What HIPAA actually requires
HIPAA, administered by the US Department of Health and Human Services Office for Civil Rights, sets standards for the privacy and security of protected health information held by covered entities and their business associates. The relevant rules for phone-based AI tools are the Privacy Rule, the Security Rule, and the Breach Notification Rule. Any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a business associate and must enter into a Business Associate Agreement.
What "HIPAA-compliant" means for a vendor
There is no federal certification for HIPAA compliance. Vendors that state they are HIPAA-compliant typically mean they have implemented the technical safeguards required by the Security Rule (encryption, access controls, audit logging, secure data storage), have administrative safeguards in place, and are willing to sign a BAA. Operators should request the BAA and review the technical safeguards documentation rather than relying on a marketing claim alone.
The Business Associate Agreement
A BAA is a written contract that specifies how the business associate will use and protect PHI, what permitted uses and disclosures are, what safeguards are required, what to do in case of a breach, and what happens at contract termination. Any healthcare or healthcare-adjacent operator using an AI phone tool must have a signed BAA in place before any call data is processed. Vendors that decline to sign a BAA cannot be used for any workflow that touches PHI.
Practical configuration choices
Three configuration choices reduce HIPAA risk. Limit what the AI is allowed to collect. Most AI receptionists can be configured to only collect non-PHI inquiry data (general questions, appointment booking) and to escalate any clinical or health-record question to a human team. Minimize storage. Configuration options to delete call recordings and transcripts after a defined retention window reduce the volume of PHI held over time. Restrict access. Audit logging and role-based access controls within the platform limit who on the operator team can view call data.
When the question matters most
The HIPAA question matters most for skilled nursing, home health, hospice, assisted living with clinical services, dental, medical specialty, and behavioral health practices. For businesses that touch health information only incidentally (a daycare collecting basic allergy notes, a fitness studio collecting a release of liability), the HIPAA framework may not apply at all, though state-level health privacy laws still apply. Operators uncertain about their classification should consult a healthcare compliance attorney rather than relying on vendor guidance.