Hear it live: call our AI receptionist (450) 367-9990 Customer login
365vox
Book a call Try free for 7 days
Try it free for 7 days Book a discovery call Call the AI demo: (450) 367-9990 Customer login / sign up

Answers · Medical practices

Can a medical office leave a voicemail with health information?

Yes: under HIPAA voicemail rules, a medical office may leave a patient a message with limited details. Think of its name, a call-back number and what’s needed to confirm an appointment. A diagnosis, a result or the reason for the call is where the risk starts, because anyone in the household may hear it.

Last updated November 2, 2026

What HIPAA voicemail rules actually say

HHS answers this in FAQ 198: the Privacy Rule doesn’t prohibit leaving messages on answering machines. To safeguard privacy, the office should limit what it says: its name and number and what’s needed to confirm an appointment, or a request to call back.

Someone else answers. An office may leave a message with a family member, using professional judgment that it’s in the patient’s best interest, and limiting the information (45 CFR 164.510(b)(3)).

The patient asks for another way. A provider must accommodate reasonable requests to be reached by other means or at another place. It may ask for the request in writing, but not for a reason (45 CFR 164.522(b)).

Minimum necessary. The minimum necessary standard asks for reasonable steps to limit disclosures to what the purpose needs. Disclosures to the patient are exempt, but a voicemail can reach someone else.

These limits bind whoever leaves the message. 365vox’s AI virtual receptionist answers incoming calls only, so it leaves none. General information, not legal or clinical advice. Rules differ by state and province and change over time, so check yours.

Your state and your policy

State laws can be stricter for some information, and so can your policy. See HIPAA and five states’ rules.

HIPAA and leaving messages for patients: usually fine, or avoid

Examples to adapt to your policy.

What a medical office usually leaves on a voicemail, and what to avoid
Usually fineAvoid
The practice’s name and a call-back numberA name that reveals a specialty, unless the patient agreed
“This is a message for Jordan”The reason for the call, a symptom or a diagnosis
An appointment’s day and time, to confirm itTest results, unless the patient chose that in writing
“Please call us back at your convenience”Medication names or doses
Your hours, and how to reach the on-call lineBalances, collections or insurance problems
A reminder to check your patient portalAny detail on a number you aren’t sure is the patient’s

Sources: HHS FAQ 198; AFHTO, answers to five privacy questions (2016).

What to say in a patient voicemail: a script for staff

Three versions, from least to most detail. With no preference on file, use the first.

Voicemail scripts for staff

Starting point only: review with your privacy officer before you use it.

Before you leave a message: check the number against the chart and listen to the greeting. If it names someone else, hang up without leaving one.

1. No preference on file, or any doubt:
"Hello, this is [first name] from [practice name], calling for [patient's first name]. Please call us back at [number]."

2. The patient agreed to appointment messages:
"Hello, this is [practice name] for [patient's first name]. We're confirming your appointment on [day] at [time]. To change it, call [number]."

3. The patient agreed in writing to detailed messages on this number:
Leave only the topics they agreed to. Results our clinicians want to discuss are never left on voicemail.

If someone else answers and the chart doesn't list them: give your first name, the practice's name and the number only.

Then note in the chart: date, time, number called, what you left.

Ontario: how PHIPA practices handle voicemail

Practical answers come from the Association of Family Health Teams of Ontario (AFHTO) and the Information and Privacy Commissioner (IPC). General information, not legal or clinical advice. Rules differ by state and province and change over time, so check yours.

  1. Can an Ontario clinic leave a voicemail?

    Yes, within what the patient agreed to. AFHTO advises asking patients each time they register to confirm their contact details and whether a message may be left. Its sample form offers three choices: no message, a message only to call back, or a confidential voicemail with listed topics.

  2. And when the clinic isn’t sure?

    “If you are in any doubt leave a message only to say to call the office,” says AFHTO. It also advises listening for signs of a misdial first.

  3. Can staff leave details with a relative who answers?

    PHIPA generally requires express consent before a custodian discloses personal health information to someone who isn’t a custodian, unless the Act permits it (IPC). A spouse isn’t a custodian, so in most cases the patient’s recorded choice decides.

What 365vox does: no voicemails, and no health details in email

It sends no text messages and makes no outgoing calls: it answers the calls that come in. So it never leaves a voicemail; your team makes the call-backs. For an agent that hears health information, the call email only says that a call came in. The details stay in your 365vox portal, behind your sign-in.

One setting helps whoever calls back. Add a question in step 3, Questions to ask: “May we leave a detailed message at this number?” The answer is then in the call record.

When a patient returns your message after hours, the agent doesn’t guess why you called. It takes their name, number and a good time, and says the team will call back.

Voicemail and patient privacy: questions

Do HIPAA voicemail rules change if the patient shares a phone line?
The rule is the same, but the risk is higher: someone else may hear the message, so the short version matters more. Ask patients which number is private. A patient may ask to be called only at work or on a cell, and you must accommodate reasonable requests.
Can a doctor’s office leave a voicemail with test results?
HHS doesn’t forbid it, but its examples of a safe message don’t include results. A cautious policy leaves results only when the patient chose that in writing, for that number; AFHTO’s sample form lists test results as a topic patients can opt into. Results that need explaining belong in a conversation with a clinician.
Is “please call us back about your recent visit” too much detail?
Usually not: it confirms a visit, not why. But it confirms the person is a patient, which is sensitive at a mental health, addiction or fertility practice. There, leave only a first name and a number, and agree on a neutral way to say who is calling.
What if staff leave a message on the wrong number?
If it held only a name and a number, very little was shared, which is the point of short messages. If it held more, tell your privacy officer, who decides what has to be reported and to whom. AFHTO advises listening to the greeting for signs of a misdial before leaving anything.
Must patients agree in writing before we leave them messages?
Not under HIPAA: FAQ 198 allows limited messages without a written agreement. A provider may require confidential-communication requests in writing, though, and a contact-preference form is a simple way to record them. In Ontario, AFHTO’s sample form records each patient’s voicemail choice at registration.
Can we leave a message with a patient’s spouse?
HHS says an office may leave a message with a family member who answers, using professional judgment that it’s in the patient’s best interest, and limiting what’s said. A safe default is the call-back message only, unless the chart says otherwise. See talking to a patient’s family.
Does an AI receptionist leave voicemails for the practice?
Not 365vox: no outgoing calls, no texts, no reminders. If another product places calls for you, the same HHS limits apply to what it says; check that its business associate agreement covers that work. See whether an AI receptionist can meet HIPAA.
What should our own after-hours voicemail greeting say?
Who you are, your hours, and “If this is an emergency, hang up and call 911.” Say when messages are checked, so nobody expects an overnight reply. If an AI answers instead, its greeting says it’s an AI and that the call is recorded.

Short messages out. Full records in, behind your sign-in.

No credit card required. Cancel anytime.Just forward your phone line — we'll handle the rest.

Or hear it first — call our AI receptionist(450) 367-9990

Not ready to start your free trial? Book a no-obligation discovery call.

Hear it Try it free for 7 days