Encryption can protect the content of a voice conversation in transit, but HIPAA does not create a single “compliant call app” category. The full communication workflow and the relationship with any vendor handling ePHI still need review.
Secure voice checklist
Who can join?
Define how participants authenticate, how invitations/passwords work, and how a host removes or blocks unauthorized participants.
Is media end-to-end encrypted?
Understand whether voice is protected only between the browser and server or encrypted at the application layer between participants.
What is stored?
Ask whether audio, transcripts, room chat, nicknames, logs or metadata are retained and for how long.
What can relays see?
WebRTC may use STUN/TURN for connectivity. Evaluate what the relay can observe and whether application-layer encryption keeps media content opaque.
Are endpoints controlled?
A compromised browser/device, room speakerphone, screen recording or nearby listener can bypass strong network encryption.
Is a BAA required?
If the service creates, receives, maintains or transmits ePHI on behalf of a regulated entity, evaluate HHS business-associate guidance and current vendor terms.
Murmivo as a privacy-focused voice example
Murmivo currently describes itself as a browser-based, audio-only private-room service. Its live landing page says voice and ephemeral room chat are protected with application-layer end-to-end encryption in the browser, unsupported browsers are blocked rather than silently downgraded, and Murmivo does not store call audio or room chat history.
Rooms use aliases rather than phone numbers. Hosts can set room capacity, passwords, guest nicknames and speaker limits. Temporary rooms disappear after 24 hours of inactivity, while a passkey account is used when someone wants to reserve a persistent custom room alias.
When secure voice complements secure email
- Discuss a sensitive issue without creating a permanent written thread.
- Walk someone through a form or referral while documents move through a separate encrypted channel.
- Use a temporary room for a short-lived conversation where phone numbers do not need to be exchanged.
- Keep written records in the approved record system rather than assuming an ephemeral call replaces required documentation.
Pair voice with written encrypted delivery
For files, forms, referrals and asynchronous communication, a tool such as AliasCloak can provide end-to-end encrypted mailbox messages, real-time chat and encrypted file delivery. For live voice, Murmivo is a separate product with a different risk model. Evaluate each product for the data it actually handles.