HIPAA and AI Phone Agents: Who Actually Signs a BAA, and What It Costs

Start here

Compliance is a contract, not a feature. If a vendor will handle protected health information on your behalf, they are a business associate, and you need a signed Business Associate Agreement before the first call — not a badge on a website, not a SOC 2 report, not a sentence in a sales deck.

Dentists, med spas doing anything clinical, and medical practices are all covered entities. An AI that schedules patients touches PHI the moment a caller says their name and why they are calling.

The chain nobody checks

Your AI receptionist vendor is one link. The call passes through at least four more, and every one of them handles PHI.

• The telephony carrier that terminates the call
• The speech-to-text service that transcribes it
• The model provider that reasons over it
• The text-to-speech service that answers
• Your CRM or practice management system, where it all lands

A signed BAA with your receptionist vendor covers you only if that vendor has BAAs down the chain. Ask them, in one sentence: "Which of your subprocessors handle PHI, and do you have a BAA with each of them?" A vendor who has done this work answers immediately. A vendor who has not will send you a security whitepaper.

The good news is that the major model providers do sign. As of 2026, OpenAI, Anthropic, AWS Bedrock, Azure OpenAI and Google Vertex all offer BAAs at business or enterprise tiers, and Twilio Programmable Voice is a HIPAA-eligible service under a Twilio BAA. The catch is scope: coverage typically attaches to specific endpoints and specific configurations. OpenAI's zero data retention, for example, is not on by default — an API call made without it configured sits outside BAA scope even when your organization has signed one. That is an engineering detail with legal consequences, which is exactly the kind of detail that gets lost between your practice and a vendor's third-party developer.

What compliance costs when you build

If you are building your own agent rather than buying one, the compliance line is published and it is not small.

Read that Vapi line again. $2,000 a month is more than most dental practices would spend on the entire front desk automation stack. For a single practice, it ends the build conversation. For a DSO running 40 locations it is a rounding error — which is precisely why the pricing is shaped that way.

This is the clearest case in the whole voice-agent market where buying beats building, and it is not close. A packaged vendor that already carries the BAA has amortized that cost across every practice on the platform.

What the vendors say, and what you can verify

A vendor publishing its BAA terms publicly, as Weave does, is doing something meaningfully harder than claiming compliance in marketing copy. Treat it as a real signal.

The claim to be sceptical of

You will see vendors advertise compliance with "the 2026 HIPAA Security Rule update." Check the premise.

HHS issued a Notice of Proposed Rulemaking on 27 December 2024 — the first substantial Security Rule rewrite in over twenty years, proposing mandatory encryption of ePHI at rest and in transit, required multi-factor authentication, 72-hour incident reporting, annual penetration testing, and expanded business associate oversight. OCR received roughly 4,745 comments, including formal requests from more than 100 hospital systems and provider associations — Cleveland Clinic, Yale New Haven, Advocate Health, the AMA — asking that it be withdrawn.

It is still not final. OCR's agenda listed final action for May 2026 and that date passed with nothing published; the regulatory agenda now shows July 2027.

So a vendor claiming to be compliant with a 2026 Security Rule update is describing requirements that do not yet legally exist. That does not make them a bad vendor — the proposed controls are sensible and building to them early is defensible. It does tell you their compliance messaging is written by marketing rather than counsel, which is worth knowing before you rely on it.

Meanwhile, the current Security Rule and the Privacy Rule are in force, unchanged, and are what you are actually accountable to today.

The design choice that shrinks the problem

Here is the cheapest compliance strategy available, and almost nobody uses it: keep clinical detail off the AI call entirely.

An agent that captures name, callback number, whether the caller is a new or existing patient, and a requested time slot is handling PHI — but a very thin, low-risk slice of it. An agent that asks "what seems to be the problem?" and records a symptom narrative is handling a completely different category of data, with a completely different breach exposure.

Scope your agent to scheduling. Route anything clinical to a human, immediately, by design. You still need the BAA. You will need far less of everything else, and your breach surface shrinks to a phone number and an appointment time.

Price it out before you decide

A two-location dental practice taking 900 calls a month at three minutes average: 2,700 minutes.

Built on Vapi with the HIPAA add-on. Hosting at $0.05/min is $135. Add models and TTS and call it $250 all in — then add $2,000/month for HIPAA. Total: about $2,250 a month, of which 89% is the compliance line.

Bought from a vendor who already carries the BAA. Somewhere between $150 and $800 a month depending on the product, with the compliance obligation sitting on the vendor's balance sheet instead of yours.

That gap does not narrow until you are running a lot of locations, and the reason is structural: compliance is a fixed cost, and fixed costs punish small deployments. This is the clearest buy-side case in the entire AI phone agent market.

What compliance drift looks like

A signed BAA on day one does not keep you compliant on day ninety. Three things go wrong, all quietly.

A configuration gets flipped. Zero data retention is a setting, not a state of being. Someone troubleshooting a broken integration turns on verbose logging, or switches to a model endpoint that is out of scope, and PHI starts landing somewhere your agreement does not cover. Nothing errors. Nothing alerts.

A subprocessor changes. Your vendor swaps transcription providers for a better rate. Their BAA chain may or may not have kept up, and nobody will tell you. Ask for contractual notice of subprocessor changes — most vendors will agree to it, and almost no buyer asks.

Retention outlives its purpose. Recordings accumulate. Default retention on most platforms is far longer than a practice needs, and every extra month is breach surface with no clinical value. Set the period deliberately, write it down, and check once a year that the system still does what you decided.

The objection you will hear

Ask about a BAA and a good number of vendors will answer a different question: "We're SOC 2 Type II certified and everything's encrypted."

That is a real answer to something else. SOC 2 is an attestation about a company's controls, commissioned by that company, against criteria it helped scope. A BAA is a contract in which the vendor accepts specific legal obligations to you regarding PHI — permitted use, safeguards, breach notification.

A vendor can be genuinely SOC 2 certified and still not be lawfully permitted to handle your patients' information. Encryption is a control; the BAA is the permission. You need both, and only one of them is a signature.

If a vendor deflects to SOC 2 twice, they do not have a BAA programme. Move on.

Your written checklist

Send this to any vendor before a trial, not after:

• Will you sign a BAA? Send the template now.
• Which subprocessors touch PHI, and do you hold a BAA with each?
• Where are recordings and transcripts stored, in what region, for how long, and can we set the retention period?
• Who at your company can access our call data, and is that access logged?
• Is zero data retention or PII redaction enabled by default on our account, or is it a configuration we must request?
• What is your breach notification timeline to us, in hours?
• On termination, what happens to our data and in what format do we get it back?

Any vendor unable to answer all seven in writing within a week is not ready to hold your patients' information.

Next step

The HIPAA voice intake workflow has the scoping pattern above written out as a build spec — what the agent captures, what it must refuse, and where the human handoff sits. For the surrounding stack, see the dental and med spa hubs, and the free AI Playbook for Dental Practices.

This is general information about vendor contracting, not legal advice. Run your BAA past counsel.