The Home Care Call Compliance Checklist: What to Record, Redact, and Retain

## Home care is not a "generic call center" Most call-recording guidance is written for banks, insurance carriers, or general contact centers. Home care agencies inherit the strictest of every world: HIPAA, state Electronic Visit Verification (EVV) rules, Medicaid MCO contracts, DOL wage-and-hour requirements, and a workforce that's calling from cars, kitchens, and patient homes. This checklist is what we walk new home-care customers through in their first week on SurfacerIQ. Print it, tape it to the wall, work through it row by row. ## 1. Consent capture - **Verbal disclosure** at the start of every recorded call ("This call may be recorded for quality and compliance"). Not optional under HIPAA even in one-party-consent states. - **State-specific two-party consent** where required (CA, FL, IL, MD, MA, MT, NV, NH, PA, WA). If a caregiver is in one of these states and the patient in another, treat it as two-party. - **NPP update** covering recording of calls, transcription, and AI-assisted review. - **Stored consent metadata** on the recording — timestamp, script version, agent ID. If it isn't stored, it didn't happen. ## 2. What actually gets recorded - Intake calls (highest PHI density; also highest churn risk). - Scheduling calls between coordinators and family members. - Caregiver-to-office calls (often the earliest signal of a caregiver about to quit). - After-hours on-call lines. - **Not** the caregiver's personal cell conversations with the patient inside the home unless you have an explicit, purpose-limited program in place. This is where agencies get in trouble. ## 3. EVV overlap Electronic Visit Verification systems already log call-based check-ins and check-outs. Two rules of thumb: - EVV audio (a caregiver dialing the check-in line) is a recorded call and inherits every HIPAA obligation on this checklist. - EVV metadata (start time, end time, GPS, phone number) is not PHI on its own but becomes PHI the instant it's joined to a patient identifier — which is basically always. ## 4. Transcription and AI review - Vendor must sign a BAA. No exceptions. - Vendor must contractually block using your audio to train their models. - Processing must be in-country (US-based data centers) unless you have a specific reason otherwise. - LLM provider must be on a HIPAA-eligible tier with prompt logging disabled or covered by BAA. - Access to raw transcripts is role-based and logged. ## 5. Redaction - Automated redaction of caregiver SSNs, direct-deposit info, and patient MRNs before transcripts leave the compliance boundary. - Manual redaction workflow for anything the automation misses — with a two-person review before publication. - Redaction that leaves the original recording intact (redact copies, never destroy the source) so audits can reconstruct. ## 6. Retention - Default retention: match the longest applicable rule (state Medicaid contract, HIPAA 6-year floor for policies and access logs, DOL 3-year for wage-related content). - Per-recording clock, not a nightly batch job that "usually" runs. - Legal hold flag that overrides deletion for any recording tied to an open complaint, DOL inquiry, or lawsuit. - Documented, logged, verifiable disposal at the end of the retention window. ## 7. Access and audit - Role-based access to recordings and transcripts. Coordinators see their patients, supervisors see their teams, compliance sees everything, everyone else sees nothing. - Every listen, read, download, and export is logged with user, timestamp, and purpose. - Weekly compliance report: unusual access patterns, exports outside the platform, off-hours listens. - Auditor-ready evidence pack that can be generated in under 15 minutes. ## 8. Incident response - Defined breach threshold (any unauthorized access to PHI-bearing audio or transcript). - 60-day HHS notification clock owned by a named individual, not "the compliance team." - Patient notification templates already approved by counsel. - Post-incident review that lands changes back into this checklist. ## 9. Signals worth surfacing to leadership Home care is a business where the earliest indicator of a lost contract is usually a single sentence in a scheduling call. Weekly digests to ops leadership should include: - Family members mentioning "looking at alternatives," "the other agency," or specific competitors. - Caregiver frustration language ("I can't keep doing this," "I need more hours," "no one called me back"). - Complaint volume by branch, week over week. - Missed-visit conversations, root-caused by reason. ## How SurfacerIQ maps to this checklist Every item above maps to something SurfacerIQ ships out of the box: BAA-covered pipeline, US-only processing, no model training on your audio, role-based access with full audit logs, per-recording retention clocks, structured signal extraction with weekly executive digests. It's the shortest path from "we record calls somewhere" to "we can answer any question an auditor or an executive asks in under 15 minutes."