A HIPAA-compliant contact center handles PHI as the practice's business associate under a signed BAA and faces direct liability under federal rules. The Privacy Rule governs PHI use and disclosure, including caller verification and minimum-necessary access. The Security Rule sets administrative, physical, and technical safeguards for electronic PHI, including recordings and voicemail. The Breach Notification Rule sets reporting duties after an incident. The BAA binds the vendor and every subprocessor behind the service to those same obligations, including the speech recognition, language model, text-to-speech, and telephony providers powering an AI voice agent.

What Makes a Contact Center HIPAA Compliant

Compliance is not a certification the vendor holds. It is a documented set of safeguards, agreements, and operational controls the practice verifies before any patient call reaches the platform, whether in-house staff, an AI voice agent, or both handle the calls. The same requirements apply to after-hours workflows that handle PHI.

Where Contact Center HIPAA Compliance Breaks Down

A call center becomes a business associate the moment its staff or AI voice agent records, transcribes, stores, or routes a patient call.

The subprocessor chain is where practices most often miss a required agreement. The vendor on the invoice needs a business associate contract, and so does every provider behind the AI agent that creates, receives, maintains, or transmits PHI. Without a business associate contract in place for every provider behind the AI agent, any one of them can touch PHI on the first patient call, and the practice is liable for the exposure as the covered entity.

Requirements to Check in a HIPAA-Compliant Call Center for Medical Practice

Use this checklist, drawn from the HIPAA obligations covered in each section below. Each requirement applies to both human staff and any AI voice agent handling patient calls; where the two differ, the section calls out what the AI voice agent implementation specifically needs. Before go-live, request a document or watch the control run on a live call.

1. A Signed Business Associate Agreement (BAA) Before Any Data Is Shared

Sign the BAA before routing the first patient call. HHS treats holding PHI in a service without one as a HIPAA violation, so any call handled beforehand puts the practice out of compliance from that point on.

The HHS Model BAA sets specific deadlines the practice can require in its own contract: written breach notice within 30 calendar days, security incident reports within five business days, and notice of any new subcontractor receiving PHI within 30 days. For a third-party AI voice agent, require the BAA to name the model tier and state that PHI, including call audio, is never used to train models.

2. Encrypted Storage and Transmission for Every Patient Interaction

With the BAA and subprocessor contracts in place, the next requirement is protecting the PHI those providers hold: a voicemail or transcript a scheduler opens needs the same encryption as the patient's EHR record. Ask the contact center platform to show the encryption protocols for call audio and transcripts, as well as voicemail and the EHR data feed.

Write current recognized standards into the contract: encryption at rest and secure transport encryption for data in transit. The Security Rule requires the platform to implement encryption or document an equivalent control. Proper encryption can help protect PHI if an unauthorized person steals a recording, as long as the encryption keys remain secure.

3. Role-Based Access Controls Limiting Who Can View PHI

Role-based access controls limit who can view PHI and record which agent opened a patient's chart. In the platform's admin console, confirm that each agent has a unique user ID and permissions scoped to the PHI that role needs. Confirm separately that the platform prohibits shared credentials and requires verification of the identity and authority of anyone unfamiliar requesting PHI.

The practice can lose control of PHI access when a departing agent or an uncontracted overflow partner retains it. Set a documented deadline for revoking a departing agent's access. Require separate BAAs for overflow partners that handle PHI, then check the written prohibition on shared credentials. Have the contact center platform show caller verification on a live call before the agent reads anything back. Assort Health's AI agent runs patient-first identity verification before accessing or reading back PHI, and every session posts to the audit log under a unique ID.

4. Documented Training for Staff and Protocol Records

Every staff member completes HIPAA training before taking a call that touches PHI, and the practice keeps the completion record. The Security Rule requires security awareness training for everyone, including management, and a sanctions policy for violators, though it does not specify an annual interval.

Train new hires and retrain staff after any material policy change. Provide periodic reminders and keep training records for as long as HIPAA requires. Maintain logs by staff member name and dated curricula that cover caller verification and pretexting calls. For an AI agent, the equivalent of a training record is the protocol library it follows, and a change record for every practice rule it updates.

5. Audit Logging That Tracks Every Access Point

Audit logs let the practice answer a patient's question about who opened a chart. Ask for a sample log before go-live and confirm that every PHI event includes a user ID and timestamp, whether the actor is a staff member or the AI voice agent. The log must capture record views and changes in the EHR or practice management system. Changes include writes and deletions. It must also capture each AI agent session and every EHR call the agent makes mid-conversation.

Incomplete entries leave the practice unable to give the patient a clear answer. Review access records regularly because waiting until after a breach or relying on infrequent, ad-hoc checks can leave inappropriate access undetected. OCR's report to Congress names this as one recurring failure. Review the exact record format the AI voice agent vendor produces before verifying the audit trail.

6. A Clear, Tested Breach Response Protocol

A tested breach response plan is what turns audit logs into a same-day list of affected patients and accurate notices. Two things need to be in place before go-live: a written incident response plan the AI voice agent platform follows, and a recent tabletop exercise run against that plan with the practice in the loop.

The BAA carries the deadlines. A business associate must notify the covered entity without unreasonable delay after discovering a breach, and the clock starts when the business associate discovers it or when it should have, with reasonable diligence. Set a notification deadline shorter than the legal maximum, and hold the AI voice agent platform contractually responsible for the practice's notification costs when the breach originates with the platform.

7. Specialty-Specific Handling of Sensitive Patient Information

Specialty-specific rules govern the consent language before discussing or releasing specially protected records, and in-house staff and the AI voice agent must apply the same standard. Give the vendor the written rules for behavioral health and substance use lines, then have the AI voice agent use the required language on a live call before booking. Substance use disorder records under the federal Part 2 confidentiality rules require written consent for most disclosures, including treatment, plus a redisclosure notice with every release.

Confirm the AI agent's protocol library carries the same consent standards the staff follows. Otherwise, either party may release records under the wrong rule.

What the Practice Owes After a Contact Center Breach

When a contact center acting as the practice's business associate has a breach, the practice as the covered entity carries the notification obligations regardless of which party caused the breach. Those obligations include:

• HHS notification. The practice must notify HHS based on the breach's size and circumstances.
• Media notice for large breaches. Breaches affecting more than 500 residents of a state or jurisdiction require notice to prominent media outlets serving that area within 60 days of discovery.
• Written patient notice. Every affected patient must receive written notice on the same 60-day timeline.
• Patient identification and reconstruction. The practice must identify affected patients, reconstruct what PHI was exposed, and send accurate notices on time.

See the HHS Breach Notification Rule for the full requirements.

Business associates face direct enforcement as well. HHS can enforce HIPAA against business associates that fail to protect or report patient information, and

the Office for Civil Rights (OCR) has pursued such actions involving business associates and breaches of patient information, with resolution agreements reaching into the millions and multi-year corrective action plans.

How Assort Health Meets These HIPAA Requirements

Assort Health applies the same controls across its patient-call workflows and gives the practice a way to verify each one before go-live:

• Signed BAA and subprocessor coverage. Assort Health executes a BAA with the practice and maintains business associate contracts with every subprocessor behind the AI voice agent, including model, speech, and telephony providers.
• Encrypted storage and transmission. Call audio, transcripts, voicemail, and the EHR data feed are encrypted at rest and in transit, with specified protocols the practice can review.
• Role-based access with patient-first identity verification. Every user carries a unique ID with role-scoped permissions, and the AI voice agent verifies the caller before accessing or reading back PHI.
• Documented training and protocol change records. Assort Health provides a protocol library and a change record for every practice rule the agent applies, along with training documentation for the humans in the loop.
• Audit logs across every access point. Each AI agent session, EHR write-back call, record view, and change is captured with a user ID and timestamp for review.
• Tested breach response with contractual deadlines. The BAA carries a notification deadline shorter than the legal maximum, and the incident response plan is documented and exercised.
• Specialty-specific handling of sensitive information. Behavioral health, substance use, and other sensitive workflows follow the consent language and disclosure rules the practice configures.

Use real call-volume testing to confirm that gaps don't expose PHI across thousands of calls. Check identity and access records under full call volume, along with EHR write-back and audit logs. These records help the practice verify how the controls work during day-to-day operations, not just in a demonstration environment.

Book a demo with Assort Health to see identity verification, encryption, access controls, audit logs, and EHR write-back in action.

Frequently Asked Questions

Does HIPAA Apply to an AI Voice Agent by Default?

Yes. An AI voice agent that stores audio, transcripts, or scheduling data is a business associate, and it is compliant only when a BAA covers the services, uses, and disclosures involved. Any subcontractor that creates, receives, maintains, or transmits PHI must have a written business associate contract.

How Does a HIPAA-Compliant Contact Center Differ From a Standard Contact Center?

The difference is enforceable safeguards on every call that touches PHI. A HIPAA-compliant contact center, whether staffed by in-house people or an AI voice agent, verifies the caller before reading back PHI, logs each session in the audit log under a unique ID, and operates under a signed BAA that binds the vendor and its subcontractors. During a surge, a standard contact center may share logins or route overflow to a partner with no BAA.

What Must a Vendor Provide to Prove HIPAA Compliance?

A vendor must provide the full System and Organization Controls (SOC) 2 Type II report with its subservice organization carve-outs, the signed BAA with its contractual notification deadline, and the complete subprocessor list with a BAA confirmed for each subprocessor behind the AI voice agent. Do not route patient calls to the platform until you have all of these.