Last verified: October 2026, against RingCentral's own HIPAA documents, Trust Center and pricing page. General information, not legal advice — confirm with your compliance officer or attorney.
Is RingCentral HIPAA compliant? RingCentral offers a business associate agreement (BAA) to paying customers that are HIPAA covered entities, and the BAA covers a specific list of products. Whether your setup is covered depends on which RingCentral products and add-ons you use, whether the BAA is signed, and how recordings, voicemail and texts are handled.
Is RingCentral HIPAA compliant? RingCentral's own answer
Short answer (verified October 2026): RingCentral's HIPAA document (opens in a new tab) (dated March 2026) says "RingCentral makes available a business associate agreement (BAA) for our paying Covered Entity customers in alignment with HIPAA requirements." Its footnote lists the covered services: RingCentral Fax, RingEX, RingCX, RingCentral Contact Center, RingCentral Engage Digital ("third party channel communications excluded"), RingCentral AI Conversation Expert, AI Quality Management, AIR Pro, AI Receptionist, AI Supervisor Assist, AI Agent Assist, the Customer Engagement Bundle, and third-party products unless their own terms say otherwise. The document doesn't explain how to request the BAA.
RingCentral also says its HIPAA material "does not constitute legal or professional advice, or warranty of compliance." Its Trust Center (opens in a new tab) lists a "SOC 2+ FINRA CSR, HIPAA Report" for RingEX and RingCX, an audit report offered through its trust portal, not a certification of your practice.
For context: "is ringcentral hipaa compliant" gets about 210 searches a month in the US, at a CPC of $17.14 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What HIPAA requires before patient information goes in
Your phone vendor hears and stores what patients say, so HIPAA's vendor rule applies. A practice may let a vendor "create, receive, maintain, or transmit protected health information on its behalf" only with "satisfactory assurance" of safeguards, set out in a written contract (45 CFR 164.502(e) (opens in a new tab)). Under 45 CFR 164.504(e) (opens in a new tab), that contract must, among other things, require the vendor to report impermissible disclosures and to bind its own subcontractors to the same terms. Our guide to business associate agreements walks through the rest.
Phone vendors sometimes get treated as a "conduit," like a mail carrier. HHS says that exception "is limited to transmission-only services for PHI" (HHS cloud guidance (opens in a new tab)). RingCentral stores voicemails, recordings, faxes and messages, so it needs a BAA.
A signed BAA is the start. RingCentral's RingEX document (opens in a new tab) says customers subject to HIPAA "are ultimately responsible for complying with its requirements."
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Which RingCentral plans a BAA can cover
RingCentral ties its BAA to paying customers and named products, not to a plan tier. Its pricing page (opens in a new tab) shows no free plan, only a free trial "available to new subscribers only."
| What you use | On the March 2026 BAA list? | What to do |
|---|---|---|
| RingEX | Yes | Sign the BAA before go-live |
| RingCentral Fax | Yes | Same |
| AI Receptionist, AIR Pro | Yes | Confirm the add-on is on your order |
| RingCentral Video Pro | Not named in 2026; named in the April 2024 RingEX list | Ask RingCentral to confirm in writing |
| Engage Digital third-party channels | Excluded | Keep PHI out of those channels |
| Add-ons not on the list | Unknown | Ask before turning them on |
If you also run patient video visits, compare video tools in our zoom guide.
Call recordings, voicemail transcripts and texting
Each of these features turns a fleeting call into stored PHI. Decide each one deliberately.
- Call recording. Record only lines where you need it, set a retention period, and limit who can play recordings back. Recordings of patients describing symptoms are PHI.
- Voicemail to email. RingCentral says RingEX can send "voicemail messages and the transcriptions of those messages to a user's email address," using "SMTP/TLS encryption." The receiving email provider is a third party, so send voicemails only to inboxes your practice controls and has its own BAA for.
- Transcription. A transcript makes a voicemail searchable and forwardable. If staff don't need it, turn it off.
- Texting. Neither RingCentral HIPAA document names SMS. The BAA list includes RingEX and the Customer Engagement Bundle, which the pricing page says includes the Business SMS Booster. Get written confirmation that your texting is in scope, then follow our texting rules: logistics only, no results or diagnoses.
- Ordinary phone lines. RingCentral encrypts protected data in transit over public networks "excluding communication over public switched telephone networks." That commitment doesn't extend to the public phone network a call to a patient's landline or cell travels over.
Safe uses and unsafe uses for a practice
| Use | Without a signed BAA | With a BAA covering the product |
|---|---|---|
| Main practice number and front desk | No | Yes |
| Voicemail-to-email | No | Yes, to covered practice inboxes only |
| Appointment reminders by text | No | Yes, once SMS scope is confirmed |
| Faxing referrals | No | Yes, with RingCentral Fax |
| AI phone answering | No | Yes, if the AI product is on the list |
| Free trial with real patient calls | No | No: test with made-up data |
Safer setup or alternatives
- Get the BAA signed and dated before porting your main number.
- List every product and add-on on your account and match it to RingCentral's covered-services list.
- Set recording and transcription defaults to off, then turn them on per line with a reason.
- Point voicemail-to-email only at covered practice inboxes.
- Review user access monthly, and remove departing staff the same day.
If RingCentral's product list doesn't fit your setup, compare business phone systems whose vendors sign a BAA covering voice, voicemail, texting and fax, or move written conversations into your EHR's patient messaging. The hub on HIPAA and everyday tools covers the other tools on a practice's desk.
Medfy isn't a phone system and doesn't answer calls. Its part of the patient journey is the website, where forms and chat feed a patient CRM and inbox stored in separate, encrypted HIPAA databases in the US or Canada, with a BAA Medfy signs with each practice. Details are on how Medfy handles patient data. To see how your website and listings send patients toward your phone number, start with a free marketing audit.
Frequently asked questions
Will RingCentral sign a BAA?
Yes, for paying customers. As of October 2026, RingCentral's HIPAA document says it "makes available a business associate agreement (BAA) for our paying Covered Entity customers," covering a named list of services that includes RingEX, RingCentral Fax, RingCX and several AI products. Its public documents don't describe how to request it, so ask your account representative and keep the signed copy. Confirm the scope with your compliance officer or attorney.
Is the free version of RingCentral HIPAA compliant?
RingCentral doesn't offer a free plan for RingEX. Its pricing page shows a 14-day free trial for new subscribers, and its BAA is offered to paying covered-entity customers. Treat the trial as a test with made-up data: no patient calls, voicemails or messages. The pricing page also notes that SMS isn't available during the trial, so you can't test texting there anyway.
Can a practice use RingCentral without patient information?
Yes, but a practice phone line rarely stays free of patient information for long. Patients call about appointments, leave symptoms on voicemail and reply to texts. If RingCentral is your main number, plan on PHI and get the BAA. A line that truly never touches patients, such as a billing-vendor line or a recruiting number, can run without one.
What is a HIPAA-compliant alternative to RingCentral?
Any business phone or messaging system whose vendor signs a BAA covering the exact features you use: calls, voicemail, transcription, texting, fax and AI add-ons. Your EHR's patient messaging is another option for written conversations. No tool is compliant by itself, so compare BAA scope, recording and retention controls, and price, then confirm the setup with your compliance officer or attorney.