Zoom has added something dental practices have wanted from their phone system for years: automatic redaction of sensitive data. Card numbers, PINs, passwords and other personal details can now be stripped out of call recordings, voicemails, transcripts and AI Companion summaries before they are saved. So the card number a patient reads out at reception no longer sits in a recording, a transcript, or every backup of either.
This is good news for any practice that takes payments over the phone, which is most of them. Here is what has changed, why card details are the one to care about most, and what we are doing about it for practices on our Zoom phone system.
What Zoom has added
Account administrators can now build redaction policies covering different kinds of sensitive data: bank card details, PINs, passwords, email addresses, phone numbers and similar. The policies apply across Zoom Phone call recordings, voicemails and text messages, and across meeting recordings, transcripts and the summaries that AI Companion writes.
Policies can be set for the whole account or for a particular site, group or user, so a practice with several locations can have one rule everywhere. There is an optional AI-assisted detection mode that runs inside Zoom's own environment rather than being sent elsewhere, and digits typed on the keypad during a call are masked automatically.
The important bit is that the redaction is applied to what gets stored, not bolted on afterwards. The number is not in the recording, not in the transcript, not in the summary, not in the backup of any of those, and not there for a colleague who plays the call back next week. The transcript simply shows a placeholder where the number was.
Two honest caveats, both from Zoom's own documentation. Detection is very good but not guaranteed to be perfect, so a practice should still check results rather than assume. And switching it on does not go back and clean up recordings that already exist. It protects what is captured from now on.
Why card details are the one to worry about
Of all the data types a policy can cover, card details are the one most practices are keenest to keep off their systems, and for good reason.
The PCI Security Standards Council, which sets the rules for anyone taking card payments, is blunt about this in its FAQ on call recordings. Storing a card's security code (the three digits on the back) in any form of digital audio recording after the payment has been authorised is a breach of PCI DSS, even if the recording is encrypted. Its guidance is that every effort should be made to stop the code being recorded in the first place, that any technology which suppresses or redacts the audio should be switched on, and that if recording cannot be prevented the data must be securely deleted as soon as the transaction is authorised.
The long card number itself can technically be stored, but only if the whole of PCI DSS is applied to wherever it lives. No dental practice wants its phone recordings pulled into the scope of a payment security standard. The sensible answer is for the number never to be there.
Then there is UK GDPR, which expects you to hold the minimum personal data you need for the job. A call recording that happens to contain a patient's full card number and security code, kept for months and copied into every backup, is exactly the kind of thing that turns a minor incident into a reportable one.
How practices end up with card data in recordings
It is rarely deliberate. A patient rings to pay a deposit or settle a balance. Reception takes the card details over the phone, as they always have. The call is recorded, because call recording is useful for training and for settling disputes. Nobody thinks about the fact that the recording now contains everything the patient just read out.
Add AI to the mix and the problem multiplies. A transcript is another copy. An AI summary is another copy. Each one is backed up. Each one can be searched. The convenience that makes these features worth having is also what makes an unredacted card number so hard to contain.
And to state the obvious: nobody should be reading a PIN or a password out over the phone to anyone, ever. But people do, and the point of redaction is that your practice's systems are not where it ends up.
What we are doing for practices on Zoom
For practices on our Zoom phone system, we can set these policies up on your account, covering call recordings, voicemails, transcripts and AI summaries in one go. We would recommend card details, PINs and passwords as the minimum, and most practices will want email addresses and phone numbers on the list too.
It sits well alongside the other things a well-run practice already does. If your recordings and summaries are kept for a sensible retention period rather than forever, redaction means that what is kept is safe to keep. If you have a proper backup regime, redaction means the backups are not quietly accumulating card numbers. And it fits the approach we set out in our piece on WhatsApp, AI and patient data compliance: use the useful tools, but make sure the data they create lives where the practice controls it.
One more reason we chose Zoom
This is one of the reasons we put Zoom at the centre of our phone systems for dental practices. It is a long way past being the meeting app, as we covered when comparing Microsoft 365, Google and Zoom as a tenant, and features like this keep arriving on it at a pace most phone systems aimed at small businesses cannot match. Our own DentalDial.AI runs on Zoom Phone, so the call analytics and the AI receptionist get the benefit of the same redaction.
If you are weighing up a phone system and compliance is part of the conversation, which in a dental practice it always should be, this belongs on the list of questions to ask any supplier: what happens to a card number read out on a recorded call?
Next steps
If you are already with us on Zoom, get in touch and we will switch the policies on and talk you through what to tell the front desk. If you are not, and you would like a phone system that takes this seriously, we are happy to show you how it works.