What HIPAA Actually Requires From an AI Voice Platform, and Which Vendors Sign BAAs

Short answer: HIPAA doesn't certify software, so there's no official "HIPAA-approved" voice AI. If your practice is a HIPAA covered entity, a vendor that handles patient information for you is a business associate and needs a business associate agreement (BAA). The vendor needs its own BAAs with subcontractors that handle call data, such as speech and AI model providers. Which vendors sign? Terms differ, so check what each BAA covers and the safeguards behind it.

There is no official HIPAA certification

HHS has said it does not endorse or recognize private organizations' "certifications" for the Security Rule, and that such certifications don't remove a covered entity's legal obligations (HHS FAQ). So a vendor's compliance claim is a starting point. Ask what it rests on.

What HIPAA requires when an AI agent handles patient calls

1. A business associate agreement. If your practice is a HIPAA covered entity (for example, it bills insurance electronically), a vendor that creates, receives, maintains or transmits protected health information on your behalf is a business associate (HHS). An AI voice agent that handles patient calls for you, and especially one that records or transcribes them, does at least one of these. The BAA sets out what the vendor may do with the information, the safeguards it must use and what happens if there's a breach.

2. Coverage down the chain. A voice agent is usually several services working together: phone carrier, speech recognition, language model, voice, hosting and storage. Each one that handles the data on the vendor's behalf is a subcontractor and needs its own agreement with the vendor. The narrow "conduit" exception covers services that only transmit data without storing it, like a phone line, so it doesn't apply to services that record or transcribe.

3. Security Rule safeguards. The vendor must protect electronic patient information with administrative, physical and technical safeguards: risk analysis, access controls, audit logs, integrity controls and transmission security. Encryption is an "addressable" specification, which in practice means you should expect it in transit and at rest, or a documented reason why not.

4. Minimum necessary and identity checks. The agent should share only what's needed, and verify who's calling before discussing appointments, results or billing.

5. Breach notification. The BAA should say how quickly the vendor must tell you about a breach or security incident.

6. Limits on how the data is used. The BAA should spell out whether recordings and transcripts can be used to train or improve AI models, whether the vendor may de-identify them, and how long they're kept.

7. Return or destruction at the end. What happens to recordings, transcripts and logs if you leave.

Which vendors sign BAAs

Whether a vendor signs a BAA, and on what terms, depends on the type of vendor:

Questions to ask every vendor

1. Will you sign our BAA, or yours, before any patient call goes through the system?

2. Which subcontractors handle our call data, and do you have agreements with each one?

3. Are recordings and transcripts encrypted in transit and at rest?

4. Who can access recordings, and is every access logged?

5. How long do you keep recordings and transcripts, and can we set that?

6. Is any of our data, including de-identified data, used to train AI models?

7. How fast will you notify us of a security incident?

8. What happens to our data if we end the contract?

Beyond HIPAA: state rules

Several states, including California, Florida, Pennsylvania and Washington, require consent from everyone on a call before it's recorded. Some states also have rules about telling people they're talking with AI, some specific to healthcare. California's AB 3030, for example, can require a disclaimer at both the start and the end of an AI call about clinical information. What a notice must say, and when, varies by state. Confirm the details with your own counsel.

Where Innova fits

Innova designs, builds and runs voice AI agents for healthcare practices. We sign a BAA with the practice before launch.

Frequently asked questions

What does HIPAA compliance actually require from an AI voice platform?

If your practice is a HIPAA covered entity: a signed BAA with the vendor, the vendor's own BAAs with subcontractors that handle the call data, Security Rule safeguards such as access controls, audit logs and encryption (or a documented alternative, since encryption is currently "addressable"), limits on how the data is used, and breach notification. Your practice also has to include the system in its own risk analysis.

Which AI voice vendors sign BAAs?

Terms differ, so check each vendor. With a managed builder or a healthcare-specific product, ask for the BAA as part of the contract. Some DIY developer platforms require an enterprise plan or a paid add-on. Vapi, for example, listed a $2,000-a-month HIPAA add-on in October 2026. Always check what the BAA covers.

Is there an official HIPAA certification for software?

No. HHS doesn't endorse or recognize private "HIPAA certifications". Look for a signed BAA and evidence of the safeguards instead.

Does the AI model provider need a BAA?

Your BAA with the vendor doesn't cover it. If the language model or speech service handles patient information on the vendor's behalf, the vendor needs its own BAA with that provider.

Can an AI vendor use our patient calls to train its models?

Only as the BAA allows, so read it closely. Check two things: what the vendor may do with your patients' information, and whether the BAA lets the vendor de-identify it. A vendor can de-identify your data only if the BAA authorizes it. Once data meets HIPAA's de-identification standard, it's no longer protected health information, and HIPAA no longer limits its use, including for training AI models (HHS). Ask which method the vendor uses (Safe Harbor or Expert Determination) and how it treats audio, since Safe Harbor lists voice prints among the identifiers to remove. Put the answers in the contract.

Talk to us about your compliance checklist

Book a 30-minute working session with Innova. We'll walk through the questions above for your practice. Book a working session

This article is for general information and is not legal advice. Talk to your own counsel about your practice.