What is HIPAA?

What it covers

The Health Insurance Portability and Accountability Act of 1996 is implemented through the HIPAA Rules in 45 CFR Parts 160 and 164. The Privacy Rule limits how protected health information (PHI) may be used and disclosed. The Security Rule sets safeguards for electronic PHI. The Breach Notification Rule requires notice after a breach of unsecured PHI.

The rules apply to covered entities, which 45 CFR 160.103 defines as health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with certain transactions. They also apply directly to business associates. A business associate is a person who, on behalf of a covered entity, creates, receives, maintains or transmits PHI for a regulated function, or who provides certain services to the entity that involve PHI.

PHI is individually identifiable health information that relates to a person’s health, to the care they receive or to its payment. A scheduling call to a clinic can produce it: a name and phone number tied to an appointment with a provider is already health information. The audio, the transcript and any logs of that call can hold PHI.

What it requires

A covered entity may let a business associate handle PHI only after obtaining satisfactory assurance that it will safeguard the information. Under 45 CFR 164.502(e) that assurance must be documented in a written contract, commonly called a business associate agreement (BAA), which must meet the content requirements in 45 CFR 164.504(e). A business associate that uses a subcontractor for PHI must get the same assurance from it. HHS notes that business associates are directly liable for some provisions of the rules.

HIPAA has no certificate. HHS states in its cloud computing guidance that the Office for Civil Rights does not endorse, certify or recommend specific technology or products. “HIPAA compliant” describes how an organization behaves and how it has signed up its vendors, not a status HHS grants. “HIPAA eligible” is a vendor phrase and is not a term the regulations define.

What it means for a voice agent

If an agent answers or places calls for a practice, hospital or health plan, every vendor in the call path that touches PHI is a candidate for a BAA. That can include speech recognition, speech synthesis, the LLM provider, the telephony carrier if it records, and the platform that runs the agent. Ask each one, in writing, whether it signs.

Design choices matter as much as paperwork. Decide what the agent may say before the caller is verified, send the fewest identifiers to tools and prompts, and settle how long audio, transcripts and logs are kept. See data retention and zero data retention. Outbound reminders raise the separate consent rules in TCPA and, where recordings are made, call recording consent.

A security attestation such as SOC 2 is evidence about a vendor’s controls. It does not replace a BAA. For a worked healthcare scenario, see the guide on conversational AI in healthcare.

Questions to ask counsel

1. Are we a covered entity, a business associate, or neither, for this deployment?
2. Which vendors in the call path need a BAA, and does each sign one that covers the services we actually use?
3. Does the audio or transcript of an ordinary scheduling call count as PHI in our case?
4. What retention period applies to recordings and transcripts, given state law and our own policies?
5. If a vendor says it keeps nothing, do we still need a BAA with it?

Related terms

• Data retention
• Zero data retention
• SOC 2
• GDPR

Guides

• Conversational AI in healthcare: patient calls

Use cases

• Healthcare
• HIPAA answering service
• Medical answering service

Sources

• HHS Office for Civil Rights, Business Associates guidance
• 45 CFR 160.103, Definitions (eCFR)
• 45 CFR 164.502(e), Disclosures to business associates (eCFR)
• HHS Office for Civil Rights, Guidance on HIPAA and cloud computing