All articles
Industry
Healthcare Voice AI: What HIPAA Actually Requires (and What It Doesn't)
Where the line is between front-desk automation and PHI, and how to architect agents that stay on the right side of it.
Hannah Brooks, Compliance Lead·December 18, 2025· 9 min read
🏥
What HIPAA covers
PHI = anything that identifies the patient combined with health information. A name plus an appointment time IS PHI.
Safe-by-design agents
- Use a BAA-covered TTS/STT path.
- Don't log raw audio beyond the minimum retention window.
- Tokenize patient identifiers before they hit the LLM context.
Where you can move fast
Appointment reminders, intake forms, billing balance lookups — all fine with the right BAAs in place. Symptom triage and clinical advice need physician oversight.