HIPAA-Compliant AI? A Checklist for Practices Evaluating AI Phone Agents

An AI phone agent that answers patient calls hears names, dates of birth, appointment details, and sometimes symptoms. That is protected health information, so the agent falls under HIPAA the moment it handles a call for a covered practice. The question to ask a vendor is less “is your AI HIPAA compliant?” and more “show me how you meet HIPAA’s requirements for a business associate.” This checklist turns that into specific questions, each tied to the HHS guidance behind it.

This article is general information, not legal advice. Your compliance officer or counsel should review any agreement before you sign it.

Start with what “HIPAA compliant” can and cannot mean

There is no official HIPAA certification. The HHS Office for Civil Rights states that it does not endorse, certify, or recommend specific technology or products. A badge that says “HIPAA certified” was not issued by HHS.

What HIPAA does set out is a set of obligations for covered entities, such as your practice, and for business associates, the vendors who handle protected health information on your behalf. An AI phone agent vendor is usually a business associate. The checklist below follows from that.

The checklist

1. A signed business associate agreement, before any patient call

HHS guidance on cloud services says that a provider that creates, receives, maintains, or transmits electronic protected health information on a covered entity’s behalf is a business associate, even if it only stores encrypted data and lacks the key. Using such a vendor without a business associate agreement is itself a HIPAA violation.

Ask:

• Will you sign a business associate agreement, and when? It should be signed before production patient data moves, not after go-live.
• Does it cover everything the agent does: calls, recordings, transcripts, messages, and any data synced with our systems?

HHS publishes sample business associate agreement provisions that list what the contract must include, among them permitted uses, safeguards, incident reporting, subcontractor terms, and return or destruction of data at termination. Compare the vendor’s agreement against that list.

2. Subcontractors, named and covered

An AI phone agent rarely runs on one company’s systems alone. Telephony, speech recognition, language models, and cloud hosting may each be a separate provider. Under the Security Rule, a business associate must ensure that subcontractors handling electronic protected health information agree to the same requirements (45 CFR 164.314).

Ask:

• Which subcontractors process our patients’ calls or transcripts?
• Does each one have a business associate agreement with you?
• Is any patient data used to train models? If so, under what terms, and can we opt out?

3. Minimum necessary, applied to calls

The Privacy Rule generally requires limiting use and disclosure of protected health information to the minimum necessary for the purpose. For a phone agent, that becomes practical design questions.

Ask:

• What does the agent need to identify a caller, and what does it ask for beyond that?
• Which staff and which vendor employees can see call recordings and transcripts?
• How long are recordings and transcripts kept, and can we set that period?

4. Security Rule safeguards

The Security Rule’s technical safeguards cover access control, audit controls, integrity, authentication, and transmission security (45 CFR 164.312).

Ask:

• How is data encrypted in transit and at rest?
• How do you control and log access to call data, both for our staff and for yours?
• Can we get audit logs of who accessed what?
• Where is the data hosted?
• Has an independent third party assessed your HIPAA compliance? Which audits, such as SOC 2, are complete, and which are still in progress?

5. Your own risk analysis, updated

The vendor’s safeguards do not replace yours. HHS describes risk analysis as the foundation of Security Rule compliance and as an ongoing process, and it names new technology as a reason to revisit it.

Before go-live:

• Add the AI agent, the data it handles, and its subcontractors to your risk analysis.
• Record the risks you identified and what you did about them.
• Decide who at your practice owns the vendor relationship.

6. Breach notification, in writing

If a breach of unsecured protected health information happens at a business associate, the business associate must notify the covered entity without unreasonable delay and no later than 60 days after discovery. HHS’s sample provisions note that the parties may agree on a stricter timeframe in the contract.

Ask:

• How quickly will you notify us of a security incident or breach, and is that in the agreement?
• Who handles notifications to patients if the breach happens on your side?

7. Clinical boundaries

This one is not a HIPAA requirement, but it belongs on the same checklist. An agent that answers patient calls will hear clinical questions.

Ask:

• What does the agent do when a caller describes symptoms?
• Who wrote the escalation and emergency messages, and can we change them?

We cover this in detail in after-hours calls in kidney care.

How EigenH AI answers these questions

EigenH AI is HIPAA compliant, and an independent third party has assessed that compliance. We sign a business associate agreement with every practice, during scoping and before any production patient data moves. Our SOC 2 audit is in progress and not yet complete. Our security and compliance page sets out our posture and its sources, and we walk through subcontractors, data handling, and retention for your setup during the sales process.

The agents work inside the rules your practice approves. Clinical calls go to your escalation path; the agents do not triage symptoms or give medical advice. For the scheduling side, see the Scheduler.

Use the checklist on every vendor

Send these questions to every AI phone agent vendor you are considering, including us, and ask for the answers in writing. A vendor that answers them clearly and puts the important ones in the business associate agreement is giving you something you can verify. If you would like to go through the list with us, email our team or book a demo.