HIPAA's Security Rule requires covered entities to protect electronic Protected Health Information (ePHI) in transit — and voice calls that involve patient information are in scope. If your VoIP infrastructure carries clinical communications, appointment reminders, or any conversation where PHI might be disclosed, HIPAA applies. Here's what engineers need to know.
HIPAA's Security Rule (45 CFR 164.312) applies to ePHI — electronic Protected Health Information. PHI includes any individually identifiable health information: patient names, diagnoses, appointment details, treatment information, billing information, and more.
VoIP infrastructure is in scope when it carries:
This covers not just the call itself but the signaling infrastructure — SIP servers, SBCs, PBX systems, voicemail, call recording platforms, and any system that stores or transmits call metadata (call logs, CDRs) that could identify a patient and their healthcare interaction.
The Security Rule doesn't mandate specific technologies, but it requires "reasonable and appropriate" safeguards. For VoIP, regulators and auditors expect:
All SIP signaling on external network segments must use TLS 1.2 or higher (port 5061). TLS protects caller identity, called number, call metadata, and any information in SIP headers from interception. Self-signed certificates are technically permissible for internal infrastructure but publicly trusted certificates are expected for carrier and third-party connections.
All RTP media streams on external segments must use SRTP. Without SRTP, anyone who can capture network traffic can listen to call content. SDES key exchange is acceptable when combined with TLS. DTLS-SRTP provides independent media encryption not reliant on signaling security.
Recorded calls stored as audio files must be encrypted at rest using AES-128 or AES-256. Access must be authenticated and logged. Cloud storage of recordings requires a Business Associate Agreement (BAA) with the storage provider.
Calls that never leave your physically controlled network (internal LAN/VLAN) are lower risk but should still be encrypted if the network carries other non-HIPAA traffic or if there is any risk of unauthorized network access. Zero-trust architecture eliminates the "internal network is trusted" assumption entirely.
A HIPAA VoIP audit should cover:
SIPSymposium's Teams tier includes compliance reports that map encryption and security findings from your SIP traces directly to HIPAA Security Rule controls. Upload a PCAP or paste a trace and export an audit-ready PDF showing which controls are satisfied and which require attention.
This is particularly useful for demonstrating due diligence during a HIPAA audit or risk assessment — giving auditors specific technical evidence that your VoIP infrastructure encrypts ePHI in transit.
VoIP systems are subject to HIPAA when they carry calls involving Protected Health Information — patient appointments, clinical communications, billing calls where patient identity is confirmed. HIPAA Security Rule 164.312(e)(2)(ii) requires encryption of ePHI in transit, which means TLS for SIP signaling and SRTP for media on all external call legs.
HIPAA requires TLS 1.2 or higher for SIP signaling on all external segments, SRTP for RTP media streams, and AES-128 or AES-256 encryption at rest for call recordings. Self-signed certificates are technically permissible for internal infrastructure but publicly trusted certificates are expected for carrier and third-party connections.
Yes — any third-party vendor that handles ePHI on your behalf requires a Business Associate Agreement. This includes your SIP trunk provider, cloud PBX vendor, and call recording platform. Review each vendor's BAA availability before using them in a HIPAA-covered deployment. Many major providers offer BAAs — confirm before signing up.
Run your SIP traces through SIPSymposium. The Teams tier compliance report maps encryption findings to HIPAA Security Rule controls and exports an audit-ready PDF you can hand directly to your compliance team.