Arlington, TX
HIPAA-Compliant Call Recording for Arlington TX Clinics
When an Arlington practice asks whether a phone system can record calls in a way that works for a medical office, the question is usually aimed at the vendor. It is the wrong half of the question.
Book a Demo
The vendor half is answerable and, in this case, settled. Cleod9 will enter into a business associate agreement, through Wildix, the platform the service runs on. That agreement covers voice, voicemail, video, call recording and transcription. It does not cover SMS text messaging, which sits outside it. Recordings are held in the platform's AWS environment, and the practice chooses how long they are kept, from one week up to ten years. Wildix has completed SOC 2 Type 1 and Type 2 audits, encrypts call media with DTLS-SRTP and protects signaling and web traffic with TLS.
That is the part a practice can buy. The rest of it is not purchasable, and it is where every real problem lives: what gets recorded, who can listen to it later, how long it is kept, what patients are told, and who at the practice is responsible for any of that being true next year.
This page is about that second half. It is operational guidance, not legal or compliance advice. A signed agreement and an audited platform are necessary, and they are not sufficient. What a practice must do under HIPAA is a question for its own privacy officer or counsel, and nothing here substitutes for that.
What the agreement does and does not do
A business associate agreement is a contract about how a vendor handles protected information on the practice's behalf. It obliges the vendor. It does not describe the practice.
Reading it that way prevents the most common mistake, which is treating the signature as the end of the project. The agreement says what happens to the data once it reaches the platform. It says nothing about whether the practice recorded a call it should not have, left playback open to the entire staff, or kept four years of audio nobody could justify holding.
Two specifics are worth writing on the wall before anything is switched on. Text messaging is outside the arrangement, so patient information does not travel that way. And the agreement covers the platform, not the practice's own devices, its network, or the laptop somebody plays a recording back on in an open office.
Get it signed before you record anything
The sequence matters. The agreement is executed first, then recording is configured, then the first call is captured. Practices that reverse this end up with an archive that predates the arrangement and a question they cannot answer cleanly.
Decide what is recorded, not whether recording is possible
The platform supports both automatic recording and recording a user starts by hand, and it offers three modes: record and transcribe, record only, or transcribe only. That is a menu of decisions, not a setting to leave at its default.
Recording everything is the easiest configuration and the hardest one to defend. Every additional recording is another thing to store, another thing to secure, another thing to find if somebody asks, and another thing to delete correctly. Volume has a cost even when the storage is cheap.
The practical way to decide is by asking what the recording is for, line by line:
- Calls where the practice needs an accurate record of what was arranged, such as scheduling and instructions given over the phone.
- Calls used for training new staff, where the value is in hearing how something was handled.
- Calls that are likely to be disputed later, such as anything involving a complaint or a difficult conversation.
- Calls where recording adds nothing: routine confirmations, internal transfers, calls that never reach a person.
Most practices that go through this honestly end up recording a narrower set than they assumed, and feel better about the set they keep.
Transcription is a separate decision
A transcript is easier to search than audio, which is exactly why it deserves its own thought. A searchable text record of patient calls is more useful to the practice and more consequential if it is exposed. Decide whether a given line needs audio, text, both, or neither, rather than enabling transcription everywhere because it is available.
Retention, chosen with a reason
Retention can be set anywhere from one week to ten years. That range invites a bad habit, which is picking the longest option because it feels safest.
Longer is not safer. A recording the practice no longer has any use for is pure exposure: it can be requested, it can be breached, it has to be secured, and it has to be searched if anything is ever disputed. Keeping ten years of routine scheduling calls protects nobody.
Set the period by asking what the recording is for and how long that purpose lasts. A call kept to confirm what was scheduled has a useful life measured in weeks or months. A call kept because a complaint is open has a life tied to that matter. Those are different answers and the platform allows different treatment.
Write the chosen period down along with the reason for it, and review both once a year. A retention setting nobody can explain is one that will be changed by whoever next has the login, or left alone for a decade by default.
Access is where this usually goes wrong
The question of who can play a recording back gets less attention than whether recording happens at all, and it is the question that matters more.
The default drift is in one direction. Access is granted when somebody needs it for a specific reason, and it is almost never removed when that reason ends. Eighteen months later a practice discovers that six people can listen to any patient call, and nobody can say why four of them can.
The discipline that works is the one used for keys. A short written list of who has playback access and why. A check on that list whenever someone joins, leaves or changes role. And a habit of treating the addition of a new name as a decision rather than a convenience.
Where playback happens is part of access
A recording played back on speaker at a front desk in earshot of the waiting room has been disclosed regardless of how well the platform protected it. Part of the practice's own policy should say where playback is appropriate, which is generally a private space with a headset.
What patients are told
Texas is a one-party consent state for recording a conversation, which means the legal floor is low. The floor is not the standard a medical practice should be working to.
There is a practical reason beyond principle. A patient who learns later that calls were recorded without any notice feels misled, and that feeling attaches to the practice rather than to the recording policy. A patient told plainly at the start of the call generally does not think about it again.
A single sentence in the greeting does the work, stating that calls may be recorded and why, in plain language. If the practice offers any way to speak without being recorded, say so in the same breath. Keep it short, because a long disclosure at the front of every call is a cost paid on every call forever.
The exact wording, whether notice is sufficient in the practice's situation, and what has to appear in the notice of privacy practices are questions for the practice's privacy officer or counsel to answer. The operational point is that the answer should be decided deliberately and then said the same way every time.
The written policy, in one page
Everything above becomes durable only when it is written down. One page is enough, and a practice that has it can answer almost any question about its recordings in a minute.
- Which lines and which situations are recorded, and in which mode.
- What is never recorded, stated explicitly.
- How long recordings are kept, and the reason for that period.
- Who can play recordings back, by name or by role, and who approves additions to that list.
- Where playback is permitted, and the requirement for a headset in shared space.
- What patients are told, in the exact words used.
- What happens when a patient asks for a copy or asks that a recording be deleted, including who decides.
- Who owns this page, and the date it was last reviewed.
The last line is the one that keeps the other seven true. A policy with no owner is accurate on the day it is written and slowly stops describing the practice.
Questions to put to any vendor in writing
Cleod9 has answered these, and they are the right questions for any provider a practice is considering, so they are worth asking explicitly and keeping the answers.
- Will you enter into a business associate agreement, and which services does it cover?
- Which services are excluded from it?
- Where are recordings stored, and under whose infrastructure?
- What retention periods can we choose, and can we change them later?
- Who on your side can access our recordings, and under what circumstances?
- What independent audits or attestations do you hold, and can we see the report?
- How is call audio protected in transit?
- What happens to our recordings if we leave, and can we export them first?
Answers in writing, kept with the agreement, are worth considerably more than the same answers given on a call.
Common questions
Does signing the agreement make the practice compliant?
No. It settles the vendor's obligations for the data it handles. Whether the practice as a whole meets its obligations depends on the practice's own policies, configuration, training and workflow, and that determination belongs to its privacy officer or counsel.
Can patient information be sent by text under this arrangement?
Text messaging sits outside the business associate agreement, so patient information should not be handled that way. Texting still has a place for appointment reminders and logistics that name no clinical detail, and where the practice uses it, the patient has to have agreed to receive messages and a request to stop has to be honored promptly.
Should every call be recorded?
Rarely the right answer. Recording is most defensible when the practice can say what a given recording is for. Automatic recording on a defined line is a reasonable choice; automatic recording of everything usually is not.
What if a patient asks for a copy of a call?
Decide the process before it happens: who takes the request, who decides, how the recording is delivered, and what is logged. Whether the practice must provide it is a question for its privacy officer or counsel, but having no process is what turns a simple request into a problem.
Who should own the recording policy in a small practice?
One named person, usually whoever handles privacy matters generally. It does not need to be a large role. It needs to be an assigned one.
Turning it on without turning on everything
The sequence that works is deliberately unhurried, and it takes about two weeks of calendar time rather than two weeks of work.
- Execute the business associate agreement and file it where the practice can find it.
- Write the one-page policy above, in draft, before touching any settings.
- Have the practice's privacy officer or counsel read the draft, particularly the notice wording and the retention period.
- Configure recording on one line or one situation only, in the narrowest mode that serves the purpose.
- Set the retention period deliberately rather than accepting a default.
- Set the playback list to the smallest number of people that works, and write down why each is on it.
- Run it for two weeks, then listen to what was actually captured and check it matches the policy.
- Widen it only where the two weeks showed a real gap.
Practices that start narrow almost always end up with a policy they can defend and an archive they can use. Practices that enable everything on day one spend the following month switching things off and are never quite sure what is in the archive.
The parts of a call nobody meant to capture
A recording is rarely just the conversation. It picks up whatever the microphone can hear for as long as the line is open, and practices are regularly surprised by what that includes.
Three situations account for most of it. A call placed on hold where the staff member forgets the caller is still connected. A transfer where the two staff members discuss the patient before the transfer completes. And the caller who keeps talking after the business of the call is finished, which in a medical office frequently means describing something clinical nobody asked about.
The fixes are mundane and they work. Staff should know which lines are recorded, so they behave as though they are. Discussion between staff about a patient belongs on a separate internal path rather than in front of a caller on hold. And where the platform allows a recording to be paused, the people answering should know how and when to use it.
Add one line to the policy covering this, and mention it when the policy is introduced. It is the single most useful thing to tell the people who actually answer the phone.
When someone leaves the practice
Staff changes are the moment a recording arrangement quietly stops matching reality, and they happen more often than the annual review does.
Three things need doing the same week. Playback access is removed, not merely disabled in principle. Any recording that lived on that person's device rather than in the platform is accounted for. And if the departing person was the one who owned the policy, the ownership moves to somebody by name rather than becoming vacant.
The same applies in reverse when somebody arrives. A new staff member should be told what is recorded and why during their first week, not discover it from a colleague six months in.
Attach the check to whatever the practice already does when people join or leave. A recording policy that depends on somebody remembering to look at it is one that will be accurate for about a year.
Talking to Cleod9
Cleod9 is a Dallas-Fort Worth provider supporting its own customers, so an Arlington practice works with someone in the same metro rather than a distant queue. The platform, including voice, video, messaging and mobile access, is described on the Cleod9 services page.
On this subject specifically, ask for the business associate agreement in writing before anything is configured, confirm what it covers and what it excludes, and settle the retention period and the playback list as part of the setup rather than afterward. Then take the practice's own policy draft to its privacy officer or counsel, who decides what the practice is required to do.