Building a HIPAA-Compliant Healthcare Voice AI Agent
A practical guide to deploying AI voice agents for healthcare use cases: appointment scheduling, patient reminders, and triage. Covers HIPAA requirements, PHI handling, BAA agreements, and architecture best practices.
AI voice agents are transforming healthcare operations. From appointment scheduling and medication reminders to post-discharge follow-ups and insurance pre-authorization calls, the use cases are compelling — and the stakes are high. A misconfigured voice agent that mishandles Protected Health Information (PHI) can result in HIPAA violations carrying fines from $100 to $50,000 per violation.
What makes a voice AI agent HIPAA-compliant?
- •All audio and transcripts encrypted in transit using TLS 1.3 or higher
- •PHI at rest encrypted using AES-256
- •Automatic transcript deletion after configurable retention period (30–90 days)
- •Audit logging of every access to call data with immutable timestamps
- •Business Associate Agreement (BAA) with all vendors handling PHI
- •No PHI in URL parameters, log files, or error messages
Business Associate Agreements (BAA)
Any vendor that handles PHI on your behalf must sign a BAA. For a voice AI pipeline, this includes your voice AI platform, your LLM provider, your STT provider, your TTS provider, and your telephony provider.
Not all LLM providers offer HIPAA BAAs. As of 2025, OpenAI offers a BAA for paid API plans. Anthropic offers a BAA for enterprise agreements. Groq does not currently offer a BAA.
Example: appointment reminder agent
{
"system_prompt": "You are an appointment reminder assistant. Confirm patient identity before discussing any health information. Never discuss diagnoses, medications, or test results.",
"hipaa_settings": {
"verify_identity_before_phi": true,
"allowed_phi_fields": ["appointment_date", "appointment_time", "provider_name"],
"blocked_phi_fields": ["diagnosis", "medications", "test_results"]
}
}Getting a HIPAA BAA with Ortavox
Ortavox Enterprise plans include a HIPAA BAA, data residency selection (US, EU, APAC), enhanced audit logging with 7-year retention, and a dedicated compliance review. Contact enterprise sales to begin — typical BAA review completes in 5 business days.