Privacy by design for a healthcare voice agent means deciding, step by step, what the call may say and where each copy lands. Get consent to call and to record, keep health details out of the greeting, verify the caller before disclosing anything, send each model only what it needs, and store recordings and transcripts where you control access.
Key Takeaways
- HIPAA, calling rules and recording laws each ask their own consent question.
- The greeting plays before verification, so it never carries health details.
- Self-hosting puts every stored copy of the call in storage you control.
A patient's health details can slip out in the first line of a call, long before anything is saved. This guide follows one call in Dograh from the consent questions and the greeting to verification, what each model hears, transfers and every stored copy. You can self-host Dograh or run it on Dograh Cloud.
A phone call is already a privacy system
Patient information is in play from the first word of a call, long before anything is saved. The definition of protected health information (PHI) in the Health Insurance Portability and Accountability Act (HIPAA) covers health information "whether oral or recorded in any form or medium". So the live conversation counts, and so does the file it leaves behind. Payment counts too, because the definition reaches information about paying for care.
The caller's number and voice are identifiers. HIPAA's de-identification rule lists telephone numbers and voice prints among the details that must go before data stops being PHI. A call log that ties a number to a clinic and a visit type is identifiable. A recording keeps the voice itself, which is on that list.
Much of the risk sits with the companies around the call. According to The HIPAA Journal, business associates had a hand in 43% of the large breaches reported to the Department of Health and Human Services in the first half of 2026. Every company that hears or stores a patient call joins that group. Privacy by design starts with a count of the systems that touch the call and what each one keeps.
Our guide to compliant AI voice agents maps that data flow for every industry. This guide stays with patient calls and walks them in the order they happen.
Before the call: three consent questions
A healthcare voice agent faces three separate consent questions, and each one has its own law. A yes to one never answers the other two, so keep them apart in your records.
The first is HIPAA. Its Privacy Rule lets a provider use patient information for treatment, payment and health care operations without the patient's written authorization, so a reminder about a booked visit needs none. Marketing is different. Using PHI to promote a product or service needs the patient's signed authorization, with narrow exceptions.
The second is the call itself. Under the Telephone Consumer Protection Act (TCPA), the Federal Communications Commission (FCC) treats an AI voice as an artificial voice, so an automated call to a mobile needs the patient's prior express consent. The FCC's calling rule carves out a healthcare exemption for calls to mobiles, and it is narrow. It covers care messages such as reminders, lab results and pre-op instructions. The call must name the provider at the start, last about a minute and offer an opt-out the provider honors at once. A patient gets at most one such call a day and three a week. Anything about bills or offers falls outside it.
The third is the recording. Whether you may record a call is a question for federal and state wiretap laws, and some states need every party's consent. The states that need every party's agreement, and the spoken notice that covers them, are in our post on call-recording consent laws. In a self-hosted Dograh install, recording is switched on or off for the whole server, so a patient who objects is offered a callback from a person.
Patient consent for automated healthcare calls walks through every condition of the exemption, how patients take consent back, and the recent court rulings on both.
The first ring and the greeting
The greeting plays before the agent knows who is on the line, so it must say nothing a stranger should not hear. In Dograh, the Greeting Text on the Start Call node is fixed text spoken word for word. Name the practice there. "Hi, this is Riverside Family Clinic" is safe. "I'm calling about your oncology follow-up" tells whoever answers something about the patient's health.
Outbound calls make this easy to get wrong, because the system already knows why it is calling. Pre-Call Data Fetch asks your system for data as the call connects, and the greeting can read what comes back. Return a record reference only. Fields your prompts never use are not sent to the model, but they are still stored with the call record, so a full chart in that reply becomes one more copy of PHI. Let a tool fetch details after the caller is verified.
Patients also expect to know when AI is involved. In a Verasight survey of 1,000 US adults, 54% wanted to give permission each time AI is used for clinical purposes, and another 32% wanted to be told. That survey asked about clinical AI, not phone calls, but the expectation carries over. If you want to tell callers they're speaking with an automated assistant, or your location requires it by law, write that in the Greeting Text along with the practice's name. Then set Allow Greeting Interruption on the Start Call node to off, because it is enabled by default, and the patient hears the whole notice before the conversation starts.
Verify the caller before any health detail
A phone number points to a record, yet it never proves who is on the line. HIPAA requires a provider to verify the identity and the authority of anyone asking for PHI before disclosing it. Caller ID can be spoofed, so the number alone never counts as proof.
The safest design keeps PHI out of the agent until the check passes. The agent asks the questions your policy sets, such as date of birth plus a second item on file. An HTTP API tool sends the answers to your own endpoint, and the endpoint replies verified or not, never the record. Only after a yes does a second tool fetch what the caller may hear.
Tell the agent in the prompt what to do when the check fails. After two tries, it says it can't share details by phone and offers a callback or a person. Family members and caregivers asking about a patient go to staff, because HIPAA leaves those disclosures to a professional's judgment. Verifying patient identity before a voice agent shares PHI covers the endpoint, the failure path and how to test both.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
During the call: what each model hears
Every model on the call hears part of it, so give each one only what its job needs. HIPAA's minimum necessary standard asks providers to limit PHI to what a task requires. On a voice call, that becomes a design rule for prompts and tools.
The speech-to-text model receives the call audio. The language model receives the prompt, the conversation so far and every tool result. The voice model receives each line it speaks. When a hosted provider runs those models, Dograh sends each one the data its service needs, which can include audio, transcripts and tool results. With your own keys (BYOK), the contract with that provider is yours, yet the patient's audio still travels to it.
Tool calls are the easiest place to leak. An HTTP API tool hands the whole response to the language model, and anything the model receives, it can say. Build each endpoint to return only what the agent may speak on that call. The appointment time is fine. The visit notes are not.
A model provider that handles PHI is usually a business associate, so it may need a business associate agreement (BAA) with you. Which parts of a voice AI stack need a BAA goes through the stack layer by layer, and our post on HIPAA-compliant voice AI for pharmacy covers who counts as a business associate on a call.
Handing the call to a person
A transfer is a disclosure too, because more than one person may hear something. Transfer Call works on Twilio, Telnyx, Plivo, Cloudonix and Asterisk ARI. The patient joins only after the person at the destination picks up, because the destination is dialed first. On Twilio, a short spoken introduction can play to both sides before the two are connected.
That introduction is written from the conversation, and both the caller and whoever answers hear it, including any member of a ring group who picks up. Write its instructions so it carries only details both sides may hear, such as the caller's first name and the topic, never a diagnosis. Your configured voice provider speaks it, so that provider hears it as well. No summary travels with the call by default. If staff need notes, an HTTP API tool writes them to your system before the transfer.
Emergencies need fixed words rather than a transfer queue. Put them on a pathway whose Transition Speech plays fixed text, such as "If this is a medical emergency, please call 911 now." Choosing that pathway is still the model reading the condition you wrote, so test it with many phrasings.
After the hang-up: every copy of the call
One call leaves several copies, and each one is PHI once it ties a patient to care or payment. A self-hosted Dograh install saves the recording three times, as the full call, the caller's side and the agent's side, plus a transcript file, all in object storage, either the bundled MinIO or your own S3. The call record in Postgres holds the pre-call data, the caller's and called numbers, the extracted answers, call logs and QA results.
Other copies are easy to miss. Server logs can hold call content. At the INFO level that Docker sets, every tool call's inputs are logged, and at DEBUG the logs also hold extracted fields and the text the agent speaks. Traces go to whichever Langfuse project you connect. Webhook payloads carry extracted fields and recording links into your other systems.
Recordings and transcripts stay in place until you delete them, so the retention schedule is yours to write. Set it on your storage, and have your own deletion process clear the database and the object store on time. The surest control is asking for less. An agent that never asks for a full Social Security number never stores one.
Copies matter because breaches are expensive. IBM's Cost of a Data Breach report puts the global average cost of a breach at $4.99 million in 2026, 12% more than a year earlier. What counts as PHI on a voice agent call lists each copy with its exact location.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Self-hosting keeps the copies in your storage
Self-hosting is the design choice that puts every stored copy in your own account. Run Dograh on your own servers with Docker, and no BAA with Dograh is needed, because the platform never receives your call data. Model providers may need their own BAA when they handle PHI. Whether the phone carrier needs one turns on what it stores. Many carriers, Twilio among them, offer a BAA. If your servers run in a cloud account such as AWS, Google Cloud or Azure, that cloud provider needs a BAA too. In your own data centre, it does not.
The platform half and the model half are separate choices. Dograh handles the call flow, tools and telephony, and you pick the speech and language models it uses. Patient audio stays in-house only when open-weight models run on your servers as well, such as Qwen3.8 27B for language, Parakeet TDT 0.6B v2 for speech-to-text and Magpie TTS for the voice.
Before patient calls start, turn off the anonymous usage telemetry a self-hosted install sends by default, by setting ENABLE_TELEMETRY=false and removing POSTHOG_API_KEY. Run Langfuse on your own servers too, or count its cloud as one more vendor. On cost, a clinic that self-hosts pays Dograh no per-minute platform fee but still pays for servers, model keys and phone minutes, and Dograh Cloud carries a 1¢-a-minute platform fee.
Self-hosting changes who holds the data. It does not make a deployment compliant by itself, since the Security Rule safeguards, such as access controls and audit logs, remain your job. HIPAA-compliant voice AI: what self-hosting changes covers what stays on your servers and what still leaves, and HIPAA-compliant voice AI for hospitals compares the setups in one table.
Settings and countries that change the rules
The same steps apply in every setting, but each one stresses a different step. A telehealth agent handles the calls around the visit, such as booking and join help. The join link and anything clinical stay behind verification. HIPAA-compliant voice AI for telehealth covers that setup.
Dental practices make many outbound calls, mostly recall and reminders, which can rest on the healthcare exemption while they stay about care. Add a whitening offer and the call is marketing. HIPAA-compliant voice AI for dental clinics shows where that line falls.
Billing calls sit outside the healthcare exemption entirely. Talk about balances only on inbound calls, after verification, and never take card numbers by voice. An HTTP API tool asks your billing system or payment provider to send its secure payment link by text or email. HIPAA-compliant voice AI for medical billing calls covers the rest.
The steps travel, but the laws change at the border. In the UK, health data is special category data under the UK GDPR, so a practice needs a specific condition for using it, such as providing health care, and patients should be told clearly when they are talking to an AI. AI voice agents for telehealth in the UK covers the NHS checks on top.
Canada's health privacy laws are mostly provincial. A clinic in Ontario follows the Personal Health Information Protection Act, and one in Alberta the Health Information Act, and many run a privacy impact assessment before a new system goes live. See AI voice agents for telehealth in Canada for clinics and AI voice agents for hospitals and health systems in Canada for health authorities.
In Australia, the Privacy Act 1988 and its Australian Privacy Principles cover how health information is collected, used, sent overseas and secured. From 10 December 2026, privacy policies must also say when personal information feeds automated decisions that significantly affect people. AI voice agents for telehealth in Australia covers both.
In each country, call data stays in the country only when you self-host in a local data centre and the models run there too. Treat the rules in this guide as general information, and confirm your setup with counsel in each place you operate.
A privacy checklist for the first patient call
Before the first real patient call, check each step of the call against this list.
- Your records show which numbers may get AI-voice calls, and for what purpose.
- The Greeting Text names the practice and nothing about care.
- Pre-Call Data Fetch returns a record reference only.
- The verify endpoint answers yes or no, never the record.
- Every tool endpoint returns only what the agent may say.
- The transfer introduction carries only details both sides may hear.
- Telemetry is off, and logs, traces and storage have access controls and a retention schedule.
- Every pathway, the emergency line included, has passed a test on a real phone line.
Each step above has its own deep dive:
- HIPAA-Compliant Voice AI: What Self-Hosting Changes
- What Counts as PHI on a Voice Agent Call
- Patient Consent for Automated Healthcare Calls
- Verifying Patient Identity Before a Voice Agent Shares PHI
- Which Parts of a Voice AI Stack Need a BAA
- HIPAA-Compliant Voice AI for Telehealth: The Calls Around the Visit
- HIPAA-Compliant Voice AI for Dental Clinics: Front Desk Privacy
- HIPAA-Compliant Voice AI for Medical Billing Calls
- AI Voice Agents for Telehealth in the UK: A GP Practice Guide
- AI Voice Agents for Telehealth in Canada: Provincial Privacy Rules
- AI Voice Agents for Telehealth in Australia: Privacy Act Basics
- AI Voice Agents for Hospitals and Health Systems in Canada
Glossary
- Protected health information (PHI)
- Health, care or payment information that identifies a patient, held by a provider or for one. HIPAA's definition covers oral information, so the live call counts, not only the recording and transcript it leaves.
- Healthcare exemption (TCPA)
- The FCC's narrow allowance for automated care messages to a patient's mobile, such as reminders and lab results. It caps calls at one a day and three a week and never covers billing or offers.
- Minimum necessary standard
- HIPAA's rule that a provider limits PHI to what a task needs. For a voice agent it means endpoints that return only what the agent may say and questions that ask only what the check needs.
- Business associate agreement (BAA)
- The contract a provider signs with a company that handles PHI for it. It hands over duties but never moves the provider's liability, which is why fewer vendors on a call means fewer contracts to watch.
