What are best practices for voice-mail security?

When possible, set voicemail to be delivered to secure e-mail server instead of residing on the phone system. Delivering voicemail to your secure e-mail server allows you to control the security and storage of any messages. Ensure that voicemail delivered to your e-mail server is done over an SSL/TLS connection.
Prohibit sharing of voicemail passwords: Ensure that voicemail passwords (or PINs) are kept confidential and never shared with others. Each user must maintain a unique password to access their voicemail account, safeguarding Protected Health Information (PHI), and ensuring individual accountability.
Set voice-mail PIN as strong as possible to avoid hack attempts: PINs should be at least 6 digits (8 or more preferred) and be changed on a periodic basis (e.g. every 90 days). Set PIN policies to prevent users from creating easy to hack PINs (e.g. 123456, 111111, 654321, 8675301). And set accounts to lock after X failed login attempts (e.g. 5 failed attempts).
Avoid shared voicemail accounts: Whenever possible, use individual voicemail accounts for each user to prevent unauthorized access to Protected Health Information (PHI). Refrain from creating joint or group voicemail accounts accessed by multiple users, as they increase the risk of PHI disclosure and complicate audit trails.
Instruct callers in voicemail greetings to avoid PHI and disclose access: Configure voicemail greetings to explicitly instruct callers not to include Protected Health Information (PHI), such as patient names, diagnoses, or medical details, in messages to minimize unauthorized disclosure risks. For group or shared voicemail boxes, include a warning that messages may be accessed by multiple authorized personnel to ensure transparency.