HIPAA Compliant AI Phone Agents: A Healthcare Guide

A HIPAA compliant AI phone agent is one deployed under a signed business associate agreement (BAA) with the vendor, with HIPAA's privacy, security and breach notification safeguards applied to every call that touches protected health information (PHI), and configured to collect and keep only what each call needs. Compliance belongs to the deployment, not to the software alone. The HHS Office for Civil Rights states that it "does not endorse, certify, or recommend specific technology or products," so there is no official HHS certification for a voice platform to hold.

This guide explains how HIPAA applies to AI phone calls as of October 2026 and how to configure an agent on Retell AI. It is not legal advice. Your privacy officer or counsel should confirm how the rules apply to your workflows.

When does an AI phone agent handle protected health information?

Nearly every patient call does. Under 45 CFR 160.103, PHI is individually identifiable health information that is transmitted or maintained in any form or medium. When a caller gives a name and date of birth to confirm an appointment, or asks for a prescription refill, the call is carrying PHI.

The same regulation defines a business associate as a person or company that "creates, receives, maintains, or transmits protected health information" on behalf of a covered entity. A voice agent platform transcribes, records and logs calls, which, read alongside HHS's cloud computing guidance, generally puts it in that group. Confirm the classification for your setup with counsel. HHS guidance limits the so-called conduit exception to "transmission-only services," and says a cloud provider that stores electronic PHI is a business associate "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data."

Direction does not change the answer. An inbound agent that answers a scheduling line and an outbound agent that places reminder calls both can create and store PHI on the platform, so both need the same agreement and the same safeguards.

What does a business associate agreement need to include?

HHS is direct about skipping it: a covered entity that uses a cloud service provider to maintain electronic PHI "without entering into a BAA with the CSP" is "in violation of the HIPAA Rules." Under 45 CFR 164.504(e), the agreement must, among other things:

• Set the permitted and required uses and disclosures of PHI.
• Require the vendor to use appropriate safeguards and comply with the Security Rule for electronic PHI.
• Require the vendor to report any use or disclosure the contract does not allow, including breaches of unsecured PHI.
• Require subcontractors that handle PHI to agree to the same restrictions.
• Require the vendor to make PHI available for patient access, amendment and accounting of disclosures.

Retell's BAA is available to self-sign at click-agreements.retellai.com, with no additional fee, and a signed BAA is required before any PHI is sent through Retell. Retell is also SOC 2 Type 1 and Type 2 certified, and its compliance docs point to a Compliance Trust Center for the certificates and reports. The overview of Retell's HIPAA compliance and BAAs walks through the agreement itself. For subprocessor lists or a custom security review, Retell's docs direct requests to its support team. Signing a BAA does not make a deployment compliant on its own: your policies, agent configuration and downstream systems still have to meet the rules.

Which Security Rule safeguards apply to a voice agent?

The technical safeguards at 45 CFR 164.312 apply to any system that holds electronic PHI, a voice platform included. They cover access control, audit controls, integrity, person or entity authentication, and transmission security. Integrity, for example, means protecting electronic PHI "from improper alteration or destruction," which matters when transcripts feed a patient record. Encryption is listed as an "addressable" specification under the current rule.

• Access control (45 CFR 164.312(a)): What the rule asks: Access only for people granted rights. Where it lives in Retell: Workspace roles: Admin, Developer, Analyst, Viewer.
• Transmission security (164.312(e)): What the rule asks: Guard ePHI sent over networks. Where it lives in Retell: TLS and SRTP options for SIP trunks (you configure).
• Minimum necessary (164.502(b)): What the rule asks: Limit PHI to the purpose. Where it lives in Retell: Data Storage Settings and PII scrubbing per agent.
• Breach reporting (164.410): What the rule asks: Vendor reports no later than 60 days after discovery. Where it lives in Retell: Reporting terms in the BAA; read before signing.

Access control in Retell runs through workspace roles (Admin, Developer, Analyst and Viewer), and Retell's pricing page lists role-based access control as an Enterprise plan feature. For transmission security on your own SIP trunk, Retell's SIP endpoint supports TLS transport with SRTP media encryption, which requires TLS. Retell's docs do not describe an audit-log setting, so ask any vendor, Retell included, how activity on stored calls is logged and how you can review it.

The Security Rule update HHS proposed in January 2025 is not final as of October 2026. The current safeguards still govern, including encryption as an addressable specification. Build to today's rule and watch the Federal Register for a final version.

How do you configure the agent to limit PHI?

The minimum necessary standard asks covered entities and business associates to "make reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose." It does not apply to disclosures to a provider for treatment. On a voice agent, the standard translates into three settings, all under the agent's Security & fallback settings → Data Storage Settings:

• Storage mode. Choose Everything, Everything except PII, or Basic Attributes Only. Basic Attributes Only stores metadata and no transcripts, recordings or logs.
• PII scrubbing. With Everything except PII, the categories you select (including medical_id, date_of_birth, person_name and address) are replaced with placeholders across the transcript, logs, dynamic variables and call analysis. The recording is beeped over at those moments, and the raw originals are deleted. Retell's docs describe this mode as excluding PII "when possible," so spot-check scrubbed transcripts before you rely on it. The data storage and PII scrubbing settings list every category.
• Retention. Set automatic deletion per agent, from 1 day to 2 years. The default is to keep data forever, so set a retention period that matches your records policy.

Here is how that looks for a reminder agent. Choose Everything except PII, then select person_name, date_of_birth and medical_id so staff reviewing transcripts see placeholders such as [person name 1] instead of identifiers. Selecting phone_number goes further: it removes the patient's number from the call record itself, so leave it off if your scheduling system needs the number to match the call. Set retention to the shortest period your records policy allows.

Three cautions apply. Webhooks still deliver transcripts and recordings to your systems after you opt out of storage, and the recording link in that webhook expires after 10 minutes, so the endpoint that receives it needs your own safeguards. Scrubbing is a minimization control, not HIPAA de-identification, which has its own standard at 45 CFR 164.514. And recording links do not expire by default, so turn on signed recording URLs, which expire after a period you choose between 1 minute and 7 days (24 hours by default).

Can an AI agent place reminder and outreach calls to patients?

Yes, but the Telephone Consumer Protection Act (TCPA) applies alongside HIPAA, and the FCC treats AI-generated voices as artificial voices under it. The FCC's rules include a carve-out for "health care" messages made by or on behalf of a HIPAA covered entity or its business associate. To a residential line, such a call needs no prior consent if the caller makes "no more than one call per day to each patient's residential line, up to a maximum of three calls combined per week" and honors opt-out requests. The FTC's Telemarketing Sales Rule likewise exempts prerecorded healthcare messages made by or on behalf of a covered entity or its business associate from its prerecorded-message restrictions. To honor opt-outs on these calls, turn on Do-not-contact Handling so a patient who says "stop calling me" is marked do-not-call, and place reminders through a path that checks that flag (batch calls do not).

Health care messages are also excluded from the written-consent requirement for telemarketing-style calls to mobile numbers. A non-emergency artificial-voice call to a mobile number still needs the patient's prior express consent, unless it fits the narrow, condition-bound exemption for certain free-to-the-patient healthcare calls at 47 CFR 64.1200(a)(9)(iv). Check with counsel which applies to your reminder program. The TCPA guide for outbound AI voice calls covers consent levels, opt-outs and calling hours in detail, and the consent and disclosure checklist turns them into launch checks.

What should you confirm before PHI touches a call?

Run through this list with your privacy officer before the first live patient call.

• BAA signed with the voice vendor before any call uses real patient data.
• Vendor's SOC 2 Type 2 report reviewed and subprocessor list requested.
• Storage mode and PII scrubbing categories set on every agent that handles PHI.
• Retention period set, with exports in place for records you must keep.
• Signed recording URLs turned on so links expire.
• Webhook endpoints, CRM and EHR destinations covered by your own safeguards and BAAs.
• Workspace access limited by role.
• Patient reminder volume within the TCPA health care message limits for residential lines, and consent checked for mobile numbers.

Business associates must report breaches to the covered entity "without unreasonable delay and in no case later than 60 calendar days after discovery," so agree on the reporting contact before launch. The notice must identify, to the extent possible, each individual whose unsecured PHI was involved, which is easier when call records are tied to patient IDs. The downstream systems matter too. If the agent reads from or writes to your EHR, the integration path carries PHI as well; the guide to connecting an AI voice agent to your EHR covers that setup.

Where do healthcare teams usually start?

A practical starting point is calls that follow a fixed script and carry limited PHI, such as appointment reminders, rescheduling and refill intake, with a transfer to staff for anything clinical. Those workflows let you prove the BAA, storage settings and escalation paths on lower-risk calls before the agent handles anything clinical. The healthcare page shows the patient call workflows Retell supports.

The quickest way to know whether your safeguards hold up is to test them on real patient calls under a signed BAA. Talk to Retell about a healthcare pilot.