AI voice agents for hospitals and health systems are phone agents that book appointments, take intake details, read prep instructions, run follow-up calls and answer non-clinical questions, reading and writing your own systems during the call. They collect, remind and route. They never diagnose or advise, and every clinical question goes to a nurse or clinician.
Key Takeaways
- The agent collects, reminds and routes. Clinical questions go to a nurse.
- Verify the patient before naming any appointment, result or medication.
- Self-hosting Dograh with open-weight models keeps patient call data on your servers.
A patient call carries protected health information from its first sentence, so this guide starts with who holds that information. Then it walks through every call a voice agent can take in a hospital or health system, grouped the way patients meet you: before a visit, during care and after it.
Own the patient data before you automate the call
Patients still phone their providers. In a December 2025 MGMA Stat poll of 236 practice leaders, phone access ranked third among 2026 patient access priorities at 22%, close behind no-shows (27%) and online scheduling (24%).
Every one of those calls is full of protected health information (PHI): a name, a date of birth, the clinic, the reason for the visit, sometimes a medication. The recording and the transcript keep all of it, and every vendor that stores them is one more party that can lose them. TechTarget's review of the Department of Health and Human Services (HHS) breach portal counted more than 35 million people affected by large healthcare breaches reported in 2025.
Dograh, an open-source, self-hostable voice agent platform, lets a hospital run the call platform on its own servers. Dograh is the orchestration layer: it runs the call flow, tools and telephony, while the speech and language models are a separate layer you choose. During a call, an HTTP API tool reads your schedule or patient record; after it, a webhook writes the outcome back.
When you self-host, here is who needs a business associate agreement (BAA):
- Dograh: none. Dograh never receives the PHI.
- Model providers you use by API key: each needs one, unless the models run on your servers too.
- Phone carrier: may need one, depending on what it stores.
- Cloud provider (AWS, Google Cloud, Azure), if your servers run there: needs one.
Patient audio stays inside your infrastructure only when both Dograh and open-weight models run on your servers. A BAA never transfers your liability under the Health Insurance Portability and Accountability Act (HIPAA), and compliance depends on how the deployment is set up; our post on HIPAA-compliant voice AI for hospitals works through it layer by layer. Dograh has no retention setting, so your own policy decides how long recordings and transcripts are kept. Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost); Dograh Cloud has a 1¢-a-minute platform fee. The wider privacy case is in Why Voice Data Needs to Stay Local: Privacy, PII, and Biometric Risk, and our page on self-hosted voice AI for regulated industries shows the setup.
Collect, remind and route: what the agent may say
The agent has three jobs, and medical advice is never one of them:
- Collect: the reason for the call, the patient's details, the answers to a care team's checklist.
- Remind: appointment times, arrival instructions and next steps, read from your own system, never the model's memory.
- Route: to a booking, the nurse line or an emergency instruction.
It never diagnoses, doses or interprets a symptom, and any clinical question goes to a nurse or clinician. ECRI put the misuse of AI chatbots at the top of its 2026 list of health technology hazards. It tested consumer chatbots, not phone agents, but the lesson carries over: a model allowed to answer clinical questions will eventually answer one wrongly.
Greet, verify, disclose. Write the Greeting Text to name the provider and say the caller is speaking with an automated assistant; Dograh plays exactly what you write. It plays before verification, so it never mentions an appointment or a test. Patients expect this: in a November 2025 Verasight survey, 86% of US adults wanted to be asked or told when AI is used in their clinical care. Then the agent verifies with the date of birth plus one reference, such as the appointment date, never a Social Security number. A phone number finds the record; it does not prove who is calling. HIPAA's 45 CFR 164.514(h) requires providers to "verify the identity of a person requesting protected health information".
The emergency line is fixed wording. Once the emergency pathway is chosen, its Transition Speech plays "hang up and call 911" exactly as written: fixed text, or a recorded clip on speech-to-speech models. Choosing the pathway is still the language model reading a short, explicit condition, so test it on real calls.
A person must always be reachable. Transfer Call puts the patient through to a nurse or the front desk. It works on Twilio only and passes no summary, so the agent writes the details to your system first. If nobody answers within 30 seconds (the default), the patient stays on the call and the agent writes a callback request to your system. The full flow is in AI voice agents for post-discharge follow-up.
Voice agents by care setting: telehealth, dental and home health
The calls change with the setting, so the guide splits by setting first. Telehealth patients need the visit booked, a reminder with the join link and a quick check that their device works, then a follow-up after the visit. Dograh has no SMS tool, so the join link is sent by the clinic's own system or by an HTTP API tool calling a messaging provider. Our post on AI voice agents for telehealth covers each of those calls.
A dental practice runs a different call mix: bookings, reminders, recall and treatment-plan follow-up. The post on AI voice agents for dental clinics sets out which of those to automate first. Answering the front-desk phone itself is covered in AI Voice Agents for Dental Reception and Call Answering.
Home health care happens at the patient's address, so most calls are about visit windows. The agency's scheduling system starts the call through the API Trigger, the agent confirms the window with the patient or a family member, handles a running-late notice or a reschedule, and writes the result back. That is AI voice agents for home health visit coordination, and our page on self-hosted voice AI for home health agencies shows the setup.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Build it yourself or choose a platform
A health system can configure a rented platform or build its own agent on an open-source one, and the choice decides who holds the call data for years. Our tutorial on how to build a voice agent for healthcare walks through an inbound appointment agent in Dograh step by step. Pre-Call Data Fetch finds the patient by phone number when the call starts. A verification step runs before any health detail is spoken. An HTTP API tool reads and books live slots in the scheduling system, and a webhook writes the booking back after the call. You test it on a web call first, then on a real phone line, because most phone calls still reach the agent as 8 kHz audio and that changes what the speech model hears.
If you would rather compare before you build, the roundup of the best AI voice agents for healthcare ranks eight platforms on stated criteria: open source, self-hosting and on-prem, BAA terms and cost. Every vendor claim in it comes from the vendor's own current page.
Whichever way you go, the integration pattern is the same: read during the call, write after it, and keep your own system as the record. Our guide to Integrating Voice Agents With Your Stack covers the mechanics, so the posts in this guide link to it rather than re-teaching them.
Patient calls before a visit
Most patient calls happen before anyone is seen, and they are the safest place to start. The first is the booking itself: new appointments, reschedules and cancellations against the live calendar. The agent verifies the patient before discussing any appointment, reads open slots through an HTTP API tool and writes the result back. The flow is in AI voice agents for patient appointment scheduling.
Intake comes next. The agent collects the reason for the visit and the patient's details, then routes by your own triage rules: book a slot, send the call to the nurse line, or play the emergency instruction. It collects and routes; it never decides what a symptom means. Our post on AI voice agents for patient intake and triage shows how to write those rules so the agent follows them.
Before a procedure, patients need the arrival time, the fasting rules and what to bring. Those details come from the hospital's system, never the language model's memory, and the agent reads them back to confirm the patient understood. Per-patient instructions are spoken by the agent from your data, because Transition Speech cannot carry per-patient details and Greeting Text plays before verification. Questions about the procedure go to clinical staff. See AI voice agents for pre-op instructions.
Reminder calls that cut missed appointments are covered in our published post, Healthcare No-Show Reduction: Why AI Voice Agents Beat Reminders.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Patient calls during care: support lines and call centers
Some calls are not about a visit at all, only a question the patient needs answered. A single clinic's or hospital's support line answers non-clinical questions such as opening hours, directions, parking, visit preparation and billing basics from the agent's Knowledge Base. It takes PDF, DOCX, DOC, TXT and JSON files up to 5 MB each, so the documents your front desk already uses can feed it. The agent verifies the caller before any account detail. A balance can be read only on an inbound call, after verification, from your own billing system through an HTTP API tool. Clinical questions go to a person. That is AI voice agents for patient support lines.
Large health systems run these calls through a contact center with queues, staffing models and routing rules. That operation has its own post, AI Voice Agents for Healthcare Call Centers: Patients Still Call.
Patient calls after a visit
The calls after care are where a voice agent can catch problems early, and where the medical-advice rule is tested hardest. After a virtual visit, a short check-in asks how the patient is doing and whether the next steps are clear. The answers are recorded as extracted variables and sent to the patient record by webhook, and any symptom goes to a nurse. Our post on AI voice agents for post-visit follow-up in telehealth covers the design.
After a hospital stay, the follow-up call usually comes 24 to 72 hours after discharge. The agent works through the care team's own symptom checklist, asks about medications and checks that the follow-up appointment is booked. A red-flag answer goes straight to a nurse, with the details written to the system first. The full flow, including what happens when the nurse line does not answer, is in AI voice agents for post-discharge follow-up.
Medication calls ask whether the patient is taking the medication as prescribed and what gets in the way, such as cost, side effects or confusion. The agent records the answers as the patient stated them, sends side effects to a clinician and never advises on dosing. That is AI voice agents for medication adherence. Refill timing at the pharmacy counter is a separate call, covered in AI Voice Agents for Prescription Refill Reminders in Pharmacy.
The last call is the survey: one rating and one open question, with the answers sent to the survey system or customer relationship management (CRM) system by webhook. The agent records what the patient said and never scores a clinician. A quality assurance (QA) node reviews a sample of calls. See AI voice agents for patient surveys in telehealth.
Specialty care: behavioral health, medical equipment and dental recall
Three specialties carry rules of their own, so each has its own post. Behavioral health intake handles first-contact calls to mental health practices: intake questions, insurance basics and booking. Crisis or self-harm language gets an immediate human handoff and the 988 Suicide and Crisis Lifeline, in fixed wording once the crisis pathway is chosen. The data here is the most sensitive in this guide, and federal rules at 42 CFR Part 2 add protections for substance use disorder records, which makes the self-hosting case strongest. Read AI voice agents for behavioral health intake and triage, and our page on self-hosted voice AI for behavioral health practices shows the setup.
Durable medical equipment (DME) suppliers call about continuous positive airway pressure (CPAP) supplies, diabetic supplies and similar orders. Resupply eligibility is read from the supplier's own system and never decided by the agent, which only confirms the order and the delivery address and writes the result back. The Medicare rules are covered in AI voice agents for DME order and resupply reminders, and our page on self-hosted resupply calls for DME suppliers shows the setup.
Dental recall is outbound only: calls to patients due for a cleaning or check-up. The due list comes from the practice management system through Campaigns, as a CSV upload, or through the API Trigger, and the booking goes through an HTTP API tool. Because it is outbound, consent comes first, as the next section explains. That is AI voice agents for dental recall and recare outreach.
Consent before any outbound patient call
The Telephone Consumer Protection Act (TCPA) generally requires prior express consent before a call made with an artificial or prerecorded voice reaches a mobile number, and the Federal Communications Commission (FCC) treats an AI-generated voice as an artificial voice.
The FCC's healthcare exemption, 47 CFR 64.1200(a)(9)(iv), covers calls "by, or on behalf of, healthcare providers" only when every condition is met:
- Who: "only to the wireless telephone number provided by the patient"
- Why: "strictly limited" to "appointment and exam confirmations and reminders, wellness checkups, hospital pre-registration instructions, pre-operative instructions, lab results, post-discharge follow-up intended to prevent readmission, prescription notifications, and home healthcare instructions"
- No money talk: "may not include accounting, billing, debt-collection, or other financial content"
- Short: "generally one minute or less in length"
- How often: "only one message... per day to each patient, up to a maximum of three voice calls or text messages combined per week"
- Opt-out: a live call needs "an automated, interactive voice- and/or key press-activated opt-out mechanism"; a voicemail must leave "a toll-free number"; opt-outs are honoured "immediately"
What that means in Dograh, generally:
- Opt-out by voice. There is no keypad tool, so the agent asks whether the patient wants to stop these calls and writes a yes to your system at once.
- Voicemail: leave a toll-free opt-out number, or no message. In the agent's Settings, turn on "Enable voicemail and screening handling" and choose "Disconnect the call" (the default).
- Provider's name and contact go in the Greeting Text.
- No balances or payments on exempt calls.
- One a day, three a week: Campaigns has no per-patient cap, and its retries can land the same day, so your own call list must enforce the limit, or set retries to zero.
A call that runs longer than a minute, discusses money or promotes a service generally falls outside the exemption and needs the patient's prior consent. This is informed commentary, not legal advice; confirm with counsel before the first outbound campaign.
Compliance, language and country, then where to start
The last three posts in this guide change the rules around the call without changing the call itself. Our post on HIPAA-compliant voice AI for hospitals covers PHI in audio, transcripts and recordings, the BAA every vendor that touches PHI needs, the minimum necessary standard and access controls. Under 45 CFR 164.502(b), a covered entity "must make reasonable efforts to limit protected health information to the minimum necessary", which for a voice agent means asking only for what the call needs.
Language is the second. Spanish-speaking patients in the US need the same calls in Spanish, with switching between Spanish and English on the same call. Dograh follows the switch when speech-to-text is set to Multilingual (Auto-detect) with English and Spanish as language hints and a Spanish-capable voice is chosen. QA summaries come out in English by default, which suits most review teams. Our post on Spanish AI voice agents for healthcare names only speech providers verified to support Spanish.
Country is the third. HIPAA is US law and does not apply in the UK, where providers work under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and National Health Service (NHS) data security expectations. Self-hosting Dograh in a UK data centre keeps patient data in the country, as long as the speech and language models run there too. See AI voice agents for hospitals and health systems in the UK. The model side of keeping data in-house, from sizing to choosing open-weight models, is in Running Voice AI on Local, Self-Hosted Models.
Start with one inbound call that only reads, usually the support line or the booking line, on a real phone number rather than a browser test. Run QA on a sample of live calls, widen what the agent may do only as the transcripts earn it, and keep the electronic health record (EHR) and the scheduling system as the record throughout. Our post on Testing Voice Agents Before You Go Live gives the test order.
Each call above has its own deep dive:
- AI Voice Agents for Telehealth
- AI Voice Agents for Dental Clinics
- AI Voice Agents for Dental Reception and Call Answering
- AI Voice Agents for Home Health Visit Coordination
- How to Build a Voice Agent for Healthcare
- Best AI Voice Agents for Healthcare
- AI Voice Agents for Patient Appointment Scheduling
- AI Voice Agents for Patient Intake and Triage
- AI Voice Agents for Pre-Op Instructions
- Healthcare No-Show Reduction: Why AI Voice Agents Beat Reminders
- AI Voice Agents for Patient Support Lines
- AI Voice Agents for Healthcare Call Centers: Patients Still Call
- AI Voice Agents for Post-Visit Follow-up in Telehealth
- AI Voice Agents for Post-Discharge Follow-up
- AI Voice Agents for Medication Adherence in Healthcare
- AI Voice Agents for Prescription Refill Reminders in Pharmacy
- AI Voice Agents for Patient Surveys in Telehealth
- AI Voice Agents for Behavioral Health Intake and Triage
- AI Voice Agents for DME Order and Resupply Reminders
- AI Voice Agents for Dental Recall and Recare Outreach
- HIPAA-Compliant Voice AI for Hospitals
- Spanish AI Voice Agents for Healthcare
- AI Voice Agents for Hospitals and Health Systems (UK)
Glossary
- Business associate agreement (BAA)
- The contract HIPAA requires before a vendor creates, receives, stores or transmits PHI for a provider. It delegates obligations to the vendor and leaves the provider responsible for monitoring them; it never transfers the provider's liability.
- Transition Speech
- Fixed text or a recorded clip that Dograh plays word for word when the agent moves onto a pathway. It cannot carry per-patient details, which makes it the right place for an emergency or crisis instruction.
- Healthcare exemption
- The FCC rule at 47 CFR 64.1200(a)(9)(iv) that lets healthcare providers place short, non-financial calls such as reminders and pre-op instructions to a patient's mobile number, at most one a day and three a week, with an easy opt-out.
- Minimum necessary
- The HIPAA standard at 45 CFR 164.502(b) that limits the PHI used or disclosed to what the task needs. For a voice agent, it means asking only for the details the call requires.
