The Voice AI Healthcare Compliance Checklist: Residency, Redaction, and Zero Retention

A healthcare voice AI review comes down to five questions a demo cannot answer: where patient conversations are processed and stored, which subprocessors touch them, what is redacted and when, how soon data is deleted, and which documents prove each answer. This checklist takes them in that order, shows what Retell AI's documentation says as of November 10, 2026, and marks where the docs are silent so you know what to ask in writing.

It is written for the compliance or IT security lead at a healthcare group that takes patient calls in more than one country. It is not legal advice. Whether a deployment meets a country's health data rules is decided by your counsel and compliance lead, not by a vendor and not by this article.

Where are patient conversations processed and stored?

Ask for the location of each stage of the call, because a voice call is processed in several places before anything is stored. A complete answer names a country or cloud region for six stops:

1. Telephony: the carrier or SIP trunk that carries the audio.
2. Speech-to-text: the provider that transcribes the caller.
3. The LLM: the model that decides what the agent says.
4. Text-to-speech: the voice provider.
5. Post-call storage: recordings, transcripts, logs and analysis.
6. Your own systems: whatever your webhook receiver, EHR or CRM keeps.

What Retell documents: its custom LLM guidance says "Retell's primary infrastructure is in the US," its security and compliance page says it does not currently operate services within the European Union, and its privacy policy says personal information is primarily stored and processed in the United States.

What Retell's docs do not describe: a setting to choose a storage or processing region per workspace or per agent. Do not assume one exists. If a country you operate in requires in-country processing, raise it in the first conversation and get the answer in writing. The data residency glossary entry explains the terms your counsel will use.

Three documented options change where content sits:

• Store the content yourself. With the Basic Attributes Only storage mode, Retell keeps no transcripts, recordings or logs, and your webhook receives the call data so you can hold it in a region you choose.
• Run the model yourself. Retell's docs point to a custom LLM when prompts and transcripts must be processed inside your own infrastructure. Retell still handles telephony, transcription and speech synthesis.
• Bring your own carrier. Calls can reach Retell from your telephony provider via SIP trunking, so the carrier relationship stays yours.

None of these moves live speech processing, so the location questions still need answers.

Which subprocessors touch a patient call?

Ask for the named list, then ask which of those providers your specific agent configuration uses. Retell publishes its subprocessor list in its Trust Center. On November 10, 2026 it showed 34 entries, each with a purpose, including the cloud storage provider, AI model providers, speech-to-text services and text-to-speech providers.

Retell's docs also state that Retell has zero data retention (ZDR) agreements with its LLM, speech recognition and text-to-speech subprocessors, so those providers do not retain call data after processing it, and that those subprocessors must have a BAA and DPA in place with Retell and be HIPAA compliant.

Two gaps to close in writing:

• Regions. The public list gives a purpose for every entry but a location for only a few. Ask for the processing region of each provider your agent's chosen model, transcriber and voice will use.
• Telephony. The ZDR sentence covers LLM, speech recognition and text-to-speech. Retell's privacy policy says carriers may process certain data as controllers in their own right, for purposes such as billing and fraud prevention. Ask which carrier handles each country's numbers.

For what ZDR does and does not cover at each layer, see the zero data retention glossary entry.

What gets redacted, and when?

On Retell, redaction happens after the call, on what is stored. The live agent still hears and processes what the patient says. Under the Everything except PII storage mode, you select categories (the documented list includes medical_id, date_of_birth, person_name and address) and Retell replaces each occurrence with a placeholder in the transcript, public logs, dynamic variables, metadata, call analysis and tool call data. The recording is beeped over those intervals, and the raw originals are deleted.

Check four things before you rely on it:

• The docs describe this mode as excluding PII "when possible." Spot-check scrubbed transcripts in each language you serve.
• If you select no categories, the docs say Retell stores everything.
• Webhooks always carry the full, unscrubbed call data, whatever the storage setting. Your receiver is part of the review.
• Workspace roles matter. The Member role sees scrubbed history only; Admins and Developers can view raw transcripts and recordings.

The voice AI data map lists every field a call creates and which ones scrubbing never touches.

Can patient data be deleted immediately?

Not instantly, but on a documented schedule, and the shortest one is measured in minutes. Retell's docs describe four deletion paths, set per agent or per call:

The default is to keep data forever, so every agent that handles patient calls needs an explicit setting.

If your policy says "zero retention," compare its wording with the first row. Content is removed within minutes, while basic call attributes remain. Then ask what the docs leave open:

• Which fields count as basic attributes, and is the patient's phone number one of them?
• Does deletion reach backups, and on what schedule?
• How long does a Delete Call request take to complete, and can Retell confirm it in writing?
• What is the "basic metadata" kept after a retention period expires?

Deleting from Retell does not delete what your webhook already delivered. Your own retention schedule governs those copies.

Which documents should you request as proof?

Request documents, not assurances. A complete proof pack for a healthcare review has eight items:

• BAA. Retell is HIPAA compliant and offers a self-service BAA at click-agreements.retellai.com, at no additional fee. It must be in place before any PHI is sent.
• DPA. Retell's DPA includes EU Standard Contractual Clauses and is also self-service. Ask counsel whether other countries you serve expect a different instrument.
• SOC 2 Type 2 report. Retell's docs point to its Compliance Trust Center for certificates and reports. Read the audit period and any exceptions.
• Subprocessor list with regions. The public list, plus the regions you asked for above.
• Written location answers. One line per stop in the six-stop list.
• Model-training terms. Retell's security and compliance page has a section on this. Read it and get the terms that apply to your contract in writing.
• Deletion answers. The four open questions above, answered by the vendor.
• Your own configuration record. Storage mode, PII categories, retention period, secure URL expiry and role assignments for each production agent.

Retell's docs direct custom security reviews and vendor assessments to support@retellai.com. For the United States side, the HIPAA guide for AI phone agents covers agent configuration in detail.

What should you settle with counsel for each country?

Settle these seven questions per country before any patient there reaches the agent. A vendor can describe its controls; only your counsel or compliance lead can say whether they satisfy a national rule.

Because storage mode, PII categories and retention are set per agent, one practical pattern is one agent per country, each configured to that country's answers, with its own phone numbers and webhook destination.

How do you prove the answers before go-live?

Prove them on real calls with the compliance configuration switched on, not in a demo. Run a small pilot per country and verify three things yourself: the stored call shows only what the storage mode allows, a call past its retention period no longer appears in call history or API responses, and your webhook receiver holds exactly what your retention schedule says it should. The demo-to-production plan covers how to scope and score that pilot.

For the systems side of the same review, see the voice AI integration questions to ask before you sign.

Retell AI is the AI voice agent platform for contact centers, and its healthcare deployments run on the per-agent storage, redaction and retention controls described above. To see the patient call workflows it supports and start a pilot on your own calls, with your own compliance settings, see Retell AI for healthcare.