HIPAA Handbooks

  • Privacy and security training for new and seasoned staff
  • 11 staff/setting focus areas
  • Education on protecting PHI
  • New HITECH Act changes
  • Discounts on bulk purchases



  • Role-based training using real-life case scenarios
  • Test-your-knowledge exercises with remediation
  • Post-course test to document staff participation


Other HIPAA Resources

  • Hot-topic audio conferences
  • Books on privacy and security
  • Newsletters
  • e-Newsletter
  • Videos



HIPAA Q&A: Voicemail messages

Email This Post Print This Post

Q. May ambulatory surgery center (ASC) staff members leave preoperative messages on patients’ voice mail or answering machines that include:

  • The caller’s first name
  • The name of the ASC
  • Instructions to call a certain number

Messages neither identify the procedure nor provide other information about the patient. I believe this practice is acceptable unless patients have specifically requested that we not do this (e.g., cosmetic cases).

What information concerning a scheduled procedure (e.g., arrival time, medication reminder, what to bring) may we leave on a patient’s voicemail or answering machine? What information may we leave in a post-procedure follow-up message?

A. You are correct. The practice you describe is acceptable because the information in the message is limited to the minimum necessary. Voicemail messages left for patients should not reveal anything about the patient’s diagnosis or surgical procedure. They may convey practical information, such as expected arrival time and medications.

Follow-up messages should be general, such as, “Mr. Smith, this is Sally at XYZ Surgery Center. I wanted to see how you’re doing after your procedure. Please call me back at 999-9999.”

Editor’s note: Mary D. Brandt, MBA, RHIA, CHE, CHPS, a nationally recognized expert on patient privacy, information security, and regulatory compliance, answered this question. Brandt is associate executive director of HIM at Scott & White Healthcare in Temple, TX. Some of her publications were used as a basis for HIPAA privacy regulations. Advice given is general. Readers should consult professional counsel for specific legal, ethical, or clinical questions.


  1. Bob Mernar says:

    Wouldn’t mentioning medications associated with the visit’s procedure cited below be a privacy issue, as you can’t say that the patient will ultimately be the sole recipient of the information from the answering machine message?

  2. Frank Ruelas says:


    I agree with your comment on the mentioning of medications for the reason you provided.

    Thanks for sharing,

  3. John Reynolds says:

    This response appears t o contradict the response to a similar question answered by HCPro on 2/16/2011.

    Q&A: Voice mail
    Compliance Monitor, February 16, 2011

    Q: May a preadmission nurse leave messages (e.g., “This is a reminder that your surgery is tomorrow; please don’t drink or eat anything after midnight.”) on an answering machine or mobile phone voice mail?

    A: Yes, as long as the nurse does not specify the type of surgery or the name of the practice. Leaving the name of a specialty practice or the type of surgery, especially on an answering machine, can allow unauthorized individuals access to the patient’s PHI. Asking patients beforehand whether it is okay to leave such messages on an answering machine or voice mail is always best (45 CFR 164.502[a][1][i]).

    Is it or is it not acceptable to leave the entity name in a voice mail message? I tend to lean towrds not leaving the entity name.

  4. Christjne says:

    When calling a patient about an account balance, what information can we leave on their voicemail?

Leave a Reply