How scammers get your phone number, and how to make it harder
Your number leaks from more places than you think. Here is where it actually comes from and what you can realistically do about it.
HIPAA compliant phone number: what to look for
No phone number is HIPAA compliant on its own. What matters is whether the provider will sign a BAA — and most consumer apps will not. Here's how to check.
If you are a therapist, counsellor, physician or anyone else handling patient information, you have probably searched for a HIPAA compliant phone number and found a lot of services claiming to be one.
Start here, because it reframes the whole search: a phone number cannot be HIPAA compliant. Compliance is a property of how an organisation handles protected health information, not a feature of a product. What you are actually looking for is a provider willing to take on legal responsibility for handling it.
That distinction is the difference between a service that protects you and one that just says reassuring things on its pricing page.
The thing that actually matters: a BAA
Under HIPAA, any vendor that handles protected health information on your behalf is a business associate, and you need a Business Associate Agreement with them. The BAA is a contract in which the vendor accepts its own obligations and liability.
A phone provider carrying calls, voicemails and texts with patients is handling PHI. Without a signed BAA, using it for patient communication puts the compliance failure on you.
So the first question for any provider is not "is this encrypted" or "is this secure". It is: will you sign a BAA?
Most consumer-grade apps will not. That is not a criticism of them — they are not built for it — but it does rule them out, however good the privacy features are.
Why clinicians want a separate number at all
Compliance aside, the reasons are practical and most practitioners hit them in the first year.
Boundaries. A personal mobile number in a client's phone is available at 2am. Having a line you can switch off at six is not coldness; it is the thing that makes the work sustainable.
Professional separation. Several professional bodies have views on how and when clients should be able to reach you. A dedicated line makes that policy enforceable rather than aspirational.
Continuity. If you join or leave a practice, the line goes with the role rather than with you personally.
Records. Clinical communication kept separate from personal messaging is easier to handle correctly — and easier to produce if you are ever asked to.
What to check before you sign up
- Will they sign a BAA? Ask directly. If the answer is anything other than a straightforward yes with a document attached, the service is not suitable for patient communication.
- Is the BAA included or extra? Some providers offer it only on higher tiers. Know which plan you actually need.
- What is retained, and for how long? Call logs, recordings, voicemail transcripts and message history all count. You need to know what exists and where.
- Can you delete records? Retention policy matters as much as encryption.
- Who at the vendor can access content? Support staff reading voicemails is a different risk profile from staff who cannot.
- Is voicemail transcription done in-house or by a third party? If a subcontractor transcribes a patient's voicemail, that subcontractor is handling PHI too.
- Where is data stored? Jurisdiction affects both HIPAA and, if you have Canadian or European patients, other regimes.
What does not make something compliant
Worth naming, because these get marketed as if they settle it:
- Encryption alone. Necessary, nowhere near sufficient, and almost universal anyway.
- "HIPAA-ready" or "HIPAA-friendly". These phrases mean nothing. The question remains whether they sign.
- A privacy policy. Not a BAA.
- Being a second number. Separating your lines is good practice and good for boundaries. It is not compliance.
A note on what we publish
PhoneHub is published by AffinityClick, which also builds Hushed, a second phone number app. Hushed is built for privacy and separation, and clinicians do use second numbers for exactly the boundary reasons above.
But we are not going to tell you it solves HIPAA, because that depends entirely on a BAA and on your own practices, and claiming otherwise about any provider — ours included — would be the exact thing this article warns against. Ask any provider you are considering, including us, whether they will sign a BAA, and make your decision on the answer.
The short version
A separate professional line is worth having regardless — for boundaries, continuity and sanity.
If it will carry patient information, the only question that decides it is whether the provider signs a BAA. Everything else on the feature list is secondary, and this is not an area to take a marketing page's word for.
