AI voice agents for hospitals and health systems in the UK take booking and reminder calls for National Health Service (NHS) and private providers under UK GDPR, the Data Protection Act 2018 and NHS data security expectations. HIPAA does not apply. Self-hosting in a UK data centre, with the models there too, keeps patient call data in the country.
Key Takeaways
- UK patient calls fall under UK GDPR and the DPA 2018, not HIPAA.
- Call data stays in the UK only if the models run there too.
- Keep a route to a person on every call, and test regional accents.
This post is part of our guide to AI voice agents for hospitals and health systems. The guide's section on compliance, language and country notes that HIPAA is US law and that UK providers work under different rules. This post sets out those rules for NHS and private providers running patient calls on Dograh, an open-source, self-hostable voice agent platform. It is general information, not legal advice.
The UK data laws that cover a patient call
The Health Insurance Portability and Accountability Act (HIPAA) is US law and does not apply to a UK provider. A UK hospital, GP practice or private clinic works under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA 2018), and NHS bodies add their own data security expectations on top.
Under UK GDPR, health data is special category data, the class with the strictest conditions. The Information Commissioner's Office (ICO) explains that "details about an individual's mental health are likely to be much more sensitive than whether they have a broken leg - but both are data concerning health." A booking call carries a name, a date of birth, a clinic and often a reason for the visit. All of it is health data.
The roles matter more than the vocabulary. The provider is the controller. Any vendor that handles the call data on its behalf is a processor, and the contract between them must contain the terms set out in Article 28(3). The ICO lists them: processing only on the controller's documented instructions, a duty of confidence, appropriate security, rules on sub-processors, help with data subjects' rights, end-of-contract provisions, and audits. That Article 28 contract does the job a business associate agreement (BAA) does in the US. There is no BAA in the UK, and a UK post that talks about one is describing the wrong country.
Where a voice agent fits in NHS demand
The scale is in NHS England's own statistics. In August 2026, 29.8 million appointments were recorded across general practice in England, and 45.0% of them took place on the day they were booked. Many of those bookings started as phone calls.
Hospital outpatients show the cost of the calls that never happen. In the 2024-25 outpatient statistics, covering April 2024 to March 2025 and the newest annual figures available, 8.1 million of 146.1 million outpatient appointments were missed without notice. NHS statistics call these DNAs, for "did not attend". A reminder call that lets a patient cancel or rebook in one conversation gives the slot back to someone else.
Those are the calls to automate first: booking, cancelling, rebooking and reminding. Clinical questions and triage stay with clinicians, as they do in every post in this guide.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Patients have pushed back, so design for it
The UK has already seen what goes wrong. In August 2026, Healthwatch Rotherham reported patient feedback on a GP practice's AI receptionist, as Management in Practice covered. Patients described "digital exclusion and communication issues", and the system "does not respond well to variations in speech such as regional accents or those with speech impediments". In September, Fakenham Medical Practice in Norfolk ended its trial of the same system after complaints from patients and staff, and moved to clinician-led total triage.
The lesson is about design, not about whether to use an agent at all. Four rules answer those complaints.
The agent complements the existing routes. Patients can still reach the surgery by the usual means, and the agent never becomes the only door. Every call has a route to a person: when a patient asks for the team, or the agent has not understood twice, it puts the call through or writes a callback request. Test with real regional accents on real phone lines, because most phone calls still reach the agent as 8 kHz audio, while a browser demo runs at 16 kHz. Add local place names, practice names and clinic names as keyterms, Dograh's custom dictionary, so the speech model listens for them. Dograh also supports more than 70 languages on its speech-to-speech models. Finally, the greeting says plainly that the caller is speaking with an automated assistant.
Keep patient data in the UK
Most UK providers want patient call data to stay in the country. Self-hosting Dograh in a UK data centre puts the call platform, the recordings and the transcripts there. Dograh is the orchestration layer: it runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose.
That separate layer decides where the audio goes. Call data stays in the UK only when the speech-to-text, language and text-to-speech models also run on your UK servers. A hosted model provider used through an API key receives the audio, so it is a processor or sub-processor under Article 28. If it processes the data outside the UK, the transfer needs its own legal basis. The phone carrier is in the chain too. Our post on Running Voice AI on Local, Self-Hosted Models covers sizing open-weight models for your own servers.
Plan retention as well. Dograh has no retention setting and deletes nothing automatically, so your own records retention schedule decides how long recordings and transcripts live. On a self-hosted server, recording can be switched off only for the whole server, and transcripts are still saved. The wider privacy case is in Why Voice Data Needs to Stay Local: Privacy, PII, and Biometric Risk.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
NHS assurance before the first call
NHS work comes with its own checks, and they take longer than the build. The Data Security and Protection Toolkit (DSPT) says that "All organisations that have access to NHS patient data and systems must use this toolkit to provide assurance", which generally covers a supplier that handles NHS patient data as well as the organisation deploying it.
A Data Protection Impact Assessment (DPIA) generally comes first. The ICO's guidance says you must do one where processing "is likely to result in a high risk", and it names "processing on a large scale of special categories of data" as a case. A patient phone line is usually that case. Expect NHS clinical safety standards to apply to the supplier and to the organisation that deploys the agent, too.
The call design follows the guide's rule: the agent collects, reminds and routes, and never gives clinical advice. An emergency gets one fixed instruction to hang up and call 999, played as Transition Speech or a recorded clip so the model never improvises it. Urgent questions go to NHS 111 or the practice's own clinical route, according to the practice's written rules. Our post on AI voice agents for patient intake and triage explains how to write those rules. Dograh's Transfer Call works on Twilio only and passes no summary by default, so the agent writes the details to your system before transferring.
Start with one administrative call
Pick one call that only books, cancels or reminds, and run it beside the existing phone route rather than in place of it. Run quality assurance on a sample of live calls and read the ones where the agent asked for a repeat, because those are where accents and line quality show up. Widen what the agent does only as the transcripts earn it. Our post on Testing Voice Agents Before You Go Live gives the test order.
Self-hosted Dograh has no per-minute platform fee, though servers, model keys and phone minutes still cost money. Dograh Cloud has a 1¢-a-minute platform fee. For a UK deployment that has to keep data in the country, self-hosting in a UK data centre is the straightforward route.
Glossary
- UK GDPR
- The UK General Data Protection Regulation, the UK's version of the EU GDPR, which applies alongside the Data Protection Act 2018. It governs how UK providers process patient data, including call recordings.
- Special category data
- Personal data that UK GDPR protects more strictly, including data concerning health. A booking call usually carries it, because a name next to a clinic or a reason for a visit is health data.
- Article 28 contract
- The contract UK GDPR requires between a controller and each processor, with set terms on instructions, confidentiality, security, sub-processors and audits. It plays the role a business associate agreement plays in the US.
- Data Protection Impact Assessment (DPIA)
- The risk assessment UK GDPR requires before processing that is likely to be high risk, such as large-scale processing of health data. It is usually the first document an NHS deployment needs.
