HIPAA, recording and data use: AI receptionists compared

HIPAA and the business associate agreement

HIPAA applies to covered entities, which are health plans, health care clearinghouses and health care providers that transmit health information electronically in standard transactions, and to their business associates. A vendor that creates, receives, maintains or transmits protected health information for a covered entity is a business associate. HIPAA requires a written business associate agreement with it (HHS).

The agreement defines permitted uses of the information, safeguards, breach reporting and how the vendor binds its own subcontractors (HHS sample provisions). For an AI receptionist, those subcontractors can include telephony, speech recognition, the language model and hosting. See BAA and subprocessors.

Some providers offer a BAA on every plan, others only on higher tiers or on request. Check which plan the BAA belongs to before comparing prices.

Call recording: one-party and all-party consent

The federal Wiretap Act allows a call to be recorded when one party consents, unless the recording serves a criminal or tortious purpose (18 U.S.C. 2511(2)(d)). Most states follow this one-party rule.

Several states require the consent of all parties for at least some recordings. The RCFP Reporters Recording Guide lists California, Delaware, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, New Hampshire, Pennsylvania and Washington as primarily all-party states, Michigan at least for recordings by a third party. Connecticut and Nevada require all parties to consent for phone calls. Some states have exceptions or differing court interpretations (RCFP; for California see Penal Code 632). When caller and business are in different states, the stricter rule may apply.

AI receptionists usually record or transcribe calls. A short notice at the start of the call, such as "this call may be recorded", is the common approach. The table shows how each provider describes its handling. See two-party consent.

AI disclosure

Whether the agent must say that it is an AI depends on the state and on the type of call. Outbound calls with an AI-generated voice are calls with an artificial voice under the TCPA, as the FCC ruled in February 2024 (FCC 24-17), and generally need prior express consent. A greeting that tells callers they are speaking with an AI assistant is the simplest way to be transparent. The table shows whether each provider states that its agent discloses itself or lets you configure it.

SOC 2, language models and training

A SOC 2 report is an attestation by an independent CPA firm on a provider's controls, based on AICPA criteria (AICPA). Type II also tests whether controls worked over a period. Ask for the latest report and check its period and scope.

Most AI receptionists use language models from third parties. Which model provider receives call content, and whether that content is used to train models, belongs in the terms or data processing agreement. The FTC has warned that quietly changing terms to use customer data for AI training can be unfair or deceptive (FTC). See training on call data.

This page summarizes public rules and provider statements. It is not legal advice and does not replace a review of your situation.