HIPAA and voice AI: nine questions to ask a vendor
An AI agent that answers a patient line hears protected health information on almost every call. These are the questions we would ask if we were buying, including the ones we find uncomfortable to answer ourselves.
1. Will you sign a BAA before the first real call?
A vendor that handles calls where patients are identified is a business associate. The Business Associate Agreement comes before the pilot, not after it. A vendor that offers to "start with a quick test on your live line and sort out paperwork later" is telling you how it treats the rest of its obligations.
2. Who else touches the audio and the transcript?
A voice agent is a chain of services: telephony, speech-to-text, a language model, text-to-speech, storage. Each link may be a different company. Ask for the list of subprocessors and whether the vendor holds a BAA with each one that handles patient data. A vendor that cannot produce this list in a day does not know its own data flow.
3. What do you mean by "HIPAA certified"?
There is no such thing. HIPAA has no certification programme and no regulator issues one. If the phrase appears on a vendor's website, either they do not understand the rule or they are counting on you not to. Neither is a good sign.
4. Do you have a SOC 2 report, and can I read it?
There are three honest answers: yes and here it is, it is in progress and here is the timeline, or no. Watch for a fourth answer, where a vendor points to its cloud provider's SOC 2 report as though it were its own. Hosting on audited infrastructure is good. It is not the same as being audited.
For the record, ours is in progress. We say so on our security page.
5. Where are recordings kept, and who can listen?
Ask where recordings and transcripts are stored, how long they are kept, how access is controlled, and whether access is logged. Ask what happens to them when the contract ends.
6. Is our call data used to train models?
The answer should be no, in writing, for the vendor and for each model provider in the chain.
7. What does the agent do in an emergency?
Ask for the exact behaviour when a caller mentions chest pain or says they want to hurt themselves. Then ask to hear it on a test call. This should be a fixed rule at the top of the call flow, not something left to the model's discretion.
8. Does the agent say it is an AI?
It should, in the first sentence. Patients are more forgiving of an AI that is upfront than of one they catch pretending. We explain why in Should an AI receptionist tell callers it is an AI? Ask too what the agent does when a third party, such as an insurer, calls about a patient. The right answer is that it confirms nothing and passes the call to staff.
9. What can the agent get wrong, and how would we find out?
Every system misroutes some calls. The useful question is how you would learn about it. Look for a call log your own staff can review, a way to leave feedback on a specific call, and a vendor who tests changes against scripted conversations before they reach your patients.
Common questions
Is there such a thing as a HIPAA-certified AI voice agent?
No. HIPAA has no certification programme, and the U.S. Department of Health and Human Services does not endorse one. A vendor can be HIPAA-compliant, meaning it signs a Business Associate Agreement and implements the required safeguards, but a claim of being 'HIPAA certified' is a marketing phrase with no regulator behind it.
Does a voice AI vendor need to sign a BAA?
Yes, if it handles calls in which patients are identified or discuss their care. The vendor is then a business associate under HIPAA and a Business Associate Agreement is required before any real calls are routed to it.
Ask us these nine
We will answer all of them on the first call, including the ones where the answer is "not yet".
Book a Call