HIPAA
HIPAA is the U.S. federal framework that governs how covered entities and their business associates may use, disclose, safeguard, and provide access to protected health information.
HIPAA stands for the Health Insurance Portability and Accountability Act. In everyday product discussions, the name usually refers to the privacy, security, and breach-notification rules associated with the law. It applies to defined organizations and data relationships, not automatically to every business that handles health-related information.
The central data category is protected health information, or PHI: individually identifiable health information maintained or transmitted by a covered entity or business associate. A vendor that handles PHI on behalf of a covered entity may be a business associate, depending on the service and relationship. When required, a Business Associate Agreement defines permitted handling and contractual safeguards; signing one does not make every workflow compliant by itself.
Why HIPAA matters for AI phone calls
A healthcare call can contain PHI even when the purpose seems routine. A person's name combined with an appointment, condition, treatment, prescription, provider relationship, or billing detail may be sensitive in context. Audio, transcripts, summaries, extracted fields, and call metadata should all be included when a team maps where PHI enters, moves through, and leaves the system.
An implementation review should cover what information the agent is allowed to request, how callers are verified when necessary, which tools and integrations receive data, who can access call artifacts, and how long those artifacts are kept. Prompts alone are not access controls. The organization also needs procedures for mistakes, disclosures, data requests, and incidents.
HIPAA compliance is therefore a property of a defined operating arrangement, not a permanent label attached to a feature. The covered entity, its vendors, the configured workflow, and the people operating it each affect the outcome. Organizations should have privacy and security professionals review the actual use case before calls involving PHI go live.
In practice on ThunderPhone
ThunderPhone's public posture is GDPR and HIPAA compliant. Customers remain responsible for configuring their workflows, data handling, recordings, integrations, and notices for their own obligations.