As far as consent goes, it seems like all you’d have to do is inform the patient that you record the calls. If Comcast can just let me know they’re recording my calls to their customer service department, then I don’t see why you can’t do the same.
As far as Hipaa compliance and storing data on a “non-secure device“ i’m not sure I appreciate a meaningful difference between temporarily storing a voice recording on your phone which is in your possession, and having a briefcase full of paper files which is in your possession (or perhaps more equivalent would be a voicemail left by a patient on a cell phone). Are we worried about hackers stealing the data? Is that really any more likely than someone stealing the briefcase?
At a certain point, the extra protection against liability in having the recordings must outweigh the liability from the data being obtained by someone who shouldn’t have it.