HIPAA-Compliant AI Voice Agents: BAAs, PHI Handling and What Your Vendor Must Sign

A customer calls up a hospital and wants to fix an appointment. An AI phone assistant collects the customer's information like name, age, purposes of visiting the hospital, and anything else required. The conversation can be recorded, transcribed, summarized, and stored on any device.

That creates a question, healthcare organizations cannot afford to overlook “what happens to all that patient information after the AI voice agent receives it?”

Well, if the system creates, transmits, maintains, and receives protected health information (PHI) on behalf of a covered entity, HIPAA requirements can come into play. A vendor providing such services may qualify as a business associate and may need to enter into a BAA. For healthcare companies, a good understanding of these rules is very important before implementing a HIPAA compliant voice AI agent.

What Makes an AI Voice Agent Compliant with HIPAA?

A voice AI agent may sound like it is simply answering a phone call, but behind every conversation, there can be a trail of sensitive patient information. That information can move through multiple stages– from being captured during the call to being transcribed, stored, processed, or shared with other systems.

This is where HIPAA compliance becomes important, enabling covered entities and business associates to implement appropriate safeguards to protect the integrity, confidentiality, and availability of ePHI. For healthcare organizations, this involves a larger understanding of processes. For example:

• Call Recording: It stores everything; what happens with recorded calls, where are they stored, who can reach them, how long the calls are stored?
• Encryption: Is ePHI secure during storage and through data transfer between systems?
• Transcripts: If conversions are converted into texts, does the transcript contain PHI and how is that information protected?
• Integrations: Does the AI voice agent transmit data to a CRM, EHR, schedule or other health care application?
• AI Processors: Does the platform use any third-party AI, speech recognition or other processor services?
• Subcontractors: Is there any other vendor that would process or handle PHI and whether it appears to require contractual safeguards?
• Access Controls: Are restrictions on access to transcripts, summaries, patient conversations and other related records allow only authorized individuals to have access to them?
• Data Retention: Does the organization have control of data retention policies for transcripts, recordings, and other voice data?

When is the Voice AI Vendor a Business Associate?

Not every software vendor that works with a healthcare organization automatically becomes a business associate. What matters is what the vendor does with patient information.

If a vendor receives, creates, and maintains PHI on behalf of a covered entity, it may qualify as a business associate under HIPAA. HHS also notes that a software vendor that needs access to PHI to provide its service can be a business associate.

The healthcare organization may need a Business Associate Agreement (BAA) with the vendor if the later handles PHI at several points:

• Receiving the call: The patient shares information with the AI voice agent.
• Gain insights from the conversation: The platform is capable of analyzing speech from the patient and extracting any useful information from it.
• Generate a transcript or summary: The conversations can be documented as text or a summary for future references.
• Information storage: Recordings, transcripts, or any other voice-related data can be saved by the platform.
• Sharing data: Relevant details may be sent to another healthcare system or application.

All these articulate that BAA is not just another document to complete before deployment, it is a written agreement that helps establish how a business associate is permitted and required to use PHI and ensure what safeguards must be in place to protect it.

A BAA AI voice vendor should address areas such as:

• Safeguards of ePHI
• Responsibilities related to patient information
• Reporting of security incidents and breaches
• Permitted uses and disclosures of PHI
• Cooperation with applicable HIPAA obligations
• Subcontractor requirements
• Return or destruction of PHI when the relationship ends

HHS guidance also states that business associates must ensure relevant subcontractors agree to the same applicable restrictions and conditions when those subcontractors have access to ePHI.

What PHI Can a Voice AI Agent Handle?

Voice conversations may provide more insights than regular chat conversation. Depending on the business flow, it may receive information about the patient, generate transcripts, extract information relating to the health status of the patient, and dispatch it to any healthcare system for utilization.

This means a PHI voice agent can encounter different types of information during a single conversation, including:

• Patient names
• Dates of birth
• Appointment details
• Contact information
• Symptoms
• Billing information
• Test or treatment details
• Insurance information
• Medical history
• Provider information

Not each detail is necessarily PHI on their own. The context in which the information is collected and whether it can be connected to an identifiable individual also matters. However, when health-related information is handled by a covered entity or business associate, it can fall within HIPAA’s protections.

For example, a patient may tell an AI voice agent:

PHI does not always stay in one place during a voice AI interaction. A single conversation can move through several stages:

Different service providers or systems may handle each stage– one platform may process the call, another may convert it into text, and an AI system may generate the summary before the information is added to the EHR. This is why organizations evaluating healthcare voice AI compliance need to look beyond the call itself and understand what data the system creates and where that data goes.

What Should a Healthcare Organization Ask an AI Voice Vendor to Sign?

A healthcare organization should consider the security and contractual documentation surrounding the service, such as:

Business Associate Agreement

When a vendor is treated as the business partner entity, the organization should sign a business partner agreement first before giving access to PHI. The agreement should also stipulate uses and disclosures allowed as well as responsibilities related to incident reporting and other applicable duties or obligations.

Data Processing and Security Obligations

The contract and supporting documents should clearly specify how the vendor deals with the buyers’ information including security measures, access, storage, and usage of the information for business purposes. The specifics are especially important for AI processing.

Subcontractors or Subprocessor Commitments

In Voice AI, it is rare for the technology to be used alone, which is why there are many external parties involved in the process in different ways, including:

• Telephony
• Speech recognition
• Data storage
• AI model processing
• Cloud infrastructure
• Analytics

Conclusion