HIPAA voice AI: why one BAA is never enough

One BAA covers one company. A composed voice agent passes each call through a platform, a transcriber, a language model, a voice engine and a phone carrier, and US health-privacy rules treat every hop that touches patient data as a business associate needing its own signed agreement. Missing one signature has cost a clinic $750,000.

That figure is a real HHS settlement, and we will get to it. Groundwork first, because the acronyms hide a lot here.

A voice agent is a PHI machine

Protected health information, PHI from here on, is any health detail tied to an identifiable person. Not just medical records: a name next to an appointment time qualifies, and so does a phone number next to a symptom. Now think about an ordinary Tuesday call. A caller says who they are, why they are ringing, what hurts and when it started, and the system turns that into a recording, a transcript, a caller record and a stack of logs. All of it is PHI. The call is not a channel that brushes against health data. The call is the health data.

Two consequences follow. First, HIPAA (the US health-privacy law) requires written assurances before a supplier handles that data: HHS guidance says they “must be in writing, whether in the form of a contract or other agreement” (45 CFR 164.502(e) and 164.504(e)). That written assurance is the Business Associate Agreement, a precondition, not a nicety. Second, “we cannot read your data” is not an exit: HHS’s cloud guidance says a service holding encrypted patient data without the decryption key is still a business associate. If the audio passes through you, you are in the chain.

One call, five companies

The argument fits in a sentence: most voice agents are assembled from separate suppliers, and the law follows the data through every one of them.

The regulation text is blunt about it. The definition of business associate in 45 CFR 160.103 includes “A subcontractor that creates, receives, maintains, or transmits protected health information on behalf of the business associate”. HHS’s cloud guidance spells out the consequence: a cloud service subcontracted to handle patient data “itself is a business associate”, and a HIPAA-compliant BAA must sit at that link too. A chain, not an umbrella.

So walk one typical composed stack, hop by hop. Five companies touch each call, and the paperwork at every hop is published policy, not theory:

The scope lines under those signatures matter as much as the yes. Twilio’s BAA covers only its listed HIPAA-eligible products, on the right edition. Anthropic’s covers the first-party API and HIPAA-ready Enterprise plans, excludes consumer tiers and some API features, and requires 30-day retention on covered models. Google signs over a defined product list and tells you to switch off the rest when PHI is in play. A signature with a scope you have not read is a signature you do not have.

The platforms confirm the chain themselves. Vapi publishes a list of which speech-to-text, language-model and text-to-speech providers its HIPAA mode allows, a platform saying out loud that not every hop qualifies. And Trillet’s trust centre lists GCP, AWS, MongoDB Atlas and Twilio as subprocessors: four downstream companies behind one logo.

The enforcement receipts

HHS’s Office for Civil Rights has settled over exactly this paperwork, at both ends of the provider scale.

Read those two together. Neither settlement involved a hack. In both cases the violation was the missing signature itself: PHI went to a vendor, no BAA existed, and OCR treated that absence as the offence. The OCR Director’s line on the Raleigh case has aged well: BAAs are “more than a mere check-the-box paperwork exercise”.

The arithmetic sharpens it. A year of Vapi’s $2,000-a-month HIPAA add-on is 2,000 × 12, so $24,000. Genuinely dear, and still less than the $31,000 a small children’s practice paid over one missing agreement. The compliant path costs less than the settlement.

The conduit trap

There is one legitimate exception, and it is narrower than the vendors citing it. Skip this section if nobody in your stack claims to be just the pipes.

HHS waives the BAA for an organisation “that acts merely as a conduit for protected health information”: the US Postal Service, certain private couriers and “their electronic equivalents”. Then it boxes the exception in hard. It “is limited to transmission-only services”, access must be “only transient in nature”, and on whether a cloud service can be a conduit the answer is “Generally, no.”

Now the live example. Telnyx, a carrier that turns up in composed voice stacks, claims the conduit exception in its help centre and does not sign BAAs, while HIPAA is asserted in its site footer. We record Telnyx as hipaa: false: whatever the merits of the conduit argument for pure call transport, a healthcare buyer cannot get a signature there. Our read: if a carrier does nothing but carry, the exception is at least arguable; the moment recordings, transcripts, voicemail or logs sit with the carrier, it is not. If you need the carrier hop covered, pick one that signs. Twilio does, with the conditions above.

Who actually signs, across our directory

We track formal compliance positions for all 27 directory vendors: 17 record a documented HIPAA claim, 10 do not, and at least 4 of the 10 assert HIPAA somewhere in their marketing with nothing signable behind it. Below, the positions most relevant to a composed stack, dated; the HIPAA roundup ranks how usable each path is.

Which paths shrink the multi-BAA problem? My lean, matching our roundup. Bland bundles the model, the speech, the voice and the line under one vendor, so one signature covers the lot. Retell made the paperwork painless this month: self-serve and click-to-sign, at no fee. One honest wrinkle: its pricing page still showed “Custom BAA” under Enterprise at the same capture; the click-through agreement is the one that binds. Pipecat Cloud shows the structural fix: one BAA covering several hops because one company owns them. And Vapi’s $2,000-a-month add-on plus its compliant-provider list is the dearest path in the table but the most explicit about the chain underneath.

”SOC 2” is not “HIPAA”, and nobody is “HIPAA certified”

Two badge patterns to read past. SOC 2 first. It is an independent audit of a company’s security controls, genuinely worth having, and it says nothing about whether the company will sign a BAA.

Second, “HIPAA certified” does not exist. Google’s own compliance page says it flat: “there is no certification recognized by the US HHS for HIPAA compliance”. Any vendor using that phrase is selling wording, not paperwork.

The pattern in the wild: Cognigy’s marketing page claims HIPAA while its own Trust Center lists SOC 2 Type II, three ISO standards, TISAX, BSI C5 and GDPR, with HIPAA absent. Cartesia’s enterprise tier advertises SOC 2 and HIPAA; we could not open a certificate for either. My AI Front Desk offers a “HIPAA-ready configuration”, and “ready” is doing heavy lifting: no BAA offer is documented anywhere on the site. Trillet’s homepage carries a SOC 2 Type II badge while its own trust centre shows SOC 2 as “In progress”. We record all four as hipaa: false, not as an accusation but because there is nothing a buyer could sign or verify. The only sentence that matters is “we will sign a BAA on plan X”. Everything else is decoration.

What to do this week

Five concrete moves, in order.

1. Map the hops. Write down every company that touches a call: platform, speech-to-text, model, voice, carrier, plus any QA or analytics tool that reads transcripts. If you cannot name them all, ask the platform for its subprocessor list.
2. Collect signatures, not badges. For every supplier you contract directly, a signed BAA. For the hops your platform subcontracts, its written confirmation that its own agreement chain covers them. A verbal “we’re compliant” is worth nothing under the subcontractor rule.
3. Read the scope lines. Eligible products, plan editions, excluded features, retention terms: match what your agent actually uses against what each agreement covers, line by line.
4. Price the compliant tier, not the headline rate. Vapi is $2,000 a month on top of usage. ElevenLabs and Rime want Enterprise conversations. Synthflow starts at $30,000 a year. Put the compliance line into your cost-per-minute maths before you commit.
5. Re-check on a schedule. These positions move: Retell’s BAA went self-serve between our May and July captures, and Rime redesigned its pricing page after ours. Put a quarterly reminder on the file.

The honest limits

We report published positions with capture dates; we have not audited any vendor or signed these agreements ourselves. The captures run from 30 May to 12 July 2026 and vendors move: Rime’s BAA basis is a page since redesigned, and Retell’s docs and pricing page currently disagree, so treat every row as dated evidence, not permanent fact. Also, no OCR guidance specific to AI existed as of 12 July 2026; the cloud guidance quoted above is the closest on-point primary for hosted models. We are a benchmark site, not a law firm; the sources below are what you hand to your compliance counsel.

Next step: check your shortlist against the HIPAA roundup and each vendor profile’s sourced compliance detail. If your agent also takes calls in Europe, the AI-disclosure duty arriving on 2 August 2026 is separate law again; we walked it in our EU AI Act piece.