Recording a patient callback in an all-party-consent state

A patient calls your front desk at 4:55 PM, nobody picks up, and the call shows in the call log. The next morning someone clicks the number in the Ready Dialer, the patient answers, and the first thing out of the staff member's mouth is "Hi, this is Riverside Family Medicine, I'm returning your call about your lab results." The call is being recorded and transcribed. In about a dozen states, that opening is already a problem, because the patient hadn't been told about the recording before the conversation started.

The fix is one sentence, said first, every time. This post covers where that sentence goes, why it belongs in every callback and not just the ones you think cross into a strict state, and why the transcript that comes out the other end needs the same handling decisions as anything else in the patient record. None of this is legal advice. Recording law varies by state and changes, and your practice is responsible for its own compliance. Run your final script and policy past your counsel or compliance officer.

What the Ready Dialer actually does on a callback

Here's what the tool does, so the compliance points line up with real behavior:

• Call log: missed inbound calls show there so staff can work through them in order.
• Click-to-call from the dial pad: staff return the call from the pad in the Ready dashboard, or from inside GoHighLevel if that's where the practice works.
• Consented call recording and transcripts: when recording is on, the call is recorded and a transcript is produced.
• Inbound calls ring the open pad: if the patient calls back while a staff member has the pad open, it rings there.

The Dialer does not have auto-dialing, voicemail drop, call transfer or supervisor monitoring. Every callback is a person clicking a number and talking, so the disclosure is something a person says. The Dialer also plays a recording notice before a call is recorded, unless the account owner switched it off in Settings > Compliance > Call recording (which takes a signed statement), and a recording is kept only once the notice has finished playing. That notice does not replace your staff saying the disclosure first in an all-party-consent state. The script is the control.

Billing is $0.025 per minute, and each started minute is billed as a full minute. That matters later when we look at what the disclosure costs in airtime.

One-party vs all-party consent, in plain terms

US federal law (the Wiretap Act) and most states use one-party consent. If one person on the call consents to the recording, it's lawful, and that person can be the one recording. Your staff member is a party, so in a one-party state the practice can generally record its own calls.

A minority of states require all-party consent (sometimes called two-party consent). Everyone on the call has to consent, which in practice means everyone has to be told and given the chance to object before the recording captures the conversation. The states usually cited include California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. Several others have partial or disputed rules, such as different treatment for civil and criminal liability, or for phone calls and in-person conversations. Treat that list as a starting point for your counsel, not a final answer.

The interstate trap

Patients don't stay inside your state. A practice in Texas, a one-party state, returns a call to a patient who winters in Florida or a college student back in California. When the parties are in different states, courts have sometimes applied the stricter state's law, and California in particular has a track record of applying its rule to calls with California residents.

You often can't tell from the number where the patient physically is. A Texas area code can ring a phone in Sacramento. That's the practical argument for one policy: disclose on every recorded callback, regardless of where you think the patient is. It costs a few seconds and removes the guesswork.

Where the disclosure goes in the script

The disclosure has to come before anything substantive. That means before the reason for the call, before identity verification, and before anyone says "lab results," "appointment" or a medication name. If the recording has already captured the patient discussing their health when you mention it's recorded, the disclosure came too late to cover that part.

A workable opening:

"Hi, this is Dana calling back from Riverside Family Medicine. Before we go on, this call is recorded and transcribed for quality and for your records. Is that okay with you?"

Then wait for an answer. Silence isn't a yes. In most all-party states, continuing the call after a clear disclosure is often treated as implied consent, but an explicit "yes" is far easier to defend, and it's on the recording itself.

What each part of that sentence is doing

1. "Calling back from [practice]" identifies who's calling without revealing why. The person who answered may not be the patient.
2. "Recorded and transcribed" names both. If you only say "recorded," a patient could reasonably argue they didn't expect a written transcript of their health conversation to exist.
3. "Is that okay with you?" turns a notice into a request for consent, and the answer is captured on the recording.

If the patient says no

Decide this before the first call so nobody improvises. The call can't keep recording after a patient declines. Turn the pad's Record switch off before you redial. If your account owner set the Compliance card to record every call, the switch is locked on, so ask them to change that card before you take calls from patients who decline. Write down which path you use and train on it.

If someone else answers

A spouse, an adult child, a caregiver. Each is a party to the call, so the disclosure covers them too. It's also a second reason to keep the reason for the call out of the opening line: until you've verified you're speaking with the patient or an authorized representative, you shouldn't be naming anything clinical.

If you reach voicemail

Your side is still being captured. Keep voicemail messages free of clinical detail ("Please call Riverside Family Medicine back at..." and nothing more). It's the same discipline we cover for texts in the four fields to never put in a patient message body.

The transcript is health information now

The recording consent question ends once the patient says yes. The PHI question is just starting at that point. A callback about lab results, refills or symptoms produces a recording and a transcript full of protected health information, and both now exist somewhere outside your EHR.

HIPAA doesn't ban recording. It does mean the practice has to make the same decisions about these files that it makes about any other PHI:

• Where they live and under what agreement. Before recordings and transcripts containing PHI are stored with any vendor, confirm with that vendor, us included, whether a business associate agreement is in place and what it covers. Email support@tryready.com with the question before you switch recording on for clinical calls, not after.
• Who can see them. Front-desk staff who return calls may not need access to every transcript. Decide who has access to the Ready account, and to recordings in particular, the same way you scope EHR roles.
• Whether they're part of the record. If a transcript documents clinical information or a patient instruction, your compliance team has to decide whether it, or a summary of it, belongs in the chart. If it does, patients may have access rights to it.
• How long you keep them. Pick a retention period on purpose and write it down. "Forever by default" is a decision too, just an unexamined one. Ready keeps call recordings and transcripts while your account is active and does not delete them on a schedule. The only way to remove them is to delete the contact, which can't be undone and also deletes every text and conversation with that contact, so save anything you still need before you delete a patient whose period has passed.
• What happens on a records request. Know who pulls the recording and transcript if a patient or their attorney asks.

Transcripts are useful, for the same reasons we lay out in using consented recordings to settle disputes: they give you an exact account of what was said. In healthcare that usefulness comes with obligations, and the obligations attach the moment the file exists.

Documenting recording consent at intake

The per-call disclosure is the control that matters legally. Intake documentation backs it up and sets the patient's expectations, so the question on the phone isn't a surprise.

Add a short, dated line to your intake or registration paperwork:

"Phone calls with our office may be recorded and transcribed for quality and record-keeping. We will tell you at the start of any recorded call, and you can ask us not to record."

Then record it the way you'd record any consent:

1. A version number or date on the wording, so you can show which language a patient saw.
2. Where it's stored: in the patient's record, alongside their other consents.
3. A preference field for patients who ask never to be recorded, visible to whoever returns the calls.

That third item is where practices slip. A patient who said "don't record me" at intake still gets a recorded callback because the preference lives in the EHR and the person dialing is looking at the Ready pad. Preferences that don't travel across channels cause the same failure we describe in opt-outs that don't cross from text to calls. Make the no-record flag visible where the call is placed.

Intake consent does not replace the on-call disclosure. The intake form covers the patient as of the day they signed. It doesn't cover the caregiver who answers, and it doesn't prove the patient remembered it six months later. If you also text patients, their texting consent is a separate record with its own rules. We cover that in how to get and record patient consent to text.

What the disclosure costs in airtime

It's worth checking, because "it adds time to every call" is the usual objection. As a worked example, assume:

• 40 callbacks a day
• 25 connect, averaging 3 minutes 40 seconds of talk, which bills as 4 started minutes
• 15 don't connect, and an unconnected call isn't billed

Daily minutes: 25 × 4 = 100 minutes. At $0.025/min, that's $2.50 a day, or about $52.50 over 21 working days.

The disclosure takes about 8 seconds. It only adds a billed minute when it pushes a call past a minute boundary. If you assume that happens on roughly a quarter of connected calls (about 6 a day), that's 6 extra minutes, or $0.15 a day, around $3.15 a month. That's the price of having the patient's consent on tape at the start of every recorded call. For more on how started-minute billing shapes callback costs, see the cost-per-connect breakdown.

The checklist to hand your front desk

• Say the disclosure first, before the reason for the call and before verification, on every recorded callback.
• Name both recording and transcription, and wait for a spoken yes.
• Have a written no-recording path for patients who decline.
• Disclose to whoever answers, not only the patient.
• Keep voicemails free of clinical detail.
• Check the patient's no-record flag before dialing.
• Have your compliance lead settle where transcripts live, who sees them, how long they're kept, and whether a BAA covers them, before recording goes live on clinical calls.

The short version

Recording patient callbacks is useful and lawful when it's done in the right order. The order is: disclose, get consent, then talk. Use one script for every call, because you can't reliably tell where the patient is standing. Treat the transcript as health information from the moment it exists, and keep a dated intake record so the question on the phone is something the patient has already heard.

If you're setting up the Ready Dialer for a practice and want to confirm how recording and transcripts are configured before you go live, start from Ready's features, and email support@tryready.com with any PHI-handling questions first. For the texting side of the same practice, our healthcare SMS compliance guide covers TCPA, HIPAA and consent for messages.

Frequently asked questions

Which states require all-party consent to record a phone call?

The states usually cited as all-party consent states are California, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington. Several others have partial or disputed rules, such as treating civil and criminal liability differently, or treating phone calls differently from in-person conversations. A patient's area code doesn't tell you where they're standing, so it's simpler to disclose on every recorded callback. Treat any state list as a starting point for your counsel, not a final answer.

Can a medical practice record patient phone calls under HIPAA?

Yes. HIPAA doesn't ban recording patient calls, but the recording and transcript become protected health information the moment they exist. The practice has to decide where the files live and under what agreement, who can see them, whether they belong in the chart, how long they're kept and who pulls them on a records request. Before turning recording on for clinical calls, confirm with the vendor whether a business associate agreement is in place. Ready does not sign a business associate agreement by default, so email support@tryready.com to ask whether one can be arranged before you record clinical calls.

Does staying on the line after a recording notice count as consent?

Often it does, but don't rely on it. In most all-party states, continuing a call after a clear disclosure is often treated as implied consent. An explicit yes is far easier to defend, and it's captured on the recording itself. After saying the call is recorded and transcribed, ask "Is that okay with you?" and wait for an answer. Silence isn't a yes. If the patient declines, stop recording or end the call and redial with recording off.

Does a signed intake form replace telling patients a call is recorded?

No. An intake form backs up the on-call disclosure but doesn't replace it. The form covers the patient as of the day they signed. It doesn't cover a spouse or caregiver who answers, and it doesn't prove the patient remembered it months later. Keep a dated, versioned line in your intake paperwork, store it with the patient's other consents, and make any no-record preference visible to whoever returns the calls.