AI Voice Agents for Health Plans and Payers: Verify, Then Answer

AI voice agents for health plans answer member calls about benefits, ID cards, claim status and prior authorization status, and place outreach calls to current members. The agent verifies the member before sharing any detail and reads every answer from the plan's own systems. Dograh, the open-source AI voice agent platform we build, can run self-hosted on the plan's servers.

Key Takeaways

• Verify member ID and date of birth before any benefit or claim detail.
• Medicare Advantage plans may call current members, never cold-call prospects.
• Self-hosted Dograh keeps recordings on plan servers, so no Dograh BAA. Model providers need theirs.

Member services lines answer the same few questions all day, and nearly every answer is protected health information. Below, we cover which calls to automate first, the verify step, outreach rules for Medicare Advantage plans and where the call data sits, and how each part is set up in Dograh.

The member calls worth automating first

Start with the calls where the answer already sits in a plan system and a person adds little. A member asking what their plan covers for physical therapy, whether a claim was paid, where a prior authorization request stands or how to get a new ID card is asking for a lookup. Welcome calls to new members, which walk through the ID card, the member portal and how to find an in-network doctor, follow a fixed script and suit an agent well.

Plans that roll this out tend to go in phases, with routine questions and routing first and harder calls later. That order is right for a reason beyond comfort. Routine calls give you a few hundred transcripts to check before the agent hears a confused member with a denied claim.

The agent reads decisions and never makes them. A prior authorization status call reads what the plan's utilization team already decided, and a coverage question reads the plan's documents. Medical necessity, appeals and grievances stay with the plan's staff. This is the payer answering its own members, which is a different call from a home health agency checking a patient's eligibility with a payer.

Verify the member before any answer

Every member call follows the same order: greet, verify, then disclose. Under the Health Insurance Portability and Accountability Act (HIPAA), a health plan must verify the identity and the authority of anyone it does not already know before it discloses protected health information. On a phone line, that means the caller, every time.

A caller's number finds a likely record, but it proves nothing about who is speaking. Pre-Call Data Fetch on the Start Call node sends the caller's number to the plan's member system as the call connects, so the agent may know which member probably holds that line. The agent still asks for the member ID and date of birth, and an HTTP API tool checks both against the plan's system. Only after the plan's system confirms a match does the agent read anything back.

Authority is the second half. A spouse or adult child calling about a member's claim needs to be an authorized representative the plan already has on file, and the plan's system, not the agent, says so. If the check fails, the agent gives general plan information only and offers a person. Our post on verifying identity before a voice agent shares PHI covers the failed-check paths in more depth.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

Answers come from plan documents and systems

A member gets an answer from the plan's own sources, never from what the language model learned elsewhere. General plan rules, such as the summary of benefits, the evidence of coverage and the formulary, go in the Knowledge Base, which accepts PDF, DOCX, DOC, TXT and JSON files up to 5 MB each. Split a long evidence-of-coverage document by chapter so each file fits.

Member-specific answers come from the plan's systems during the call. An HTTP API tool asks the claims system for a claim's status, the accumulator service for how much of the deductible is met, or the utilization management system for an authorization's status. Each lookup calls the plan's own API, so the answer is as current as the plan's record.

Write the prompt so the agent says when it does not know. If a member asks whether a specific surgery will be covered, the honest answer is what the documents say about that benefit and that coverage depends on the plan's review of the request. Then the agent offers to send the question to a person.

Many members would rather speak Spanish or another language. Set speech-to-text to Multilingual (Auto-detect) in the agent's Model tab and write the Greeting Text in both languages, for example "Hola, hello", since it plays before Dograh can hear which language the caller speaks. Load the plan documents in each language the agent answers in, so a Spanish answer comes from the Spanish summary of benefits.

Outreach calls and the Medicare Advantage rules

Outbound calls carry most of the legal weight. The Medicare Advantage rules on contacting beneficiaries bar a Medicare Advantage plan from using cold calls, robocalls, text messages or voicemail messages for unsolicited contact. A call is not unsolicited when the person agreed to it or contacted the plan first.

Current members are a different case. A plan may call its own members about plan business, and must tell them in writing at least once a year that they can opt out of those calls. It may not use calls about its other lines of business to generate Medicare leads. Under HIPAA, a call describing a benefit included in the member's own plan is not marketing, unless a third party pays the plan to make it.

Consent matters too. Under the Telephone Consumer Protection Act (TCPA) rules, the FCC treats an AI voice as an artificial voice, so calls to mobile numbers generally need the member's prior express consent. The rules have a healthcare exemption with conditions, and whether a plan's own call fits it is a question to confirm with counsel before the first campaign.

In Dograh, outreach runs as a campaign. You set the retries (0 to 10) and the calling hours by weekday, in one time zone per campaign, so split the list by time zone. The plan's list enforces opt-outs, so remove anyone who opted out before each upload. Open with the plan's name, and if you also say it is an AI, as we argue in why a voice agent should say it is an AI, put it in the Greeting Text and switch off Allow Greeting Interruption so the full line plays.

Handing off to a person or the nurse line

Some calls need a person, and the agent should get the member there quickly. Transfer Call works on Twilio, Telnyx, Plivo, Cloudonix and Asterisk ARI. Dograh dials the destination while the member hears hold music and connects them once the destination answers. If the line is busy or nobody answers, the agent hears transfer_failed and the call continues, so it can record a callback request in the plan's system through an HTTP API tool.

The destination can follow the reason. Context Mapping picks the number from a value the agent gathered, so a clinical question goes to the nurse line and a billing dispute goes to member services. Have the agent write the reason to the plan's system before the transfer, so the person who answers can see why the member called. If a member describes a medical emergency, the agent tells them to get to safety and call 911.

Where member call data sits

Every recording and transcript of a verified member call holds protected health information. The HIPAA Journal's analysis of the federal breach portal found business associates involved in 43% of large healthcare breaches in the first six months of 2026. Each vendor that keeps a copy of the call is one more place a breach can start.

A business associate agreement delegates obligations and adds a duty to monitor the vendor, and it never transfers the plan's liability. Self-hosted Dograh runs on the plan's own servers, so no BAA with Dograh is needed. A model provider that hears the call needs its own BAA, a cloud host such as AWS needs one if the servers run there, and the phone carrier may need one depending on what it stores. Our post on which parts of a voice AI stack need a BAA lists each layer.

Dograh runs the call flow, tools and telephony as the orchestration layer, and you pick the speech and language models separately. Your own keys for hosted models move the contract, while the audio still reaches the provider. Open-weight models on the plan's servers keep the audio inside.

Recording can be switched off server-wide with ENABLE_CALL_RECORDING_UPLOAD, while transcripts are still saved, and the plan's own retention policy decides when both are deleted from its storage. Self-hosted Dograh has no per-minute platform fee, but servers, model keys and phone minutes still cost money. Dograh Cloud charges a 1¢-a-minute platform fee.

Where to start

Pick ID card requests and claim status calls for the first month. Both are lookups that test the verify step on every call, and a wrong answer is easy to spot in the transcript.

Then add a check to QA that flags any call where the agent gave a benefit, claim or authorization detail before the member was verified. Read the flagged calls with their full call traces, fix the prompt or the tool, and only then add welcome calls and outreach. A plan that can show every member was verified before any answer has the record its compliance team will ask for.