Now put an AI on your phone line.

Every call into a medical practice is potential PHI the moment a caller says their name and why they're calling. "Hi, this is Maria Lopez, I need to reschedule my colonoscopy" — that single sentence is protected health information: an identifier tied to a health condition and a service. An AI receptionist doesn't just touch PHI. It records it, transcribes it, sends it to a language model, stores it, and acts on it. So the question "is my AI receptionist HIPAA compliant?" is really five questions, and most vendors can only answer one of them.

Here's the 2026 answer — the fast verdict, the five questions, an ungated evaluation checklist, and how to actually run voice AI compliantly.

The short verdict

A generic AI phone agent is not HIPAA compliant by default. Voice AI for a medical practice can be HIPAA compliant — but only when every vendor in the chain signs a BAA, the AI is constrained by hard guardrails (not just a prompt), and every interaction lands in an audit trail.

"We use OpenAI" or "we're built on Twilio" is not a compliance answer. HIPAA doesn't evaluate the model; it evaluates the business associate relationship and the safeguards. An AI receptionist vendor that handles your calls is a business associate under 45 CFR § 160.103, full stop. No BAA, no deal — and a BAA alone is the floor, not the ceiling.

Why a phone call is PHI (and why voice AI raises the stakes)

Traditional answering services created HIPAA exposure too — but a human receptionist forgets. An AI receptionist creates artifacts:

• The audio recording of the call, retained by the telephony layer.
• The transcript, generated by a speech-to-text provider.
• The LLM exchange — the transcript sent to a language model, plus the model's response.
• The extracted data — name, phone, date of birth, appointment reason — written into a scheduling system or CRM.
• The logs at every hop.

Each artifact is PHI. Each system holding it needs to be covered. That's typically three to five vendors deep: the telephony carrier, the speech-to-text engine, the LLM provider, the orchestration platform, and wherever the results are stored. A single uncovered link — say, a transcription API used under a consumer terms-of-service that permits training on your data — is an impermissible disclosure on every single call. At a practice taking 80 calls a day, that's 80 violations a day, discoverable in one breach investigation.

This is the pattern OCR punished at URMC and Froedtert: not villainy, just PHI flowing to parties without the right agreements and safeguards. Voice AI multiplies the number of parties.

The five questions that actually determine compliance

1. Is there a BAA covering the entire pipeline?

Not just the vendor you signed with — every subprocessor that touches call audio, transcripts, or extracted patient data. Ask for the subprocessor list in writing. A trustworthy vendor publishes it. PilotPractice does: our trust center at trust.pilotpractice.com lists subprocessors, and we sign a BAA with every practice. We're SOC 2 audited and HIPAA compliant, with controls continuously monitored through Drata — meaning the evidence exists year-round, not just at audit time.

If a vendor hesitates on the subprocessor question, the honest translation is usually: "somewhere in our stack, your patients' calls flow through a service we don't have a BAA with."

2. Is the AI constrained by code, or just by a prompt?

This is where most 2026 buyers get fooled. Nearly every vendor will tell you their AI is "instructed not to give medical advice." A prompt is a suggestion. Under pressure from a determined or confused caller, language models drift. A patient asks "should I double my dose since I missed yesterday?" and a prompt-only system will eventually answer — and now your practice has an unlicensed entity dispensing medical advice on a recorded line.

Compliance-grade voice AI enforces boundaries in code, outside the model. PilotPractice's AI runs behind deterministic guard layers — a medical guard and a legal guard that screen what the AI is about to say before it says it, independent of the prompt. Medical advice, dosage questions, legal exposure: intercepted and redirected to staff, every time, not "usually."

3. What happens when the AI wants to send data out?

An AI agent that can look up appointments and send confirmation texts can, if misconfigured or manipulated, send PHI to the wrong place. The safeguard that matters is a fail-closed egress control: outbound actions are checked against policy, and when the check can't complete, the action is blocked rather than allowed. Fail-open systems pass audits on sunny days and leak on the day something breaks. PilotPractice's egress guard fails closed by design.

The same logic applies to autonomy. Our automated replies run through a deterministic gate with hard caps — no more than 6 automated SMS in any 24-hour window per contact, with human-in-the-loop escalation — so an AI can never spiral into spamming a patient. Rate limits are a HIPAA safeguard and a TCPA safeguard; if your SMS program touches marketing, read our HIPAA-compliant marketing automation guide for the full consent picture.

4. Can you prove what the AI did?

The Security Rule requires audit controls (45 CFR § 164.312(b)). For voice AI that means every AI interaction is logged: what was said, what the AI accessed, what actions it took. PilotPractice writes every AI compliance event to a dedicated compliance log, and every AI agent operates under per-agent permissions — the receptionist agent can check the schedule; it cannot browse clinical notes, because it was never granted the ability, not because it was asked nicely.

When OCR investigates, "we believe the AI behaved" is not a defense. Logs are.

5. Is your data isolated from other practices?

Multi-tenant AI platforms serve hundreds of practices from shared infrastructure. Ask how tenant isolation is enforced and tested. PilotPractice enforces tenant isolation at the data layer and runs an internal red-team command against it — we actively attack our own isolation to verify a client's AI can never read another client's data. If a vendor has never tried to break their own walls, assume they're breakable.

The AI receptionist HIPAA checklist (ungated — take it to any vendor)

1. Signed BAA with the vendor, covering AI processing explicitly — not a generic template that predates their AI features.
2. Written subprocessor list — telephony, speech-to-text, LLM, storage — with BAA coverage confirmed at every link.
3. SOC 2 report — and ask which type it is; a Type II report covers controls operating over time, not just a point-in-time design review — plus a public trust center you can verify yourself.
4. Deterministic guardrails in code for medical and legal boundaries — ask them literally: "if I delete the prompt instruction, does the block still work?"
5. Fail-closed egress controls on every outbound action the AI can take.
6. Hard rate caps and human-in-the-loop escalation on automated messaging.
7. Per-agent, least-privilege permissions — the AI can only touch the systems its job requires.
8. Complete audit logging of every AI interaction, retained and reviewable.
9. Tenant isolation that's adversarially tested, not just architected.
10. Data retention and training policy in writing — your patients' calls must never train someone else's model.
11. Call recording consent handled per your state's one-party/two-party rules.
12. A documented escalation path to a human for emergencies, clinical questions, and distressed callers.

If a vendor clears all twelve, you've found a real business associate. If they clear three and change the subject, you've found your next breach report.

Common voice AI compliance myths (2026 edition)

"The vendor is HIPAA compliant, so we're covered." No vendor makes you compliant. HIPAA obligations sit with the covered entity — your practice. A compliant vendor gives you a defensible pipeline; you still need the BAA executed, the risk analysis updated to include the AI, and staff who know when the AI escalates to them. The right vendor makes that paperwork short. It doesn't make it optional.

"The AI doesn't store anything, so there's no PHI problem." Transmission is disclosure. Even if the vendor genuinely retains nothing (verify that claim in writing — most retain transcripts for quality review), the audio and transcript still flowed through every subprocessor on the list. Each hop needs coverage regardless of retention.

"We'll just tell patients not to share health information with the AI." Patients call a doctor's office to talk about their health. A disclaimer nobody hears doesn't change what they say in the next breath; your architecture has to assume every call contains PHI, because most do.

"Our AI only does scheduling, so it's low-risk." Scheduling is health information. "Book me a follow-up with Dr. Chen in oncology" identifies a person, a provider, a specialty, and an ongoing course of care. The lowest-stakes use case a voice AI vendor will pitch you is already squarely inside HIPAA.

"HIPAA doesn't mention AI, so there are no AI rules yet." HIPAA is technology-neutral on purpose. The Privacy Rule's disclosure rules and the Security Rule's safeguard requirements apply to an LLM pipeline exactly as they applied to a fax machine. Waiting for an "AI rule" before taking this seriously is how practices end up as the enforcement example in someone else's blog lede.

What good looks like on an actual call

Compliance abstractions are easier to judge against a concrete call. A patient dials at 7:40 p.m., after close:

1. The AI answers on the first ring, identifies itself as an automated assistant, and asks how it can help.
2. The caller wants to move Thursday's appointment. The AI verifies the caller, checks real availability, and rebooks — using only the scheduling access its per-agent permissions grant.
3. The caller then asks whether they should stop a medication before the visit. The medical guard intercepts before any answer forms: the AI declines, flags the question for clinical staff, and confirms a callback.
4. Every step — the verification, the schedule change, the blocked medical question, the escalation — is written to the compliance log with timestamps.
5. The confirmation text goes out through the deterministic gate, inside the rate cap, from a properly registered number.

That's the whole standard in one call: useful where it's allowed to be, walled off where it isn't, and provable afterward. If a vendor can't walk you through their version of step 3 and step 4 in detail, steps 1 and 2 are just liability with good hold music.

"So should my practice even use an AI receptionist?"

Yes — and this is where the compliance-blog genre gets it wrong. The blogs stop at "get a BAA and be careful," as if the safe move were staying with voicemail. It isn't. Studies suggest practices miss somewhere between a quarter and 40% of inbound calls, and the missed 2 p.m. call is a patient who books with whoever answers at 2:01. The compliant move isn't avoiding voice AI; it's deploying voice AI that was built for healthcare from the first line of code.

That's what PilotPractice runs for medical practices: an AI receptionist that answers every call, books real appointments, and does it inside the compliance architecture described above — BAA signed, SOC 2 and HIPAA controls verified through our Drata-backed trust center, medical and legal guard layers screening every response, fail-closed egress controls, capped and human-supervised automation, per-agent permissions, tenant isolation with red-team verification, and a compliance log behind all of it.

And because voice is one door among several, the same guardrails govern our website chat and AI chatbots, and calls convert into booked visits through EHR-integrated online scheduling rather than a sticky note. It's one system, compliant by default — part of the full approach in our 2026 guide to HIPAA-compliant marketing.

You can run the twelve-point checklist against any vendor, including us. Or skip the procurement project: we run the whole channel for you.

Wondering what else on your website is leaking patient data? Run the free PHI scanner — it takes two minutes and the report is yours, ungated.

Ready to hear it answer? Book a demo and call our AI receptionist yourself.