Who owns your patient data and your phone number

The moment you find out who owns your practice’s phone number is usually the moment you are trying to leave.

It is a bad moment to find out. The number is on your signage, your cards, hundreds of patient records and every directory listing you have ever been in. If a vendor controls it, leaving them costs more than the contract ever did.

Same story with your patient list, your reviews and your call recordings.

The three clauses that decide it

Open whatever agreement you are considering, or the one you already signed, and find these.

1. Data ownership. Look for language saying the practice owns and retains all rights to patient data, and that the vendor processes it solely on your instruction. If the agreement says the vendor owns “aggregated” or “derived” data, read that twice and decide whether you mind.

2. Data return and deletion on termination. You want a defined window, a usable format, and deletion afterwards. “Available upon request” is not a commitment. A CSV export within 30 days is.

Note that this overlaps with HIPAA. A business associate agreement is supposed to address what happens to protected health information when the relationship ends, so if your BAA is silent on it, that is a gap worth raising. More on which vendors need a BAA here.

3. Telephone numbers. The clause should say the practice is the subscriber of record, or that the vendor will cooperate with porting on request without charge.

Why phone numbers are the sharp edge

In the US you generally have the right to port a number to another provider. The FCC is clear that a provider cannot refuse to port simply because you owe them money.

The catch is that porting requires accurate account information from the losing carrier, and if the account is in the vendor’s name rather than yours, you are dependent on their cooperation to get it. A slow or unhelpful vendor can turn a two-week port into two months.

The fix is boring and takes ten minutes: find out today whose name the account is in. If you do not know, ask. If the answer is the vendor, ask what it would take to change it.

The ones people forget

• Reviews. If a vendor’s platform sits between your Google profile and your patients, make sure the profile itself is yours and you have owner access. Reviews live on Google, but the profile can be held hostage.
• Your website and domain. Registrar account in your name, not the agency’s.
• Call recordings and transcripts. These contain patient information. They are yours, and they should be returned or destroyed.
• The A2P registration. If texts to your patients go out under someone else’s brand, you cannot take that with you. That is a reason to register your practice’s own brand from the start.

A short email you can send today

To any vendor currently holding something of yours:

Could you confirm in writing: who is the subscriber of record on our phone numbers, who owns the patient data in your system, and what the process and timeline is for returning that data and porting the numbers if we end the agreement?

A vendor with clean answers will reply within a day. A vendor who needs a call to discuss it has told you something useful.

Where we stand

You own your data and your phone numbers. If you leave, they go with you. That line is in the FAQ on the homepage because it is the question worth asking everyone, including us.

If you are still working out whether recall is worth doing at all, start with the numbers.