Legal Intake Call Recording Compliance: Wiretap Laws, HIPAA & Best Practices

Call recording is one of the highest-value tools in a legal intake operation — and one of the most compliance-sensitive. Recordings allow supervisors to score calls, identify missed qualifications, train staff on objection handling, and document exactly what a prospective client was told. But getting it wrong exposes law firms and intake vendors to wiretap claims, state privacy violations, and HIPAA-adjacent liability.

This guide covers the full compliance framework: federal and state wiretap law, the all-party consent states you can't ignore, how to handle recordings that contain medical information, storage standards, retention policies, and how to write a disclosure that actually protects you.

The Legal Foundation: Federal Wiretap Law

Call recording is governed at the federal level by the Electronic Communications Privacy Act (ECPA), 18 U.S.C. § 2510–2523, which prohibits the intentional interception of wire communications without consent. The key federal requirement is one-party consent: if at least one party to the communication consents to the recording, federal law is satisfied. In a business context, this means a firm's own agent recording the call with knowledge of the recording satisfies the federal standard.

Federal law sets a floor, not a ceiling. States are free to impose stricter requirements — and 13 do.

Two-Party (All-Party) Consent States

These states require that all parties to a conversation consent before it can be lawfully recorded:

Writing a Compliant Recording Disclosure

A disclosure that satisfies all-party consent requirements in every state must: (1) inform the caller the call is being recorded, (2) be delivered before any substantive conversation, and (3) give the caller an opportunity to object.

IVR / Auto-Attendant Disclosure (Recommended)

The most defensible approach is an automated audio disclosure triggered before a live agent connects:

"Thank you for calling [Firm Name]. To serve you better, this call may be recorded for quality assurance and documentation purposes. If you prefer not to be recorded, please press 1 now and you'll be connected to an agent without recording. Otherwise, please hold for the next available intake specialist."

Live Agent Disclosure (Backup)

When recording begins after the agent connects (e.g., in an outbound callback scenario):

"Hi, this is [Agent Name] calling from [Firm Name]. Just so you know, this call is being recorded for quality and documentation purposes. Is it okay if we proceed?"

For outbound calls, explicit verbal consent ("Yes, that's fine") should be captured on the recording before continuing to substantive intake questions.

HIPAA and Health Information in Recordings

PI intake calls routinely collect medical information: diagnosis, treatment history, treating physicians, hospitalization records, prescription medications, and prognosis. This is protected health information (PHI) under HIPAA's definition — regardless of whether your firm is a covered entity.

Law firms are not HIPAA covered entities, but several courts and state attorneys general have applied state medical privacy statutes to PI intake recordings. More practically: a data breach involving intake call recordings that contain medical information creates significant exposure even without direct HIPAA liability.

HIPAA-Equivalent Standards for Intake Recordings

• Encryption at rest and in transit: Recordings stored on any cloud platform (AWS S3, Google Cloud, Azure) should use AES-256 encryption. Transmission should use TLS 1.2 or higher.
• Access controls: Role-based access — only supervisors, quality reviewers, and authorized attorneys should be able to retrieve recordings. Log all access.
• Business Associate Agreements: Any vendor who processes, stores, or transmits your intake recordings should sign a BAA-equivalent data processing agreement covering breach notification, data security standards, and use limitations.
• Breach notification policy: Even without direct HIPAA coverage, document a written policy for how you would respond to unauthorized access to recordings containing medical information.

Retention Policy Framework

The single most common retention mistake is inconsistency. If your written policy says recordings are deleted after 90 days but discovery reveals you kept some recordings for 3 years, the inconsistency itself becomes evidence of selective retention — worse than either policy applied uniformly.

When You Use an Outsourced Intake Vendor

If your law firm uses a third-party intake vendor, the compliance obligations don't transfer — they multiply. You're responsible for ensuring your vendor's recording practices satisfy your disclosure obligations, and the vendor is handling data collected on your behalf.

Contracts with outsourced intake vendors should specify:

• Whether calls are recorded, and who retains the recordings
• Required disclosure language (the vendor should use language that protects your firm, not just theirs)
• Data security standards and encryption requirements
• Retention and deletion schedules
• Incident notification timeframes for any breach or access event
• Ownership of recordings and any derived data

Frequently Asked Questions