HIPAA-Compliant Voice AI for Pharmacy: The BAA Is Half the Job

HIPAA-compliant voice AI for pharmacy needs two things. Every vendor that creates, receives, maintains or transmits the call's health data needs a business associate agreement (BAA), and the call itself must verify the caller before naming any medicine. Running the platform and the models on the pharmacy's own servers removes most of those vendors.

Key Takeaways

• Each vendor holding call data needs a BAA, and no BAA transfers your liability.
• A contract cannot stop a medicine being named before verification.
• Self-hosted Dograh needs no BAA with Dograh; model providers and carriers may.

This post is part of our guide to AI voice agents for pharmacy and pharma. The guide's section "Where pharmacy call data lives: HIPAA" starts from one fact: once a caller names a medicine, the recording and transcript hold protected health information, so where they sit matters as much as what the agent says. This post counts every place a pharmacy call goes, and how each one is handled in Dograh, an open-source, self-hostable voice agent platform.

Who counts as a business associate on a call

HIPAA's definition decides which parties on a call need a contract. Under 45 CFR 160.103, a business associate is a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information" for a regulated function. The definition also covers a business associate's subcontractors. On a voice agent call, that list can include the phone carrier, the voice platform, the speech-to-text, language and text-to-speech models, the store that keeps recordings and transcripts, and any trace store used for debugging.

The HIPAA Journal's analysis of the federal breach portal, which lists breaches affecting 500 or more people, found business associates involved in 43% of large healthcare breaches in the first six months of 2026, so every vendor you add is one more to check.

A BAA delegates obligations to the vendor and adds a duty for you to monitor them; it never transfers your liability. HIPAA-compliant voice AI for hospitals covers the same layers in a hospital.

Three ways to set up a pharmacy voice agent

How many BAAs you sign depends on where the platform and the models run:

Among hosted platforms, Vapi lists a HIPAA add-on at $2,000 a month. Retell AI's compliance page states that "A signed BAA is required before transmitting PHI through Retell"; it offers the BAA self-serve on pay-as-you-go, and its pricing page lists custom BAA terms on its Enterprise plan.

For patient calls, self-host Dograh. No BAA with Dograh is needed, because Dograh never sees the data. Your speech and language providers may need their own BAA, and your phone carrier may too. A carrier that only carries the call can fall under HIPAA's conduit exception; many, such as Twilio, offer a BAA.

Dograh starts every account on its own managed models. To keep call audio away from Dograh, open Models, switch the Organization default to BYOK with your own speech and language providers (or local models), and check that no agent has its own model override.

Dograh is the orchestration layer: it runs the call flow, tools and telephony, and the speech and language models are a separate layer you choose. Bringing your own model keys moves the contract, not the data, because the audio still reaches the provider. The call audio stays in-house only when the speech and language models run on your own servers too. Then the model column drops out of the BAA list.

Open Source Alternative to Vapi / Retell

Self-hosted voice agent platform — no per-minute fees

dograh-hq/dograh

Star on GitHub

A signed BAA does not stop a leaky call

Every contract in the table can be in place and the call can still name a medicine before the agent knows who is on the line. HIPAA puts the check before the disclosure. Under 45 CFR 164.514(h), a covered entity must "verify the identity of a person requesting protected health information and the authority of any such person to have access" when it does not already know them. So every patient call runs greet, verify, then disclose. A phone number finds a record, but it does not prove who is calling. Before the agent names a medicine, it asks for an approved check, such as date of birth plus one more detail on file.

The greeting plays before verification, so a per-contact greeting from a campaign file names the pharmacy and the patient only. A voicemail names no medicine, because anyone in the house can play it. And a caregiver calling for a parent is a judgement call: 45 CFR 164.510(b)(3) lets a pharmacist use "professional judgment" to let someone else "pick up filled prescriptions". An agent has no professional judgement, so tell it in the prompt to send a caller acting for a patient to staff unless the PMS lists them as authorised.

The PMS should hand the agent only what the call needs. The minimum necessary standard asks for "reasonable efforts to limit protected health information to the minimum necessary to accomplish the intended purpose". It generally does not apply to what is told to the patient, but it shapes what your endpoint returns. Pre-Call Data Fetch can load the caller's open order as the call connects, so return that order, not the patient's full profile. This is general information, not legal advice; confirm your position with counsel.

Refill reminders are allowed; money decides

The most common outbound pharmacy call is generally fine under HIPAA's marketing rules. 45 CFR 164.501 excludes communications made "To provide refill reminders or otherwise communicate about a drug or biologic that is currently being prescribed for the individual, only if any financial remuneration received by the covered entity in exchange for making the communication is reasonably related to the covered entity's cost of making the communication."

A manufacturer paying more than the call costs changes the answer. A voice agent placing the call does not. AI voice agents for prescription refill reminders covers that call in full.

Recordings, transcripts and traces on your servers

Dograh has no retention setting and no automatic deletion, so your own policy and deletion job decide how long recordings and transcripts stay. On a self-hosted server, recording can be switched off only for the whole server. Set ENABLE_CALL_RECORDING_UPLOAD to false, and transcripts are still saved. Dograh masks nothing callers say. Recordings and transcripts keep whatever is said, so the call never asks for a full account, card or Social Security number; use a short check such as the last four digits, and send payment links by text or email from your own system.

Each call's View Trace button opens its trace in Langfuse, and traces carry the call's content. Tracing runs only once you connect a Langfuse project (see the environment variables), so host that project on your own servers or count it as one more vendor.

The API sends call events, such as IDs and call details but no audio or transcripts, while POSTHOG_API_KEY is set. Set ENABLE_TELEMETRY=false, and remove POSTHOG_API_KEY from the api service in docker-compose.yaml (or set it to an empty value).

HIPAA checks before the first pharmacy call

List every party that touches a pharmacy call by name: carrier, model providers, storage, trace store and cloud account. Each one has a signed BAA, runs on your servers, or only carries the call. Our guide to compliant AI voice agents covers the wider review. Then call over a real phone line as a relative and as the patient, and read the transcripts for any medicine named before the check.

Self-hosted Dograh has no per-minute platform fee (servers, model keys and phone minutes still cost); Dograh Cloud has a 1¢-a-minute platform fee. Best AI voice agents for pharmacies compares the products. Confirm your own position with counsel before the first patient call.