HIPAA compliant voice AI: the BAA chain, PHI and reminder calls

Why no voice AI product is HIPAA compliant on its own

HIPAA (the Health Insurance Portability and Accountability Act) is the US health privacy law, and its duties fall on organisations, not on products. It applies to covered entities, such as clinics, hospitals and health plans, and to their business associates, meaning the vendors that handle patient data on their behalf. What it protects is protected health information (PHI): health information that identifies a patient, including the simple fact that someone booked an appointment with a cardiologist.

So a vendor cannot make a clinic compliant by being compliant itself. The US Department of Health and Human Services (HHS) says its Office for Civil Rights "does not endorse, certify, or recommend specific technology or products" (HHS cloud computing guidance). A "HIPAA certified" badge on a website therefore has no official meaning. What a vendor can offer is a signed BAA and evidence of its safeguards, such as independent security audit reports, while the clinic remains responsible for its own risk analysis.

Voice AI makes this harder than most software purchases, because a single call passes through several companies. An AI receptionist for clinics and hospitals typically relies on a telephone provider, a speech-to-text engine, a language model, a text-to-speech engine, storage and monitoring tools. Each of them may see what the patient said, and each is a link in a chain of contracts that has to hold.

Which vendors in a voice AI call need a BAA

HIPAA defines a business associate as anyone who "creates, receives, maintains, or transmits" PHI on behalf of a covered entity (45 CFR 160.103). A subcontractor that does the same for a business associate is a business associate too. The definition therefore reaches past the voice AI platform the clinic pays to the speech, model and storage vendors that platform relies on.

The contracts form a chain. The clinic must get satisfactory written assurances from its direct vendor (45 CFR 164.502(e)(1)(i) and 164.308(b)(1)), and that vendor must get the same assurances from its own subcontractors (164.502(e)(1)(ii) and 164.308(b)(2)). The clinic does not sign with every subcontractor itself. It should still ask the platform for its list of subcontractors and written confirmation that each has signed, because a single missing link breaks the chain.

What the business associate agreement has to say

Knowing who must sign is half the work; the other half is reading what they sign. The required terms are set out in 45 CFR 164.504(e)(2). Taken together, they limit what the vendor may do with PHI, give the clinic ways to check on it, and let the clinic end the relationship and get the data back or destroyed.

For a voice AI vendor, two terms deserve the closest reading. The permitted-uses clause is where you settle whether the vendor may keep recordings or use your patients' calls to train its models. If the BAA does not allow training, the vendor may not do it. Ask for the same written confirmation about the language-model provider, which sees transcripts, prompts and patient context on every call. The exit clause decides what happens to stored audio and transcripts when you leave.

It also helps to check that the BAA names the service you actually use. A vendor that added an AI agent to an older calling product may have an agreement written for the older product. Our due-diligence questionnaire for AI voice vendors was written for Indian banks, but its questions on subcontractors, audit reports and data retention apply just as well to a clinic's vendor. The terms a BAA must cover are:

• Permitted uses: what the vendor may and may not do with PHI.
• Safeguards: comply with the Security Rule for electronic PHI.
• Reporting: report any use the contract does not allow, including breaches of unsecured PHI.
• Subcontractors: make them agree to the same restrictions and conditions.
• Patient rights: make PHI available for patient access, amendment and an accounting of disclosures.
• HHS access: open its books and records on PHI to HHS when asked.
• Exit: return or destroy PHI at the end, and let the clinic terminate if the vendor breaks a material term.

Where patient data ends up during a call

A BAA protects only the data you know about, and a voice AI call spreads PHI into far more places than the call recording. A single booking call can leave PHI in the raw audio, the live transcript, the prompt sent to the language model and the model provider's request logs. It also lands in tool calls to the scheduling system, the text sent to the voice synthesiser, the stored recording, the post-call summary and any analytics export.

Debug logs are the usual leak. Engineers switch on full-text logging to fix a problem, and transcripts end up in a monitoring tool that has no BAA. The Security Rule requires "an accurate and thorough assessment" of the risks to electronic PHI (45 CFR 164.308(a)(1)(ii)(A)). For a voice agent, that means listing every vendor and every store in the flow below before the agent takes its first patient call. For each one, note what it holds, for how long and who can see it.

Architecture affects how easy this is. A cascaded agent, which turns speech into text, has a language model write a reply and then speaks it, produces a transcript at every step; a speech-to-speech model may not. Our comparison of cascaded and speech-to-speech voice agents explains the trade-off. A transcript is easier to audit, but it is also one more copy of PHI to protect.

Reminder calls and the TCPA healthcare exemption

HIPAA is not the only law in play once the agent starts calling patients rather than answering them. The Telephone Consumer Protection Act (TCPA) restricts calls that use an artificial or prerecorded voice. The Federal Communications Commission (FCC) has ruled that AI-generated voices count as artificial (FCC Declaratory Ruling 24-17, February 2024). An AI call to a patient's mobile phone therefore normally needs the patient's prior express consent.

The FCC carved out an exemption for certain healthcare calls to mobile numbers, created in its 2015 order FCC 15-72 (47 CFR 64.1200(a)(9)(iv)). It covers appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration and pre-operative instructions, lab results, post-discharge follow-up, prescription notifications and home healthcare instructions. It excludes telemarketing and any billing, debt-collection or other financial content. A call about an unpaid bill therefore falls under the ordinary rules, which the guide to AI debt collection calls in the US covers.

The exemption is conditional, and each condition becomes a setting in the agent or its calling campaign. Within it, the content of the call is still governed by HIPAA. The FCC warned that a message must not be so personal that it breaches the patient's privacy if someone else hears it (FCC 15-72, para 146). In practice, a voicemail should say little more than who is calling and how to call back. A reminder can still be brief and useful, as the appointment booking call script shows. The conditions are:

• Call only the mobile number the patient provided. The call must be free to the patient and must not count against their plan's minutes or texts.
• State the provider's name and contact details at the start of the call.
• Keep voice calls to about one minute or less.
• Send no more than one call or text a day, and three a week, to each patient.
• Offer an automated voice or key-press opt-out during the call, and a toll-free opt-out number on voicemail. Honour opt-outs immediately.

The proposed Security Rule and what it would add for vendors

Everything above rests on the current Security Rule, which has not changed, although HHS has proposed a stricter version. HHS published the proposal on 6 January 2025 (90 FR 898, RIN 0945-AA22), and comments closed on 7 March 2025. As of 24 October 2026 no final rule has been published. HHS had targeted May 2026 for a final rule, as Davis Wright Tremaine reported in July 2026. Its regulatory agenda now lists the rule as a long-term action, with final action projected for July 2027 (Unified Agenda entry).

The proposal would require encryption of electronic PHI at rest and in transit, with limited exceptions (proposed 164.312(b)). It would also require multi-factor authentication, plus a technology asset inventory and network map reviewed at least every 12 months (proposed rule).

For voice AI buyers, the biggest change would be vendor checks. Clinics would need written verification from each business associate, at least once every 12 months, that it has deployed the required technical safeguards (proposed 164.308(b)(2)(ii)). That would turn the BAA chain from a contract signed once into something confirmed every year. A projected date is not a commitment, and parts of the proposal could change or be dropped, so plan for the current rule and treat the proposal as the likely direction.

Outside the US, the same questions take a different legal form. In India there is no HIPAA, and patient call data falls under the Digital Personal Data Protection Act instead, as the guide to AI receptionists in Indian healthcare and patient-data rules explains.

Key dates