storing or transmitting it, scaled to the size of the practice 4Ref 4HHS Office for Civil Rights (2026).Summary of the HIPAA Security Rule.That the Security Rule requires administrative, physical, and technical safeguards scaled to practice size, applying to a phone system carrying PHI..

Budgeting the line and what it actually costs monthly

A VoIP line with an answering service and voicemail transcription typically costs more monthly than a bare-bones dial tone, and that gap is worth line-item budgeting into the same startup-cost worksheet used for every other recurring vendor bill, rather than discovering the real number only once add-ons are switched on 5Ref 5U.S. Small Business Administration (2026).Calculate your startup costs.SBA's method for itemizing startup costs, applied here to budgeting the monthly cost of a VoIP line with answering-service and transcription add-ons.. Comparing a candidate vendor's advertised base price against what a fully-featured setup actually costs once BAA-covered add-ons are included avoids a surprise jump in the first month's bill.

Some vendors bundle transcription and answering-service features into one tier, while others charge per add-on, so the same feature set can price out very differently between two candidates quoting a similar base rate. None of the add-on features are mandatory for every solo practice — a clinician doing all their own scheduling with no answering service needs a much simpler, cheaper setup than one running an after-hours coverage arrangement, and the phone system should match the actual practice model rather than the most feature-complete package available.

What changes when a colleague or a second location gets added

A phone system built for one solo clinician usually doesn't scale cleanly to a second provider or a second location without reconfiguring call routing, adding extensions, and revisiting who receives which after-hours calls — worth planning for even at solo launch if a second clinician joining is a realistic near-term possibility, since retrofitting call routing later is more disruptive than building it in from the start. A practice operating across two states also needs its phone setup to reflect where calls are actually answered from and routed to, a separate consideration once the practice crosses a state line rather than a phone-system detail on its own.

Most VoIP vendors handle adding an extension or a second line as a straightforward account change rather than a full re-setup, which is part of why choosing a VoIP vendor over a locked-in traditional carrier tends to age better as a solo practice grows. Keeping the phone vendor's contract and BAA on the same renewal cycle as the rest of the vendor stack — practice email, the EHR, e-fax — keeps this from becoming the one agreement nobody remembers to check.

Common questions

Many solo clinicians start this way, but it becomes hard to separate the practice from personal life once patients have the number memorized, and there's no clean way to hand it off or route it through an answering service later. A dedicated line from the start avoids that problem entirely.

Yes, if any feature — voicemail transcription, call recording, or a live answering service — could touch content containing PHI. A bare dial-tone-only line has a smaller footprint, but most practices add at least one feature that brings the BAA requirement into play.

Only when the vendor providing it is covered by a signed BAA and reasonable security safeguards, the same standard that applies to any vendor touching PHI. A free consumer transcription app with no BAA option isn't a compliant choice for a line that takes patient calls, no matter how convenient it is.

Most VoIP numbers are portable and can transfer to a new vendor, but confirm the exact porting process and expected timeline before canceling the old line, since a gap in coverage during the transfer window can mean missed patient calls at the worst possible moment.

Not necessarily a separate number, but the platform actually used for telehealth sessions carries its own distinct BAA and configuration requirements apart from the phone line — keep the two separate in planning even if they overlap in daily use.

Run your practice on Gale

The software is free. Gale earns one flat 3.5% all-in per paid transaction — only on transactions that actually pay. No subscription, no setup fee, no network cut.

Start or manage a practice →

References

1.HHS Office for Civil Rights (2026). Business Associates. U.S. Department of Health and Human Services. linkThat a voicemail-to-text or answering-service vendor handling content that could contain PHI is a business associate requiring a signed BAA.
2.HHS 405(d) Program (2026). HHS 405(d) — Aligning Health Care Industry Security Approaches. U.S. Department of Health and Human Services. linkThat HHS's 405(d) program publishes a small-practice cybersecurity baseline useful for scoping a reasonable phone-system security setup.
3.Office of the National Coordinator / ASTP (2026). Security Risk Assessment Tool. HealthIT.gov. link ✓That ONC/OCR publish a free Security Risk Assessment tool sized for a small practice, usable to review a phone system's PHI exposure.
4.HHS Office for Civil Rights (2026). Summary of the HIPAA Security Rule. U.S. Department of Health and Human Services. linkThat the Security Rule requires administrative, physical, and technical safeguards scaled to practice size, applying to a phone system carrying PHI.
5.U.S. Small Business Administration (2026). Calculate your startup costs. U.S. Small Business Administration. link ✓SBA's method for itemizing startup costs, applied here to budgeting the monthly cost of a VoIP line with answering-service and transcription add-ons.

https://www.gale.care/for-providers/spc-practice-phone-voip · 5 sources. Competitor details are cited to dated public sources and maintained as they change; figures are estimates, not commitments. Synthetic demonstration.

← Back to for providers