Most clinic staff never need to know what happens between pressing a button on a desk phone and hearing a voice on the other end. But when calls drop, audio breaks up, or a security questionnaire asks whether calls are encrypted, the answers all come back to three pieces of the same machinery: the signaling protocol, the media protocol, and the codec. This guide explains each in plain terms and points out the decisions a clinic is making, often without realizing it, when it chooses a provider.
A call is two conversations
A VoIP call is really two separate flows of data. The first is signaling: the messages that say "I want to call this number," "the phone is ringing," "they picked up," and "hang up." The second is media: the stream of audio packets carrying the voices. They use different protocols, often take different paths across the network, and can be secured independently. Many quality and security problems come from treating them as one thing.
SIP: setting up and tearing down the call
Session Initiation Protocol is the standard most VoIP systems use for signaling. When a phone places a call, it sends a SIP INVITE to the provider's server describing who is calling, who is being called, and what audio formats the phone can handle. The server routes it, the far end responds with ringing and then acceptance, and the two sides agree on where to send audio. When someone hangs up, a SIP BYE ends the session.
SIP also handles registration, which is how a phone tells the provider "I am online at this address, send my calls here." Registration is why a softphone on a laptop can receive calls from anywhere with internet access, and it is also the mechanism attackers target when they try to hijack an extension. A phone that registers with a weak password is a phone that can be used to make toll calls on the clinic's account.
RTP: carrying the voice
Once SIP has set up the call, the audio itself travels over Real-time Transport Protocol. RTP breaks the audio into small packets, typically representing 20 milliseconds of sound each, and sends them continuously. It does not wait for lost packets to be resent, because a resent packet would arrive too late to be useful; it simply keeps going, and the receiving side conceals the gap as best it can.
This is why network quality matters more for voice than for almost anything else a clinic does online. Three measurements describe it. Latency is how long a packet takes to arrive; above roughly 150 milliseconds one way, conversation starts to feel like a satellite delay. Jitter is variation in arrival timing; the phone buffers packets to smooth it, and if jitter exceeds the buffer, audio stutters. Packet loss is packets that never arrive; even one percent is audible, and a few percent makes speech hard to follow. A provider's quality guarantees, and a clinic's own network setup, are about controlling these three numbers.
Codecs: turning voice into packets
A codec is the method used to compress the microphone's audio into data and decompress it at the other end. The choice trades bandwidth against quality and resilience.
| Codec | Bandwidth per call (approx.) | Character |
|---|---|---|
| G.711 | 80 to 90 kbps | Uncompressed telephone quality; the baseline that connects to every carrier; works well with fax and hearing-aid compatible devices |
| G.729 | About 30 kbps | Heavily compressed; useful on constrained links; noticeably lower fidelity; unsuitable for fax |
| G.722 | 80 to 90 kbps | Wideband "HD voice"; clearer than G.711 between endpoints that both support it |
| Opus | Adaptive, 6 to 510 kbps | Modern, adjusts to network conditions; common in softphones and web-based calling |
For a clinic the practical guidance is simple. Prefer G.711 or G.722 on the office network, where bandwidth is not a constraint, so that voices are clear and fax lines or analog adapters behave. Allow adaptive codecs on remote softphones where connections vary. And know that a call between the clinic and an outside party will usually fall back to G.711 at the carrier boundary regardless, so internal HD voice does not change what a patient hears on a cell phone.
TLS and SRTP: protecting both streams
Because signaling and media are separate, each has its own encryption. SIP over TLS encrypts the signaling, which protects the phone's credentials during registration and hides who is calling whom. SRTP, Secure RTP, encrypts the audio packets so a call cannot be listened to by anyone who can see the network traffic. A provider that offers only one of the two is protecting half the call.
Encryption normally covers the path between the phone and the provider, and between the provider and its peers when they support it. Once a call hands off to the public telephone network toward a patient's landline or cell, it leaves the encrypted path. That is a limitation of the phone network, not of any one provider, and it is why call encryption is one safeguard among several rather than a complete answer.
Under the HIPAA Security Rule, encryption of electronic protected health information in transit is an addressable implementation specification: a covered entity must assess whether it is reasonable and appropriate and either implement it or document an equivalent alternative. For calls that carry patient information through a cloud provider, enabling TLS and SRTP is almost always the reasonable choice, and it costs nothing on modern platforms.
What this means for a clinic
- Ask the provider whether SIP over TLS and SRTP are supported and enabled by default for both desk phones and softphones.
- Ask which codecs are used on the office network and on remote devices, and confirm fax or analog adapter lines use G.711 or a dedicated fax protocol.
- Confirm the provider publishes latency, jitter, and packet loss targets and how they measure them.
- Set up the office network so voice traffic is prioritized over general web traffic; most business routers can tag and prioritize it.
- Use strong, unique registration credentials for every extension, and disable extensions that are no longer in use.
None of this requires a clinic to become a telecom engineer. It requires knowing that a call is two streams, that each can be secured, and that quality is a measurable property of the network, so that the questions to a provider are specific enough to get real answers.
Common questions
Is a VoIP call encrypted by default?
Not always. Many providers support SIP over TLS and SRTP but leave them optional or enable them only on certain devices. Ask the provider to confirm both are enabled for all endpoints, and remember that encryption ends when a call reaches the public telephone network.
How much bandwidth does a clinic need for VoIP?
Plan on about 100 kbps per concurrent call in each direction using G.711, so ten simultaneous calls need roughly 1 Mbps up and down, plus headroom. Bandwidth is rarely the constraint; jitter and packet loss from congestion are, which is why traffic prioritization matters more than raw speed.
Why do faxes fail over VoIP?
Fax machines send modem tones that compressed codecs distort and that packet loss corrupts. Fax over VoIP needs G.711 with no compression or, better, the T.38 fax relay protocol, and even then results vary. Many clinics move to a cloud fax service instead.
What is the difference between SIP and VoIP?
VoIP is the general term for voice carried over internet protocol networks. SIP is the specific signaling protocol most VoIP systems use to set up and end calls. A SIP trunk or SIP phone is a VoIP connection or device that uses that protocol.