HIPAA Call Recording Retention Requirements

Before you start

HIPAA itself does not set one universal retention period for recorded calls. The general HIPAA retention requirement applies to documentation of policies, procedures, risk assessments, and designated record sets for six years from the date a policy or record was created, or from its last effective date. Whether a call recording is a designated record set depends on what the recording contains and how the covered entity or business associate uses it. If a recording is part of the patient's medical or billing record and used to make decisions about the individual, retention may need to follow the same six-year rule. If the recording is kept only for quality assurance, training, or security purposes, it may be outside the designated record set and subject to a separate retention policy.

State laws can impose longer or more specific retention periods, so a compliant policy must consider the strictest applicable rule. Confirm whether the recording system stores calls locally on a device or in a service before you configure retention. A recorder that saves files on an office computer gives you direct control over deletion and backup. A cloud-based phone, video, or contact center service may apply its own retention settings, storage locations, and access controls. Do not assume that deleting a local copy also deletes every service-side recording or transcript.

Step-by-step instructions

The exact menu path depends on the calling platform, so use these steps as a guide and match them to the system you administer.

• 1. Identify the recording scope. Determine whether the system records inbound calls, outbound calls, video visits, voicemail, or screen activity. Treat any portion containing protected health information as a PHI recording.
• 2. Classify the recording. Decide whether it belongs in the patient's designated record set or is an operational recording used for training, QA, or security. Record this classification in the retention policy instead of deciding case by case.
• 3. Check the platform retention setting. In the phone or video service, open the recording, compliance, data retention, or storage section. Look for the number of days or years recordings are kept and set it to the period selected by your organization.
• 4. Disable automatic deletion if the recording belongs in a designated record set and must remain available for six years or longer. If the platform cannot guarantee that period, plan to export recordings to a controlled archive.
• 5. Configure access controls. Limit playback, download, export, and deletion rights to authorized staff. If the service has an audit log, enable it for recording access and deletion events.
• 6. Set up export or archival where required. For long-term retention, route recordings and any call metadata into encrypted storage that supports the required retention schedule and access review.
• 7. Write the deletion rule. For operational recordings that are not part of the designated record set, define the retention window, review cycle, and deletion method. The policy should state who deletes the file, when, and how deletion is verified.
• 8. Apply the same controls to backups and derivatives. Transcripts, call summaries, voicemail files, and recorder backups can contain PHI and must follow the same retention and deletion schedule.

Check the output

Verify that the retention setting matches the chosen schedule and that it applies to every location where the service stores recordings. If the platform keeps files in a recycle folder, trash, or secondary backup, confirm that those copies are covered by the policy. Check the recording format and related metadata: audio quality, channel count, transcript availability, call direction, date, time, participants, and any attached patient identifier should be visible to an authorized user without requiring another unapproved tool.

For recordings that must be preserved, confirm that export does not strip security controls or place files into unauthorized cloud storage. For recordings subject to deletion, perform a test deletion and confirm that the item is not recoverable through the normal service interface. Do not treat a partial check as proof that all copies were removed. If the platform cannot show a deletion confirmation or retention log, document that limitation and use a controlled archive where deletion can be verified.

Common problems and next steps

The service keeps recordings longer than the policy allows

Find the longest available retention option and set it to the shortest period that still meets HIPAA and state requirements. If the service only offers a longer fixed window, export the recordings to controlled storage, delete them from the service when the policy allows, and apply the correct deletion schedule in the archive. Always reconcile service-side trash or backup retention because some platforms retain deleted recordings for a separate recovery period.

A recording contains PHI but is outside the designated record set

The recording still requires HIPAA safeguards such as access controls, encryption in transit and at rest, audit controls, and a defined retention and disposal process. The distinction affects the retention basis, not whether the recording must be protected. Label the storage container so operators can see which schedule applies.

Retention settings differ across devices and services

A desktop recorder, mobile app, phone system, and cloud meeting service may each keep a separate copy. Inventory every system that can capture voice or video and confirm that each one has retention, access, and deletion controls. If one component does not provide suitable controls, disable recording in that component or replace it with an approved recording path.

If the platform does not give you enough control to meet the six-year documentation or designated record set requirement, move the affected recordings into a HIPAA-compliant archive that supports scheduled retention, access logging, encryption, and verified deletion. Then document the platform limitation in the retention procedure so staff do not rely on the service alone.