What Should a BAA Cover When a Medical Practice Uses an AI Phone Agent?
Every BAA needs HIPAA's required terms. A voice vendor's BAA should also answer what happens to recordings and transcripts, whether call data trains anything, and who the subcontractors are.
Ed
Luxury Medical, HIPAA, Business Associate Agreement, AI Phone Agent, AI Receptionist
A business associate agreement for an AI phone agent has to contain everything HIPAA requires of any BAA, and it should also answer the questions specific to voice: what happens to call recordings and transcripts, whether call data can be used to train or improve anything, and which subcontractors touch the call. HIPAA's required terms are set out at 45 CFR 164.504(e) and 164.314(a). They cover permitted uses and disclosures, safeguards, reporting of breaches and security incidents, flow-down to subcontractors, support for patients' access and amendment rights, return or destruction of data at the end, and the practice's right to terminate.
This guide describes what the regulations say. It is not legal advice; have your counsel or privacy officer review any BAA before you sign it.
Is an AI phone vendor a business associate?
If it handles protected health information for the practice, it fits the definition. HIPAA's definition of a business associate covers a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information" for a regulated function or activity. A phone agent that answers a practice's patient calls and records names, callback numbers and reasons for calling is creating and maintaining that kind of information. Confirm the analysis with your privacy officer.
HHS has applied the same logic to cloud services. Its guidance on HIPAA and cloud computing says a cloud service provider that handles ePHI is a business associate even if it stores only encrypted data and lacks the key, and that the covered entity must enter into a HIPAA-compliant BAA with it.
What HIPAA requires every BAA to say
Under 45 CFR 164.504(e)(2) and 164.314(a)(2), the contract must:
Establish the permitted and required uses and disclosures of PHI by the business associate.
Bar any other use or disclosure, except as the contract permits or the law requires.
Require appropriate safeguards, including compliance with the Security Rule for electronic PHI.
Require reporting of any use or disclosure not provided for by the contract, including breaches of unsecured PHI, and of any security incident.
Require that subcontractors who handle PHI agree to the same restrictions and conditions.
Make PHI available for patients' rights of access and amendment, and for an accounting of disclosures.
Make the business associate's practices, books and records available to HHS.
Require return or destruction of PHI at termination, where feasible.
Authorize the practice to terminate the contract if the business associate violates a material term.
On breaches specifically, 45 CFR 164.410 requires a business associate to notify the covered entity without unreasonable delay and in no case later than 60 calendar days after discovering a breach. That is an outer limit, and a BAA can set a shorter one.
Questions specific to an AI phone agent
The regulations set the floor. A voice vendor's BAA, or the service agreement it sits alongside, should also answer:
Recordings and transcripts. Are calls recorded? Where are recordings and transcripts stored, for how long, and who at the vendor can access them?
Training and improvement. Can call content be used to train or improve the vendor's models or anyone else's? The regulation says the contract may not authorize uses that would violate the Privacy Rule, so get the answer in writing.
Subcontractors. Telephony carriers, speech recognition, language models and hosting providers may all handle PHI. Which ones does the vendor use, and does each have its own BAA with the vendor? We map that chain in one signed BAA is not compliance.
Location. Where is the data processed and stored?
The structured record. Does the practice own the call log, and can it export it?
End of contract. What exactly is returned or destroyed, and how will you know?
Using HHS's sample provisions
HHS publishes sample business associate agreement provisions. HHS describes them as sample language only, says their use is not required for compliance, and notes that the language may be changed to reflect business arrangements. They are a reasonable starting point for checking that the required terms are present, not a substitute for the voice-specific questions above.
How the Watch handles this
The Thinking Robot builds AI phone agents, called the Watch, for businesses where a missed call is expensive. The luxury medical agent runs under a BAA on every tier. It does not triage, and it tells anyone describing an emergency to call 911. In Standing Watch and Silent Watch it routes callers who ask for a clinician in the order your written rules set. Call its demonstration line at (720) 676-0088.
Tiers and prices are on the services page, and build time to go-live is four weeks. The Line Audit is $300, credited against setup, or you can book a call.
Frequently asked questions
Does an AI receptionist need a BAA?
If it creates, receives, maintains or transmits protected health information on the practice's behalf, the vendor is a business associate under HIPAA's definition, and the practice needs a BAA with it before it goes live.
Can an AI phone vendor use patient call recordings to train its models?
Only as the BAA permits, and the contract may not authorize uses that would violate the Privacy Rule. Ask for the vendor's answer in writing and have counsel review it.
How quickly must a business associate report a breach?
Without unreasonable delay and no later than 60 calendar days after discovery, under 45 CFR 164.410. A BAA can set a shorter deadline.
Does a signed BAA make a vendor HIPAA-compliant?
No. A BAA is a contract that sets obligations. Compliance depends on whether the vendor, and every subcontractor in the chain, actually meets them.
Related guides
Sources
