Do You Need a BAA for an AI Phone Agent?

If your phone vendor records, transcribes or texts on your behalf, you may be handing patient details to a company you have no contract with. A business associate agreement (BAA) closes that gap. This post covers when a US practice needs a BAA for an AI phone agent, what the agreement has to say, and what to request before the first patient call reaches the vendor.

It is a plain overview for owners and office managers of US practices, not legal advice. Have your counsel review the final paper.

When does an AI phone agent vendor need a BAA?

A phone agent vendor needs a BAA when it creates, receives, maintains or transmits protected health information on behalf of your practice. An agent that answers patient calls, checks appointment slots, books visits and texts confirmations usually does all of that. If it does, the agreement should be signed before any call data reaches the vendor.

HIPAA's definition at 45 CFR 160.103 turns on 4 verbs. A business associate creates, receives, maintains or transmits protected health information for a covered entity, and the definition reaches downstream: a subcontractor that does the same for your vendor is also a business associate [1].

Now map that onto a single call. A patient phones to move an appointment. The agent hears a name, a callback number and often a reason for the visit. It checks your calendar, writes the new booking and sends a text with the time. Every step involves information tied to a person and to your practice. Whether each field counts as protected health information is a legal question, but the safe working assumption for a medical or dental practice is that call audio, transcripts, booking records and appointment texts are in scope.

The hours make this sharper. A week has 168 hours. A practice open 8 hours a day, 5 days a week, is staffed for 40 of them. An agent that covers the phone 24/7 is handling patient details through the other 128 hours, when nobody from your practice is in the building to watch what happens to them. The contract is what governs the vendor while you are away.

So the useful question about any phone vendor is simple: what does it touch, and does it keep it? Live forwarding with no storage is one thing. Recording, transcribing, logging and texting is another.

Why the conduit exception rarely covers a phone agent

Some vendors say they are a conduit, like a mail carrier, and so need no BAA. That exception is narrow. It covers transmission only, with storage no longer than the transmission itself requires. A phone agent that keeps recordings, transcripts or booking logs is storing your data, which puts it outside the exception.

The legal background is short. Congress made business associates directly liable for parts of HIPAA in the HITECH Act in 2009, and HHS put that into effect through the Omnibus Rule in 2013 [2].

A Holland & Hart summary of HHS commentary on that rule makes the boundary concrete. The exception is meant for courier services such as the U.S. Postal Service and UPS and their electronic equivalents, and an entity that maintains electronic health information for storage is a business associate even if it never views the information [3]. HHS also said the decision is fact specific, based on the service and how much access it needs [3].

For a phone setup, that often splits two ways. A carrier that only passes live audio may sit on the conduit side. The agent platform that transcribes the call, stores the recording and keeps a booking log does not.

A vendor that stores your call data is a business associate even if no person at the vendor ever listens to a call.

What must a BAA for an AI phone agent cover?

The contract terms come from federal rules, not from a vendor's sales deck. A BAA must say what the vendor may do with patient information, require safeguards, require reporting of problems, bind its subcontractors, support patient rights, open its records to HHS, and return or destroy the data when the contract ends.

The required terms sit in 45 CFR 164.504(e)(2) [4]. The contract must set the vendor's permitted and required uses and disclosures, and it may not authorize anything the practice itself could not do, with limited room for the vendor's own management and administration and for data aggregation [4]. Paragraph (e)(2)(ii) then lists 10 lettered obligations, (A) through (J). The last of those requires the vendor to return or destroy the information at termination, if feasible, and the contract must also let the practice terminate if the vendor violates a material term [5].

The Security Rule adds its own layer. Under 45 CFR 164.314(a)(2)(i), the contract must provide that the vendor will comply with the Security Rule and will make sure any subcontractor handling electronic health information agrees to the same through a compliant contract [6].

A McGuireWoods alert from 2024 suggests checking each BAA against the HHS sample provisions and against 5 rule sections: 164.410, 164.504(e), 164.524, 164.526 and 164.528 [7]. Those cover reporting, the core contract terms, and the patient's rights to access, amendment and an accounting of disclosures [7].

For a phone agent, read the permitted uses clause slowly. Ask directly whether the vendor may use your call recordings or transcripts to train or tune its models, and get the answer in writing. Then read the subcontractor clause and the termination clause, because those decide where your patients' details go and whether they come back.

The reporting clause deserves the same attention. The rule requires the vendor to report problems to you [7], but the contract is where you set the practical details. Ask who at the vendor will contact you, who at your practice receives the notice, and what the notice will include. A phone agent sees a lot of small, routine data, so agree in advance on what counts as an incident worth a call. Write your own contact's name into the file, and update it when your office manager changes. A clause that points at someone who left two years ago helps nobody on the day it matters.

Which vendors in your phone stack need a BAA?

Count every company that touches a call, not only the one you pay. A typical phone agent setup involves a phone carrier, the agent platform, a speech or language model provider, a text messaging provider and your scheduling system. Each one that stores or processes patient details needs a BAA, either with you or with your vendor.

The table below is a starting map. Status is fact specific [3], so treat the third column as a prompt for questions, not a ruling.

The downstream chain matters because the rules put the burden on each link. Your vendor's contract with its subcontractors has to carry the same restrictions and safeguards as your contract with the vendor [1] [6].

If you are comparing a phone agent with a traditional answering service, ask both the same questions, and see how the two categories differ on the work itself.

Ask for the subprocessor list in writing, then check that each name on it handles data under a signed downstream BAA.

What should you request before any call data flows?

Ask for the paperwork before any phone number is forwarded or ported. You want a signed BAA, the list of subcontractors that will see call data, the vendor's retention and deletion terms, how it reports incidents, and a written description of how clinical calls are handled. Until all of that is in hand, test only with dummy calls.

Timing matters for a practical reason. Once a live line points at the vendor, real patient calls arrive whether the paperwork is done or not. Running test calls with staff playing patients lets you hear the agent, check the booking flow and review the texts without exposing anyone's details.

Diligence does not stop at signature. Under 164.504(e)(1)(ii), a covered entity that knew of a pattern of activity amounting to a material breach by its vendor is out of compliance unless it took reasonable steps to cure it and, if those failed, ended the contract where feasible [4]. Keep the BAA, the subprocessor list and the vendor's security answers in one file, and review them when the vendor changes providers.

Ask the vendor to show its settings as well as its contract. Who at the vendor can open a recording? How long are transcripts kept? Can you turn recording off? A BAA is a promise. The configuration is how the promise is kept.

Two related items sit outside HIPAA. Appointment texts carry their own consent rules, so build to the strictest standard: one opt-out stops every message. And ask how the agent handles a caller with a clinical or urgent question. The answer you want is that it never books that call and never gives advice. It routes the caller to a person.

What a BAA does not do

A BAA moves specific duties onto the vendor in writing. It does not certify anyone, and it does not end your own obligations. There is no official HIPAA certification for software. Compliance comes from a signed agreement plus a configuration that matches it, and your practice still has to act if the vendor falls short.

Claims of a HIPAA certification are common in vendor marketing and rest on a misconception. The federal rules set out contracts, safeguards and duties [4] [6]. They do not set up a certificate a phone vendor can hold.

A vendor that advertises a HIPAA certification has given you a reason to ask more questions.

The stakes are real on both sides. Since the HITECH changes took effect through the 2013 Omnibus Rule, business associates carry direct liability for certain requirements [2]. Your practice keeps its own duties too, including the duty to act on a known breach of the contract [4]. Ask counsel for the current civil penalty amounts rather than relying on a figure from an older article.

Geography matters too. Everything in this post is US framing. A practice in the UK works under UK GDPR, an Australian practice under the Australian Privacy Act, and a US BAA confers nothing in Australia. If you run sites in more than one country, ask the vendor how it handles each.

Where Velaire Health fits

Velaire Front Office answers calls, checks live availability, books into your practice calendar and texts the patient the time. Because that work touches patient details, the BAA question applies to Velaire Health like any other vendor. Ask for the agreement and subprocessor list during your demo, and have counsel review both before go-live.

Velaire Health signs a BAA with your practice before we proceed with setup, so the agreement is in place before any patient call reaches the agent.

For subprocessors, ask which companies handle the call audio, the transcript, the language model and the texts, and which of them sit under a downstream BAA. Get that answer in writing before go-live, from us and from any vendor you compare.

The agent's limits are deliberate. A caller with a clinical or urgent question is never booked, and Velaire Health never diagnoses or gives medical advice. Those calls route to a human at your practice. Setup takes under 48 hours and needs no new hardware.

If you are still deciding whether a phone agent is worth it at all, start with what one unanswered call is worth to your practice. When you are ready to see the agent handle a call, put the BAA question to us directly in a demo.