Florida Healthcare VoIP Switch Checklist

Who This Checklist Is For

This guide is written for office managers, practice administrators, and operations leads at Florida medical, dental, therapy, and specialty practices who are actively evaluating a new hosted VoIP provider or are mid-switch and want to confirm nothing was missed.

If your current provider cannot produce a signed BAA, cannot explain how voicemail is encrypted, or has left your after-hours routing in a default state, this checklist will help you identify the gaps before they become audit findings.

Provider Review at a Glance

Use the same written questions for every provider. The answers depend on the selected service, the practice’s workflows, and whether the provider will create, receive, maintain, or transmit electronic protected health information.

Mynians publishes its current base pricing and confirms BAA availability, selected safeguards, and activation details in writing before signing.

Step 1: Confirm a Business Associate Agreement

If a hosted VoIP provider creates, receives, maintains, or transmits electronic protected health information on your practice’s behalf, HHS treats that provider as a business associate and requires the appropriate Business Associate Agreement. Confirm that determination and the agreement before the selected service handles ePHI.

Before switching, ask your prospective provider directly: Will the selected service create, receive, maintain, or transmit ePHI, and is the applicable BAA available? Confirm the answer in writing before porting a single number.

Mynians confirms BAA availability in writing for the selected service before signing. Your practice should review the proposed service, agreement, safeguards, and handling of ePHI as part of its own risk analysis before porting numbers.

Step 2: Verify Encryption for Calls and Voicemail

Encryption is not a checkbox — it is a configuration that must be verified at multiple points in your phone system.

Voice call encryption

Ask whether the provider uses SRTP (Secure Real-Time Transport Protocol) for voice traffic and TLS (Transport Layer Security) for SIP signaling. These are the standard protocols for encrypting VoIP calls in transit. The IETF maintains the standards that govern both protocols.

Voicemail encryption and delivery

Voicemail-to-email is a convenience feature that can become a compliance liability if the email delivery path is not encrypted. Confirm that voicemail audio files are delivered over encrypted transport and that your email platform supports encrypted delivery. Unencrypted voicemail forwarded to a standard inbox is a common gap practices discover only after a review.

Data at rest

Ask where call recordings and voicemail files are stored and whether that storage is encrypted at rest. Get the answer in writing as part of your BAA review.

Step 3: Audit Your Call Routing and After-Hours Workflow

Call routing is where most practices have the most exposure during a provider switch. A misconfigured auto-attendant or after-hours routing rule can send callers to the wrong destination, leave urgent calls unanswered, or route messages to a voicemail box that no one monitors.

Auto-attendant configuration

Your auto-attendant script and menu options should be reviewed and rebuilt on the new platform — not assumed to carry over. Confirm that the new provider will configure the auto-attendant to your specifications before go-live, not after.

After-hours and on-call routing

Florida practices with after-hours on-call staff need routing rules that send urgent calls to the right person without exposing PHI unnecessarily. Map out your after-hours call flow in writing before the switch and verify it works in a test environment before porting your numbers.

Hunt groups and call queues

If your front desk uses a call queue, confirm that the queue behavior — ring order, overflow destination, hold music, and timeout rules — is configured correctly on the new system. A queue that overflows to a disconnected extension is a front-desk problem that patients notice immediately.

Step 4: Review Call Recording and Retention Policy

Call recording in a healthcare environment requires deliberate policy decisions. Before switching providers, answer these questions:

• Does your practice record calls, and for what purpose?
• Where are recordings stored, and for how long?
• Who has access to recordings, and is that access logged?
• Does your new provider’s recording feature meet the encryption and access-control requirements in your BAA?

If your practice does not need call recording, confirm that the feature is disabled by default on the new platform — not just unused. An active recording feature that stores files without a retention or deletion policy can create unnecessary risk.

The National Institute of Standards and Technology publishes guidance on data retention and access controls that can inform your internal policy decisions around recorded communications.

Step 5: Confirm Failover and Redundancy

Florida practices face a risk that offices in other states do not think about as often: hurricane season. A power outage, ISP disruption, or extended storm event can take down a phone system that has no failover plan. For a practice that relies on inbound calls for scheduling, referrals, and urgent patient contact, an unplanned outage is a serious operational problem.

What to verify before switching

• Does the provider offer automatic failover to a mobile number or alternate destination if your internet connection drops?
• Are softphone apps available so staff can take calls on mobile devices during an office closure?
• Is the failover configuration documented and tested, or is it a theoretical feature that has never been verified at your site?

Mynians reviews failover and redundancy per site after reviewing the network setup. Mobile and desktop softphone availability is confirmed for the selected plan and documented before activation.

The Cybersecurity and Infrastructure Security Agency provides business continuity guidance that applies directly to communication system resilience planning.

Step 6: Plan Number Porting Carefully

Number porting is the step that makes most practice managers nervous — and for good reason. A porting error can leave your main practice line unreachable for hours or days. Here is what can go wrong and how to avoid it.

Common porting problems

• Incorrect account information: The losing carrier rejects the port request if the account name, address, or billing telephone number does not match exactly.
• Porting before the system is ready: Numbers are ported before the new system is fully configured, leaving calls with nowhere to go.
• Partial port: Only some numbers in a block are ported, splitting your practice’s lines across two providers temporarily.
• No rollback plan: If something goes wrong on port day, there is no documented plan to restore service quickly.

Mynians VoIP handles number porting end-to-end for Florida practices. The porting and installation timeline is confirmed per site after reviewing network readiness, hardware, and porting requirements — because every practice’s situation is different.

Step 7: Lock Down User Access and Admin Controls

A hosted VoIP platform is a cloud system with an admin portal. That portal controls call routing, voicemail access, call recordings, and user permissions. Treating it like a low-risk system is a mistake.

Access control checklist

• Assign admin access only to staff who need it — not every licensed user.
• Use strong, unique passwords for the admin portal and enforce them through policy.
• Confirm whether the platform supports multi-factor authentication for admin logins.
• Review which users have access to voicemail boxes that may contain PHI.
• Establish an offboarding process so that departing staff lose access immediately.

The Federal Communications Commission provides guidance on communications security that is relevant to any practice managing a cloud phone system with sensitive call data.

Who This Is NOT For

This checklist is not the right fit for every situation. Skip it if:

• Your practice has no phone-based patient contact and does not transmit PHI over voice channels.
• You are a solo practitioner with a single personal cell phone and no staff — your compliance picture is different and simpler.
• You have already completed a full VoIP compliance review with your current provider in the last 12 months and have a signed BAA on file.

If none of those apply, keep reading — and consider getting a second set of eyes on your current configuration before you sign anything with a new provider.