SOC 2 and HIPAA Compliant AI Voice Agent: Buyer Checklist
In this article
Novacall AI is SOC 2 compliant and HIPAA compliant, and it signs a Business Associate Agreement (BAA) with covered entities such as medical, dental and therapy practices. The platform also handles TCPA, A2P 10DLC and DNC rules, consent and opt-out requests, call recording with a disclosure, and GDPR/CCPA privacy requests. Those facts answer two separate buyer questions. Has an independent CPA firm examined the vendor's controls? That is SOC 2. Will the vendor accept federal duties for patient information? That is HIPAA.
Below, each standard is explained from its source, the AICPA and Title 45 of the Code of Federal Regulations, followed by a checklist that works on any AI voice agent.
SOC 2 in plain terms
A SOC 2 report is the output of an examination by a CPA firm. The AICPA's description of its SOC 2 guide says the examination looks at a service organization's description of its system and its controls relevant to security, availability, processing integrity, confidentiality or privacy. The same page notes that customers and business partners often request a SOC 2 report from the vendor. A SOC 3 report covers similar ground in a shorter form meant for general use.
A report does not have to cover all five categories, so check which ones were in scope. The criteria also move. Current reports use the 2017 Trust Services Criteria, with points of focus revised in 2022, plus the 2018 description criteria. On October 26, 2026 the AICPA published exposure drafts of proposed 2027 criteria for public comment.
Watch for template reports
The AICPA's SOC services page says it is looking into anonymous allegations about a compliance vendor that sells SOC services. In May 2026 its Journal of Accountancy covered new guidance for peer reviewers on firms that lean too heavily on third-party SOC platforms and produce "identical reports, risk assessments, sample sizes, and testing procedures." So note which CPA firm signed the report, and check that the system description reads like this vendor's phone, transcription and scheduling setup.
What HIPAA expects from an AI voice vendor
HIPAA's administrative rules live in 45 CFR Parts 160 and 164. Under 45 CFR 160.103, a business associate is a person who, on behalf of a covered entity, "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter." The definition also reaches subcontractors doing the same work for a business associate.
That matters for voice systems: a telephony carrier, a speech-to-text engine, an AI model and a hosting provider can all sit in the path of one call. Ask for the subprocessor list and how each one is bound.
The Security Rule's technical safeguards in 45 CFR 164.312 apply to covered entities and business associates alike. On a voice platform they become concrete settings:
- Access control: a unique login for every staff member who can open recordings or transcripts, an emergency access procedure, automatic logoff, and encryption, which the rule lists as "addressable."
- Audit controls: a record of who opened, played, edited or exported a call.
- Integrity: protection against a transcript or call summary being altered or destroyed improperly.
- Person or entity authentication: proof that whoever signs in to the dashboard is who they say they are.
- Transmission security: protection for audio and data moving between the phone network, the AI and the calendar.
Other sections fill in the rest. Section 164.308 requires a risk analysis and regular review of audit logs and access reports. Section 164.316 requires keeping security documentation for 6 years. Section 164.410 gives a business associate no more than 60 calendar days after discovering a breach to notify the covered entity, and says the notice must come without unreasonable delay. The minimum necessary standard in section 164.502(b) asks both parties to limit the patient information used for each task.
This is general information, not legal advice.
What a BAA with a voice vendor should spell out
HHS, the federal regulator for HIPAA, publishes sample business associate agreement provisions. Its introduction lists ten things the written contract must do, and states that a business associate is directly liable for uses and disclosures its contract does not allow and for failing to safeguard electronic patient data under the Security Rule. The table turns the main clauses into questions for a voice vendor.
| BAA element listed by HHS | What to confirm with the voice vendor |
|---|---|
| Permitted and required uses and disclosures | Whether recordings or transcripts may be used for anything beyond running the practice's calls, such as product improvement |
| Appropriate safeguards, including the Security Rule | The access, audit and transmission settings above, and which vendor staff can play a recording |
| Reporting uses not allowed by the contract, including breaches | A named security contact and the channel used for notice |
| Subcontractors agree to the same restrictions | A current list covering the carrier, speech-to-text, AI model and hosting |
| Support for patient access, amendment and accounting requests | How staff export one patient's call record or correct a wrong detail |
| Return or destroy patient information at termination | What happens to recordings, transcripts, summaries and backups when the contract ends |
SOC 2 and HIPAA side by side
The two standards come from different bodies and do different jobs. The comparison draws on the AICPA guide description and the HIPAA text on eCFR.
| Question | SOC 2 | HIPAA |
|---|---|---|
| Who writes the criteria | AICPA | HHS, in 45 CFR Parts 160 and 164 |
| What the buyer receives | A CPA firm's report on the vendor's system and controls | A signed business associate agreement |
| Whose duties it sets | Describes the vendor's own controls | Places duties on both the practice and the vendor |
| What it leaves open | Your call script, retention choices and staff logins | Whether an outside examiner has tested the vendor's controls |
A clinic usually wants both: the report to see that controls were examined, and the BAA to make the vendor answerable for patient data.
Voice-specific checks to run before launch
Run these with made-up patients before any real caller reaches the system:
- Recording disclosure. The greeting says the call is recorded before the agent collects any details.
- A caller volunteers a symptom. The summary keeps what scheduling needs and drops the rest.
- Voicemail and text-back content. Messages carry the practice name and a callback request, not treatment details.
- "Stop texting me." The opt-out reaches every channel, so no reminder goes out the next morning.
- Shared family phone. The agent checks identity under the practice's rules before discussing an existing appointment.
- Staff role test. A front-desk login cannot bulk-export recordings, and the audit log shows the attempt.
- Deletion request. Removing a test patient clears the recording, transcript and summary, not just the dashboard row.
Some calls must reach a person under the practice's own rules. Write them down before launch: severe pain or swelling, bleeding that will not stop, a clinical question, a billing dispute and a records request. Callers describing a medical emergency should be told to hang up and dial 911.
A buyer checklist for any AI voice agent
- Get the current SOC 2 report. Note the CPA firm, the period, the categories in scope, any exceptions and the controls the customer is expected to run.
- Confirm the phone, transcription and AI components you will use are inside the described system.
- Sign the BAA before any patient call flows, and check it against the HHS elements above.
- Collect the subprocessor list and ask how new ones are announced.
- Set separate retention periods for recordings, transcripts and summaries.
- Run the seven test calls above and keep the results.
- For outbound reminders, confirm consent records, opt-out handling, DNC checks and A2P 10DLC registration for texts.
- Repeat the review when the vendor adds a subprocessor or the AICPA criteria change.
Practices comparing options can read the dental AI answering service guide, the med spa AI receptionist roundup or the explainer on how an AI receptionist works.
An AI front desk for healthcare practices
For practices that want this setup without building it, Novacall AI responds to inbound calls and leads in under 60 seconds, 24/7/365, by voice, SMS, email and WhatsApp in 15+ languages. It asks the practice's own intake questions, books on the practice calendar and syncs each conversation to the CRM, all under a signed BAA. The healthcare industry page shows how that works by specialty.
Questions buyers ask about compliant voice agents
Is an AI voice agent with SOC 2 automatically HIPAA compliant?
No. A SOC 2 report shows that an independent CPA firm examined the vendor's controls against AICPA criteria. HIPAA asks something else: whether the vendor will sign a business associate agreement and protect patient information under the Security Rule. A healthcare buyer should see the report and the signed agreement before patient calls start.
Which AI voice companies offer both SOC 2 and HIPAA compliance?
Ask each vendor for two documents: its current SOC 2 report and a business associate agreement it is willing to sign. A vendor that offers a badge but no report, or a privacy policy but no agreement, has not answered the question. Read the report's scope to confirm it covers the voice product you will actually use.
Does a voice agent need a BAA if it only books appointments?
Scheduling calls still carry names, callback numbers and the reason for the visit. Most covered practices therefore ask any scheduling vendor for a business associate agreement before patient calls flow through it. Confirm the scope with your privacy officer or counsel, since they know how your practice handles patient information.
Should healthcare calls handled by AI be recorded?
Recording helps with quality checks and disputes, but it creates more patient data to protect. If calls are recorded, the greeting should say so, access should be limited by role, and retention should be set on purpose rather than left at a default. Some practices keep transcripts and summaries and skip the audio.
What should a business outside healthcare check in a SOC 2 report?
Restaurants, home service firms and law offices can use the same reading method. Check which categories were examined, the period covered, any exceptions the auditor found, the vendors carved out of scope and the controls the customer is expected to run. Then match that scope to the phone features you plan to switch on.
Next step
Send one email to every shortlisted vendor this week requesting the latest SOC 2 report together with a draft BAA. Score each reply against the eight checklist items, and drop any vendor that stalls on either document. Before going live, rehearse the seven scripted test calls using fictional names, then file the results with your privacy officer. To see Novacall AI ask your intake questions and book onto your calendar under a signed BAA, Book for a quote.