Guides
What HIPAA requires when AI voice agents and automated SMS workflows handle patient data — including the Privacy Rule, Security Rule, BAA obligations, practical compliance checklist, common mistakes, and how Thoughtly helps healthcare teams stay compliant.
Last updated
Healthcare organizations are adopting AI voiceAI voiceAn artificially generated, natural-sounding voice produced by a TTS model. Thoughtly supports a library of AI voices and brand-specific cloning. agents and automated SMS workflows to manage patient intake, appointment scheduling, prescription reminders, post-visit follow-up, and claims-related outreach. These tools create real operational leverage — but they also handle the kind of data that HIPAA was written to protect.
If your AI agent asks a caller for their date of birth, confirms a diagnosis code, or texts an appointment reminder that includes a provider name and visit reason, you are creating, receiving, and transmitting protected health information (PHI). That triggers specific obligations under federal law — and the penalties for getting it wrong are steep and well-documented.
This guide covers what HIPAA actually requires when AI voice and SMS agents handle patient data, how to structure compliant workflows, where healthcare teams commonly make mistakes, and which Thoughtly platform features map to each requirement.
The Health Insurance Portability and Accountability Act of 1996 (HIPAA) established national standards for protecting individually identifiable health information. Three rules are directly relevant when deploying AI voice and SMS agents in healthcare:
The full regulatory text is published by HHS at hhs.gov/hipaa/for-professionals. These rules apply equally whether PHI is processed by human staff or by AI systems.
HIPAA applies to covered entities — health plans, healthcare clearinghouses, and healthcare providers who transmit health information electronically — and to their business associates. Under 45 CFR 160.103, a business associate is any person or entity that creates, receives, maintains, or transmits PHI on behalf of a covered entity.
When a healthcare organization deploys an AI voice or SMS platform that processes patient data — recording calls, extracting clinical details, sending appointment reminders that include visit types or provider names — that platform provider is a business associate. This designation is not optional. It requires a signed Business Associate Agreement (BAA) before the platform touches any PHI.
A BAA must specify the permitted uses and disclosures of PHI, require the business associate to implement appropriate safeguards, mandate breach reporting, and ensure the business associate's subcontractors agree to the same restrictions. If your AI vendor will not sign a BAA, you cannot use them for workflows that involve PHI.
Protected health information is any individually identifiable health information held or transmitted by a covered entity or its business associate. In practice, AI voice and SMS workflows commonly create or handle PHI in these situations:
Note that even seemingly routine messages can contain PHI. A text that reads "Your appointment with Dr. Martinez for a cardiology follow-up is confirmed for Tuesday at 2 PM" combines an individual identifier with a healthcare provider and clinical specialty — that is PHI under the Privacy Rule.
The Security Rule requires three categories of safeguards for ePHI. Here is how each applies to an AI voice and SMS platform:
Use this checklist when evaluating or deploying an AI voice and SMS platform for healthcare workflows.
| Requirement | What to verify | Why it matters |
|---|---|---|
| BAA execution | Signed Business Associate Agreement with AI platform vendor before any PHI exposure | No BAA = automatic HIPAA violation if PHI is involved |
| Encryption in transit | TLS 1.2+ on all API calls, voice streams, and SMS transmissions | Unencrypted ePHI in transit is a breach waiting to happen |
| Encryption at rest | AES-256 or equivalent for stored call recordings, transcripts, and patient data | Required by Security Rule technical safeguards |
| Access controls | Role-based access, unique user IDs, MFA for platform access | Prevents unauthorized access to patient data |
| Audit logging | Platform logs all access to recordings, transcripts, and patient records with timestamps and user IDs | Required for Security Rule audit controls and breach investigations |
| Minimum necessary data | AI agent prompts collect only fields required for the workflow — not the full patient record | Privacy Rule minimum necessary standard |
| SMS content controls | Automated texts do not include clinical details, diagnoses, or treatment information unless patient has consented | Unsecured SMS with PHI violates Security Rule transmission requirements |
| Call recording storage | Recordings stored in HIPAA-compliant environment with defined retention and destruction policies | Recordings containing PHI are ePHI and must be secured |
| Consent documentation | Patient consent to AI interaction and call recording is captured and stored per state and federal requirements | Privacy Rule and many state laws require documented consent |
| Breach response plan | Documented process for detecting, investigating, and reporting breaches involving AI-processed PHI | Breach Notification Rule requires notification within 60 days of discovery |
| Subcontractor oversight | AI vendor's subcontractors (telephony, cloud, LLM providers) also bound by BAA terms | Business associates must ensure downstream compliance |
| Risk analysis inclusion | AI voice/SMS workflows included in your organization's enterprise-wide HIPAA risk analysis | Risk analysis gaps are the #1 enforcement target — OCR levied penalties in 10 settlements in early 2025 for this |
Thoughtly is SOC 2 Type II certified and HIPAA-compliant. The platform is built for regulated industries — insurance, mortgage, healthcare, financial services — where compliance is a prerequisite, not an afterthought. Here is how Thoughtly's features map to HIPAA requirements:
For a detailed look at Thoughtly's security posture, visit trust.delve.co/thoughtly. To discuss a BAA for your healthcare organization, contact the Thoughtly team.
HIPAA enforcement is administered by the HHS Office for Civil Rights (OCR). Civil monetary penalties are tiered by culpability:
| Tier | Culpability level | Penalty range per violation | Annual cap |
|---|---|---|---|
| 1 | Did not know (and could not have known) | $137–$68,928 | $2,067,813 |
| 2 | Reasonable cause (not willful neglect) | $1,379–$68,928 | $2,067,813 |
| 3 | Willful neglect, corrected within 30 days | $13,785–$68,928 | $2,067,813 |
| 4 | Willful neglect, not timely corrected | $68,928–$2,067,813 | $2,067,813 |
These figures are adjusted annually for inflation. Criminal penalties can also apply for intentional violations, including fines up to $250,000 and imprisonment up to 10 years under 42 U.S.C. § 1320d-6. State attorneys general may bring separate civil actions.
In the first five months of 2025, OCR announced ten resolution agreements with settlement amounts from $25,000 to $3,000,000. The consistent theme: failure to conduct an adequate enterprise-wide risk analysis under the Security Rule. Healthcare organizations deploying new AI systems without incorporating them into their risk analysis are walking directly into OCR's enforcement priority.
Yes. HIPAA requirements apply equally whether PHI is processed by human staff or by AI systems. If an AI agent creates, receives, maintains, or transmits PHI on behalf of a covered entity, the platform provider is a business associate and must comply with the same privacy and security standards.
Yes, but the content matters. A text saying "You have an appointment tomorrow at 2 PM" with no clinical details is lower risk. A text that includes a provider specialty, diagnosis, or treatment type crosses into PHI territory. Best practice is to limit SMS reminders to the minimum necessary information and obtain patient consent for text-based communications. If a patient has initiated SMS contact or requested communication by text, sending limited reminders is generally permissible under the Privacy Rule.
SOC 2 Type II is a third-party audit framework that evaluates a service organization's controls for security, availability, processing integrity, confidentiality, and privacy. HIPAA compliance means meeting the specific requirements of the Privacy, Security, and Breach Notification Rules for handling PHI. SOC 2 certification is a strong indicator that a vendor has appropriate security controls, but it does not replace the need for a BAA or HIPAA-specific compliance measures. Thoughtly holds both SOC 2 Type II certification and HIPAA compliance.
Yes. Thoughtly signs Business Associate Agreements with healthcare customers on the Enterprise plan. If you are a healthcare organization evaluating Thoughtly, contact the team to discuss BAA terms before deploying any workflows that involve PHI.
Follow your organization's breach response plan. Under the Breach Notification Rule, you must notify affected individuals without unreasonable delay and no later than 60 days after discovery. If the breach affects 500 or more individuals, you must also notify HHS and prominent media outlets in the affected jurisdiction. Document the breach, your investigation, and your response. Work with your AI platform vendor to determine the scope of the incident and whether the vendor's breach notification obligations under the BAA have been triggered.
This article is informational and does not constitute legal advice. Consult qualified legal counsel for compliance decisions specific to your organization.
HHS Summary of the HIPAA Security Rule — hhs.gov/hipaa/for-professionals/security/laws-regulations
HHS HIPAA Resolution Agreements (enforcement actions) — hhs.gov/hipaa/for-professionals/compliance-enforcement/agreements
HIPAA Journal: What Are the Penalties for HIPAA Violations? (2026 Update) — hipaajournal.com/what-are-the-penalties-for-hipaa-violations
HIPAA Guide: HIPAA Rules Regarding Text Messaging — hipaaguide.net/hipaa-rules-regarding-text-messaging
Paubox: When Does AI Become a Business Associate Under HIPAA? — paubox.com/blog/when-does-ai-become-a-business-associate-under-hipaa
Ogletree Deakins: 2025 Enforcement Trends — Risk Analysis Failures at the Center of HHS's Multimillion-Dollar HIPAA Penalties — ogletree.com/insights-resources/blog-posts/2025-enforcement-trends
Thoughtly Security and Trust — trust.delve.co/thoughtly
Thoughtly Healthcare Solutions — thoughtly.com/solutions/healthcare
Related: TCPATCPAUS federal law governing telemarketing calls and SMS. Thoughtly enforces consent capture, time-of-day windows, and DNC scrubbing automatically. and AI Outbound Calling: A Practical Compliance Checklist for Revenue Teams
Related: Call Recording ConsentRecording consentState-by-state legal requirement to disclose call recording. Some states require all-party consent; Thoughtly enforces the right script per state. for AI Voice Agents: A State-by-State Guide
Related: A2P 10DLC10DLC10-Digit Long Code — US carrier-mandated registration for A2P SMS. Without it, your business texts get filtered or blocked. Compliance for AI SMS Follow-Up: What Revenue Teams Need to Know
Related: 10 Best HIPAA-Compliant AI Voice Agents for Healthcare & Clinics in 2026
