A HIPAA-compliant AI receptionist where every vendor in the call path is under BAA
Most voice-AI platforms fail a HIPAA review for one of two reasons: no BAA on offer, or a multi-tenant audio path. This page is the architecture we deploy instead, vendor by vendor, and the evidence an auditor gets to see.
Three commercial voice platforms. One HIPAA review. Three failures.
The dental network we now run 20+ offices for did not come to us first. They trialled three commercial voice-AI platforms, and all three failed HIPAA review. Not on transcription accuracy, and not on voice quality — both were fine. They failed on two structural points: either the vendor would not sign a Business Associate Agreement at all, or the platform routed audio through a multi-tenant path where protected health information could theoretically co-reside with another tenant's data.
Neither of those is a configuration you can fix in a dashboard. A vendor that has not built a BAA programme cannot produce one because you asked nicely, and a shared media plane cannot be made single-tenant with a settings toggle. This is the gap that matters: a voice agent can be excellent at answering the phone and still be un-deployable in a covered entity, and you usually discover which one you bought at the point your compliance officer asks for the data-flow diagram.
The phrase "HIPAA compliant" on a vendor's pricing page is not a certification. There is no HIPAA certifying body. What exists is a set of obligations you carry as the covered entity, and a set of contracts and controls that determine whether a vendor can carry part of that obligation with you. So the useful question is never "is this HIPAA compliant." It is: which vendors touch PHI, what has each one signed, and where does the audio physically live.
Where PHI goes, and where it is not allowed to go.
The deployment below is the one running in production across the dental network. It is the reference we start from for any covered entity.
A call arrives on the clinic's existing DID, crosses a Twilio SIP trunk, and lands in a self-hosted LiveKit room running on AWS inside the clinic's own VPC. Private subnets. Clinic-managed KMS keys. No ingress that was not explicitly allowed. From that point on, audio does not cross the covered boundary — the media plane belongs to the clinic, not to us and not to a shared platform.
Inside that boundary, speech goes to Deepgram Enterprise under BAA, running a custom dental vocabulary model. Intent and tool calls run against Azure OpenAI GPT-4o on a private endpoint, under BAA, with zero data retention. Speech comes back through ElevenLabs Enterprise, also BAA-covered, streaming its first audio chunk in under 150ms. Turn-taking is handled by LiveKit's own VAD and end-of-utterance model, which makes its decision in under 150ms — that is what keeps the agent from talking over a patient mid-sentence.
The agent does not free-text its way into your practice management system. It calls six named tools and nothing else: check_availability, book_appointment, modify, cancel, collect_intake, and transfer_to_human. A constrained tool surface is a compliance property as much as an engineering one, because it bounds what the model is capable of doing with the data it has been given.
Every vendor in the call path, and what each one is allowed to see.
This table is the first thing a compliance officer asks for and the last thing most voice-AI vendors can produce.
| Component | Vendor | What it touches | Coverage |
|---|---|---|---|
| Telephony | Twilio | SIP transport of the call into the VPC | BAA |
| Media / voice infra | LiveKit, self-hosted | Live audio. Runs on the clinic's own AWS VPC, private subnets, clinic-managed KMS | In your VPC |
| Speech-to-text | Deepgram Enterprise | Call audio and transcript, with a custom dental vocabulary model | BAA |
| Language model | Azure OpenAI GPT-4o | Transcript and tool arguments, on a private endpoint with zero retention | BAA |
| Text-to-speech | ElevenLabs Enterprise | Outbound speech synthesis | BAA |
| Cloud & storage | AWS | Compute, S3 audit storage, KMS key custody | BAA |
| Practice management | Your PMS | Appointment reads and writes. Direct API where one exists, in-LAN gateway where it does not | Your system |
Every vendor above was BAA'd before a single byte of PHI touched the system. That ordering is the whole point, and it is why the dental build took 14 weeks rather than four — BAA negotiation ran in parallel with the architecture work, not after it. The operating rule is short enough to audit against: no BAA, no PHI. A component that cannot be covered is either replaced with a self-hosted equivalent or removed from the PHI path entirely.
If a clinic wants zero third-party model exposure, the language model is the component that comes out. Self-hosted open-weight models are the substitution we offer for that case; it trades some capability for a boundary that never leaves your infrastructure. That is a real trade-off and we will walk you through what it costs in quality before you choose it.
What an auditor asks for, and where it already lives.
Compliance work that only exists as a slide deck fails the second time it is examined. These are artefacts, not assurances.
The environment, as code
Infrastructure ships as Terraform. An auditor can clone the repository and reproduce the environment rather than taking a screenshot of a console as evidence. Drift between what was described and what is running becomes visible instead of theoretical.
Per-call audit log, immutable
Every call writes an audit record to S3 under WORM retention with clinic-managed KMS keys, plus an auditor-ready export. Because the bucket is write-once, the evidence trail cannot be quietly edited after an incident — including by us.
Configurable data retention
Call audio and transcripts sit on a separate, configurable retention window. The default is 30 days rolling with purge on request. The audit log and the call payload are deliberately governed by different policies, because they answer different questions.
Named access, break-glass only
Access is limited to clinic staff you name, plus our on-call engineer under break-glass access with a full audit trail. There is no standing engineering access to production PHI, and every break-glass event is recorded.
Quarterly BAA reconciliation
Vendor BAA coverage is re-checked every quarter as part of the retainer, alongside a review of the audit log. Coverage is a live state, not a box ticked at kickoff, and vendors do change their terms.
A written incident runbook
Isolate, preserve logs, notify the clinic within 24 hours, remediate, then hand over the evidence packet your HIPAA policy and any applicable state breach law require. Written before go-live, not drafted during the incident.
The agent refuses clinical questions. That is a design decision.
Ask this agent whether your tooth pain is an emergency, or whether you should take more ibuprofen, and it will not answer. It refuses and warm-transfers to a human on-call. That ceiling is explicit and it is deliberate: we would rather the agent say "I'm going to get someone" than improvise clinical guidance it has no standing to give.
This is worth stating plainly because it is where the incentives of a demo and the incentives of a production deployment diverge hardest. An agent that attempts every question demos beautifully. An agent that knows the four or five categories it must hand off is the one you can leave answering a clinic's phone at 2am. The scope boundary is not a limitation we are apologising for — it is the reason the deployment has run without a HIPAA incident.
The same logic shapes what the agent does with intake data. It collects what the front desk needs, writes a structured note, and stops. It does not summarise a caller's symptoms into the chart, and it does not make triage decisions dressed up as scheduling ones.
20+ offices, roughly 160K patient records, zero HIPAA incidents.
Figures below are live-traffic aggregates from clinic analytics, audited alongside the quarterly BAA review.
Self-hosted LiveKit on a fully BAA-covered stack, integrated directly into Dentrix, Open Dental, Curve and Eaglesoft.
A multi-location dental group with roughly 160,000 active patient records was answering about 62% of its inbound calls; the rest went to voicemail. We built the HIPAA architecture and negotiated vendor BAAs in parallel over the first two weeks, stood up self-hosted LiveKit inside their VPC, built a 600-term dental glossary for the speech model, and shipped an in-LAN gateway for the practice management systems that expose no API. Pilot at one office, then 10, then 20+.
The booking figure is measured over the first 90 days after deployment against the trailing 90-day baseline, on the same marketing spend — so it is a capture improvement, not the result of buying more leads. Per-call cost runs higher than our restaurant deployments because dental calls run longer and use a heavier vocabulary model; that 600-term glossary of procedures, insurance carriers and medications cut word error rate by 38% against the generic model on live-traffic calls, which is the difference between a bookable call and a transfer.
GDPR, and the state laws that layer on top of it.
HIPAA is rarely the only regime in play. For EU clinics, GDPR adds data-residency and right-to-erasure obligations that HIPAA does not contemplate; our default for EU deployments is EU-hosted infrastructure with a DPA on every vendor. Our contracting entity is Gazolin Production SRL, based in Baia Mare, Romania, so an EU deployment is our home posture rather than an accommodation.
In the US, state-level rules layer additional obligations on top of the federal baseline — CCPA in California, the SHIELD Act in New York, HB 300 in Texas. These change breach-notification timing and, in some cases, what counts as reasonable safeguards. We model whichever ones apply to your locations during the discovery workshop, so they land in the architecture document rather than surfacing after go-live.
What the compliant version costs to build and to run.
Fixed project pricing. Per-call unit economics are modelled during discovery, so you know the monthly run-rate before you sign anything.
| Deployment | Scope | Price |
|---|---|---|
| Single-office AI receptionist | Inbound voice, one PMS integration, scripted flows, shadow mode, staff handoff | $8,000–$14,000 |
| Multi-location rollout | Multi-office, shared templates, per-location config, analytics dashboard | $18,000–$35,000 |
| Fully self-hosted HIPAA stack | LiveKit and models entirely inside the clinic VPC, zero third-party PHI exposure | $25,000–$50,000 |
| Monthly retainer | Ops, script tuning, new intents, reporting, PMS change management, quarterly BAA reconciliation | $2,500–$8,000/mo |
A single-location clinic goes live in 4–6 weeks including scripting, PMS integration, shadow mode and staff handoff. Multi-location rollouts add 1–2 weeks per practice-management variant, because each closed PMS needs its own gateway. The dental network's full programme ran 14 weeks end to end, and the extra time was BAA negotiation and HIPAA architecture rather than engineering.
Every engagement starts with a discovery workshop at $1,500–$3,000, credited against the project if you proceed. It produces the HIPAA architecture document, the data-flow diagram, and a fixed-scope proposal — the artefacts your compliance officer needs to review before a build is worth starting. See full pricing for how this maps onto our standard tiers, and the tech stack for why each component was chosen.
The questions a compliance officer asks first.
Who actually signs the BAA?
Can the whole stack run inside our own AWS account?
What happens if one of your vendors lets its BAA lapse?
How long do you keep call recordings and transcripts?
What does the agent do when a patient asks a clinical question?
What do you need from us before a HIPAA review can start?
Who wrote this, and why it matters when the decision is a compliance decision.
This page was written by Viktor Andriichuk, founder and lead architect at DataFlux Software, who designed and deployed the BAA-covered stack described above. On HIPAA work the buyer is screening for compliance competence, not marketing, so the relevant credentials are stated plainly and are all independently verifiable.
DataFlux Software has shipped 50+ production systems since 2018, and works on AI voice and agent infrastructure exclusively since 2023. Contracting entity: Gazolin Production SRL (Romania, EU).
The nine questions, on one page.
A signed BAA assigns liability. It does not move data. These are the nine things we ask during a review that decide whether the architecture behind the signature holds up.
Bring your compliance officer to the first call.
Twenty minutes, no pitch deck. Bring your call volume, your practice management system, and whatever your last vendor review flagged. We will tell you whether a HIPAA-grade AI receptionist makes sense for you — and if it doesn't, we'll say so.