HIPAA and AI Phone Agents: the BAA and Data-Handling Checklist for Clinic Owners

The BAA is the whole conversation

A vendor can say its AI phone agent is “HIPAA-ready” in a sales deck. The document that actually matters is the Business Associate Agreement. A BAA is a signed contract where the vendor accepts responsibility for protecting patient information under HIPAA, and it is legally required before any third party handles your patients’ protected health information.

If a vendor will not sign a BAA, the evaluation is over. Everything else on this list is secondary.

What the BAA should spell out

A signed BAA is necessary but not sufficient. Read it for three things: what data the vendor admits to handling (call audio, transcripts, names, phone numbers), what safeguards they commit to (encryption in transit and at rest, access controls), and what happens when the relationship ends (data deletion timelines). Vague language about “industry-standard security” without specifics is a yellow flag. Ask for the specifics in writing.

Also confirm who else touches the data. AI phone agents run on voice infrastructure, transcription services, and language models, and each of those may be a sub-processor with its own BAA chain. A serious vendor can name its sub-processors. One that cannot has not done the work.

Call recordings and transcripts: where they live and for how long

AI phone agents record and transcribe calls by default, because transcripts are how the system logs appointments and messages. That means every call produces a stored record containing patient information. Before you sign, get answers to three questions: where are recordings and transcripts stored, who at the vendor can access them, and how long are they kept?

Retention matters more than most owners expect. There is no HIPAA rule that says “keep call recordings for exactly X days,” but HIPAA does require reasonable safeguards, and a vendor holding years of patient call audio in a system you cannot audit is a risk you own. Set a retention policy up front, and confirm the vendor can delete on schedule.

What the AI is allowed to say

Train the agent on what it may and may not discuss. It should be able to confirm appointments, take messages, and answer scheduling questions. It should not read back diagnoses, test results, or detailed clinical information. This is not a limitation of the technology; it is a configuration decision you make during setup, and it should be documented in your own policies.

While you are at it, document the escalation path. When a caller reports symptoms or asks a medical question, the agent should follow your practice’s protocol: gather the information, flag it, and get it to the right person. Our general HIPAA guide for clinics using AI receptionists covers the baseline; this checklist is the detail behind it.

The questions to ask on the call

When a vendor pitches your clinic, ask these in this order: Will you sign a BAA before the first call? Who are your sub-processors? Where is call data stored and encrypted? What is your retention and deletion policy? How do I configure what the agent may discuss with patients? What does your incident response look like if there is a breach?

A vendor that answers all six clearly is worth talking to. One that deflects on any of them is not. For more on how voice AI fits healthcare workflows, see AI voice agents for healthcare: what clinics need to know.

A note on scope

HIPAA compliance is not a feature you buy once. It is an ongoing arrangement between your practice and every vendor that touches patient data. The BAA, the retention policy, and the conversation limits are your part of the work. The technology handles the calls. You handle the governance.