AI voice agents and HIPAA: what to ask a vendor.

HIPAA has no clause about AI, and the existing rules already cover it. A vendor that creates, receives, maintains or transmits protected health information on a practice’s behalf is a business associate and must sign a business associate agreement before it touches a call. HHS’s cloud guidance settled the edge case: a provider that only stores encrypted data it cannot read is still a business associate. A voice agent that hears the call, transcribes it and books the appointment is well inside the line.

The Security Rule applies to the vendor directly: risk analysis, access controls, audit logs, encryption as an addressable standard today. The proposed update published in January 2025 would make encryption, multi-factor authentication and annual penetration testing mandatory; HHS has pushed the final rule to 2027, and the current rule is still enforced in the meantime. A vendor that already meets the proposed standard has nothing to change.

Minimum necessary still applies. The agent should hear what it needs to book the visit and nothing it does not, and the transcript should be kept only as long as there is a reason to keep it.

1. Will you sign our BAA, or send yours, before any call is routed?
2. Where is the audio stored, for how long, and who can play it back?
3. Where is the transcript stored, and is it written into our EHR or kept in your system?
4. Is any call content, audio or text, used to train or tune a model, yours or a third party’s?
5. Which subprocessors handle the call: the telephony carrier, the speech model, the language model, the hosting? Are they all under BAA?
6. Is any of it processed or accessible outside the United States?
7. Is the call encrypted in transit and at rest? With what?
8. Who at your company can access our calls, and is that access logged?
9. Is multi-factor authentication required for every account that can reach our data?
10. What is in the audit log, and can we export it?
11. How do you notify us of a breach, and within how many days?
12. What happens to our data when the contract ends? Certificate of destruction?
13. Have you had a third-party security assessment? Which one, and when?
14. What does the agent do when a caller says something clinical, or is in distress?

Don’t put a vendor on a clinical line until it can answer all fourteen. Most of these questions apply to a live answering service too.

Three rules outside HIPAA reach the same phone line.

Outbound calls. The FCC ruled in February 2024 that a call made with an AI-generated voice is an artificial-voice call under the Telephone Consumer Protection Act. An agent that calls patients with reminders or results needs their prior express consent, in writing for anything that could be read as marketing, and must identify the practice and offer an opt-out. Inbound calls the patient places are not covered. Consent for reminders usually lives in the intake forms; check that it does.

Recording. Eleven states require every party’s consent to record a call: California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, Nevada, New Hampshire, Pennsylvania and Washington, with Connecticut and Michigan as special cases. Decide whether calls are recorded at all, and if so how consent is captured, before the agent goes live.

Disclosure. California’s AB 3030, in force since January 2025, requires a generative-AI communication that contains clinical information to say it was AI-generated and how to reach a person, verbally at the start and end of an audio interaction, unless a licensed provider reviewed it first. Scheduling and billing calls are exempt. Whatever the law, an agent that says what it is at the start of the call is the right default. This is a summary, not legal advice; check your state’s rules with counsel.

• Say it is an automated assistant, and how to reach a person, at the start.
• Verify the caller before reading anything back: two identifiers, every time.
• Book, reschedule, cancel, confirm, take a message, answer hours and directions.
• Not give clinical advice, not read results, not discuss medications. Anything clinical goes to a person with the context attached.
• Recognize distress and emergencies and hand off at once, with a scripted line for 911.
• Write what it did into the EHR, so the record is where the practice keeps records.

Our agents work in the practice’s own EHR and phone system. They run on our Google Cloud under a BAA, or in the practice’s own Google Cloud account if it prefers. The agent writes call content to the chart. No call trains a model, every action is logged, and we sign the BAA before any build starts. How we handle practice data.