Yes, you're misunderstanding how public key encryption (such as RSA) works. Indeed, the entire point of public-key encryption schemes is that the public key can be used to encrypt data, but not to decrypt it; for decryption, the private key is required.
However, there's a catch that you should be aware of: the public-key encryption schemes we currently know of are generally not suitable for directly encrypting large amounts of data, because:
- they're really slow, especially when compared to symmetric encryption schemes like AES; and
- they tend to produce ciphertext that is larger than the encrypted plaintext, often significantly so.
The usual solution to these problems is to use hybrid encryption. Basically, what programs like PGP / GnuPG do to "encrypt a file with RSA" is that they generate a random "message key" for a fast symmetric cipher like AES, encrypt the file with that AES key, then encrypt the AES key (which is short, only 16 to 32 bytes) with RSA, and finally join the two ciphertexts together (along with various kinds of metadata) as the encrypted output file.
As long as the intermediate AES key used to encrypt the data is safely discarded, the only way to decrypt the encrypted file is to first extract the encrypted AES key from the encrypted file, decrypt it with the RSA private key, and then decrypt the actual data with the decrypted AES key. But in principle, a malicious encryptor could save a copy of the AES key (or simply generate it according to some deterministic pseudorandom algorithm that they can later repeat), and thereby retain "back door" access to the encrypted files.
Of course, in principle a malicious encryptor could also simply save a copy of the unencrypted data before encrypting it, so in that sense, the problem is unavoidable. However, a bunch of 32-byte AES keys is a lot easier to conceal than several mega/giga/terabytes of audio recordings (and an "accidental bug" in the AES key generation code that makes it at least partially repeatable could be even easier to hide, and to explain away if found).
In practice, giving your telephony provider an RSA public key and your lawyer the corresponding private key (or, better yet, asking your lawyer to generate an RSA keypair and to send you and your provider the public key), and having the provider encrypt the audio files with that key using standard off-the-shelf software like PGP / GnuPG is probably good enough.
While it would be theoretically possible for the provider to modify the software to insert a backdoor into it, that would take some non-trivial effort and programming / crypto knowledge, and would risk being caught in an audit (since any such modified software would stand out if compared to the standard version of the same program). And in any case, they'd have to do that before encrypting the files they want to be able to decrypt; as long as they're initially honest, they won't be able to later decrypt any honestly encrypted files even if they later turn malicious (and/or are compromised by someone else).
