HIPAA and voice AI: evidence to review before patient calls

A voice assistant handling healthcare calls needs a deployment review, not a “HIPAA-ready” badge. The review must cover the organizations involved, the information processed and the complete service configuration. This article does not establish Burki's suitability for protected health information or offer a Business Associate Agreement.

Establish which relationships are in scope

HIPAA applies to covered entities and business associates as defined by the rules. It does not apply to every business merely because a conversation mentions health. Use the HHS explanation of covered entities and business associates with your privacy team to identify the relevant relationships.

Then draw the actual data path: telephone carrier, media service, speech/model providers, tools, transcripts, storage and support access. A provider key supplied by your organization does not by itself remove the application or media service from that path.

Ask for agreements that match the configuration

HHS explains that a cloud service processing or storing electronic protected health information on a regulated entity's behalf can be a business associate even when it cannot decrypt the data. The relevant agreement and responsibilities must therefore be assessed for the actual service, not inferred from encryption alone. See HHS cloud-computing guidance.

Ask who signs the agreement, which services and subprocessors it covers, and whether the selected model and recording arrangement fall within that scope. A contract available for another product or enterprise plan is not evidence for your chosen configuration.

Turn safeguards into acceptance checks

Ask your team to demonstrate who can read a transcript, download a recording, change retention, export data and view support diagnostics. Check the corresponding denial paths with a different organization. Document how access is removed when a staff member leaves.

Include deletion, backups, incident notification and the information sent to external tools. Recording-disabled does not necessarily mean transcript-disabled. A privacy review must cover both and any extracted fields.

The HHS Security Rule summary describes administrative, physical and technical safeguards. Your own risk assessment determines the operational work; no single checkbox replaces it.

A suitable first evaluation

Use fictional callers and public office information: opening hours, location and the published contact process. Do not enter patient names, symptoms, insurance identifiers or medical records into a trial while the deployment remains unapproved.

Burki provides editable drafts and browser practice, but those features are not evidence of healthcare authorization. Confirm the required agreements and controls before connecting patient traffic. For a procurement worksheet, use voice AI vendor security questions.