HIPAA Compliance

Enterprise-Grade Security for Healthcare Providers

Voxanne AI is designed from the ground up to meet HIPAA (Health Insurance Portability and Accountability Act) requirements, ensuring your patient data is protected with industry-leading security measures.

Last Updated: January 30, 2026

1. HIPAA Overview

What is HIPAA?

The Health Insurance Portability and Accountability Act (HIPAA) is a federal law enacted in 1996 to protect sensitive patient health information from being disclosed without patient consent or knowledge. HIPAA establishes national standards for the protection of Protected Health Information (PHI).

Why HIPAA Matters for Healthcare Providers

As a healthcare provider, you are legally required to:

  • Protect patient privacy: Safeguard all PHI from unauthorized access or disclosure
  • Ensure data security: Implement technical, administrative, and physical safeguards
  • Work with compliant vendors: Ensure all third-party service providers sign Business Associate Agreements (BAAs)
  • Report breaches: Notify patients and HHS within 60 days of discovering a data breach
  • Train your workforce: Ensure all staff understand HIPAA requirements and your privacy policies

Our Commitment to HIPAA Compliance

Voxanne AI is committed to full HIPAA compliance. We understand the critical importance of protecting patient health information and have implemented comprehensive security measures across our entire platform. We work exclusively with HIPAA-compliant infrastructure providers and are prepared to sign Business Associate Agreements with all covered entities and healthcare providers.

Enterprise BAA Available

Business Associate Agreements are available for all enterprise customers. Contact our sales team at sales@voxanne.ai to request a BAA.

2. What is Protected Health Information (PHI)?

Definition of PHI

Protected Health Information (PHI) is any individually identifiable health information that is transmitted or maintained in any form or medium by a covered entity or its business associates. PHI includes:

Demographic Information

  • • Patient names
  • • Addresses (street, city, ZIP)
  • • Phone numbers
  • • Email addresses
  • • Dates of birth
  • • Social Security numbers

Medical Information

  • • Medical record numbers
  • • Diagnoses and conditions
  • • Treatment information
  • • Prescription details
  • • Lab results
  • • Insurance information

Communication Records

  • • Call recordings
  • • Voicemail transcripts
  • • SMS messages
  • • Email correspondence
  • • Appointment notes
  • • Patient inquiries

Unique Identifiers

  • • Medical record numbers
  • • Health plan numbers
  • • Account numbers
  • • Device identifiers
  • • IP addresses (in some contexts)
  • • Biometric identifiers

How Voxanne AI Handles PHI

Voxanne AI processes and stores the following types of PHI on behalf of healthcare providers:

  • Call Recordings & Transcripts: When patients call your practice, their conversations with our AI voice agent may contain PHI such as symptoms, medication questions, or appointment preferences. All recordings and transcripts are encrypted and stored securely.
  • Patient Contact Information: We store patient names, phone numbers, email addresses, and appointment details to facilitate scheduling and follow-up communications.
  • Appointment Data: We access your Google Calendar to check availability and book appointments. This may include patient names and appointment types (e.g., "Annual Checkup," "Botox Consultation").
  • Medical Queries: Patients may ask questions about medical procedures, treatments, or conditions. Our AI responds using your knowledge base but does not provide medical advice.

Important: PHI Redaction

Voxanne AI automatically redacts certain types of PHI (such as Social Security numbers, credit card numbers, and explicit diagnoses) from stored transcripts to minimize risk. However, you should configure your AI agent to avoid asking for highly sensitive information unless necessary.

3. Security Safeguards

HIPAA requires covered entities and business associates to implement administrative, physical, and technical safeguards to protect PHI. Voxanne AI adheres to all three categories of safeguards:

Administrative Safeguards

Administrative safeguards are policies and procedures designed to manage the selection, development, implementation, and maintenance of security measures to protect PHI.

  • Security Management Process: We conduct annual risk assessments to identify vulnerabilities and implement corrective actions
  • Workforce Training: All employees complete HIPAA training upon hire and annually thereafter
  • Access Authorization: Role-based access control (RBAC) ensures employees only access PHI necessary for their job functions
  • Workforce Clearance: Background checks are conducted for all employees with access to PHI
  • Incident Response: We maintain a documented incident response plan for security breaches
  • Contingency Planning: Disaster recovery and backup procedures ensure data availability

Physical Safeguards

Physical safeguards protect the physical systems, buildings, and equipment where PHI is stored.

  • Data Center Security: Our infrastructure providers (Supabase, Google Cloud) operate SOC 2 Type II certified data centers with 24/7 physical security
  • Access Controls: Biometric authentication and keycard access restrict entry to server rooms
  • Device Security: All employee laptops are encrypted with BitLocker (Windows) or FileVault (Mac)
  • Workstation Security: Automatic screen locks after 5 minutes of inactivity
  • Media Disposal: Hard drives are securely wiped or physically destroyed before disposal

Technical Safeguards

Technical safeguards are the technology and policies that protect PHI and control access to it.

  • Access Control: Unique user IDs, automatic logoff after 15 minutes, and multi-factor authentication (MFA) for administrative access
  • Audit Controls: All access to PHI is logged with immutable audit trails retained for 7 years
  • Integrity Controls: Digital signatures and checksums verify data has not been altered
  • Transmission Security: TLS 1.3 encryption for all data transmitted over networks
  • Encryption: AES-256 encryption for all PHI stored at rest (see Section 4)

4. Encryption Standards

Encryption is one of the most critical technical safeguards for protecting PHI. Voxanne AI uses industry-leading encryption standards to protect data both at rest and in transit.

Encryption at Rest (Stored Data)

All PHI stored in our database is encrypted using AES-256 encryption, the same encryption standard used by banks and government agencies.

  • Algorithm: AES-256 (Advanced Encryption Standard with 256-bit keys)
  • Key Management: Encryption keys are stored separately from data and rotated every 90 days
  • Database Provider: Supabase (SOC 2 Type II certified, HIPAA-compliant infrastructure)
  • Backup Encryption: All database backups are encrypted with the same AES-256 standard
  • Media Encryption: Call recordings stored in cloud storage are encrypted at rest

Encryption in Transit (Data Transmission)

All PHI transmitted over networks (including the internet) is encrypted using TLS 1.3, the latest and most secure version of Transport Layer Security.

  • Protocol: TLS 1.3 (Transport Layer Security 1.3)
  • Certificate Authority: Let's Encrypt (industry-standard SSL certificates)
  • API Communications: All API calls between frontend, backend, and third-party services use HTTPS/TLS 1.3
  • Voice Calls: Voice data transmitted via Vapi and Twilio is encrypted end-to-end using SRTP (Secure Real-time Transport Protocol)
  • Webhook Delivery: All webhook payloads containing PHI are transmitted over TLS 1.3

End-to-End Encryption for Voice Calls

Phone calls between patients and our AI voice agent are encrypted from end to end:

  • Patient to Twilio: PSTN call encrypted by carrier (varies by carrier)
  • Twilio to Vapi: SRTP (Secure Real-time Transport Protocol) encryption
  • Vapi to AI Model: TLS 1.3 encrypted API calls
  • Storage: Call recordings encrypted with AES-256 and stored in compliance with retention policies

Encryption Key Management

Encryption keys are managed using industry best practices: keys are stored in secure hardware security modules (HSMs), rotated every 90 days, and never transmitted in plaintext. Access to encryption keys is restricted to authorized security personnel only.

5. Access Controls

Access controls ensure that only authorized individuals can access PHI, and only to the extent necessary for their job functions. Voxanne AI implements multiple layers of access control:

Role-Based Access Control (RBAC)

Users are assigned roles based on their responsibilities, and each role has specific permissions:

RolePermissionsPHI Access
Practice AdministratorFull access to all features, settings, and patient dataFull access to all PHI
Office ManagerView patient data, manage appointments, configure AI agentLimited to patient contact info and appointments
ReceptionistView call logs, listen to recordings, send follow-up messagesLimited to call data and contact info
Billing StaffView patient contact info, export billing reportsNo access to call recordings or medical queries
Read-Only UserView-only access to analytics and reportsDe-identified data only (no PHI)

Multi-Factor Authentication (MFA)

All user accounts with access to PHI are required to use multi-factor authentication:

  • Primary Authentication: Username and password (minimum 12 characters, complexity requirements)
  • Secondary Authentication: Time-based one-time password (TOTP) via authenticator app (Google Authenticator, Authy, etc.)
  • Enforcement: MFA is mandatory for all users; cannot be disabled without administrator approval
  • Recovery Codes: Users receive 10 recovery codes for account recovery if they lose their authenticator device

Audit Logging

All access to PHI is logged in immutable audit trails:

  • Events Logged: Login/logout, PHI viewing, data modifications, report generation, settings changes
  • Information Captured: User ID, timestamp, IP address, action performed, data accessed
  • Retention Period: 7 years (HIPAA requirement)
  • Access to Logs: Restricted to security administrators and compliance officers
  • Monitoring: Automated alerts for suspicious activity (e.g., multiple failed login attempts, unusual data access patterns)

Session Management

To prevent unauthorized access, we enforce strict session management policies:

  • Automatic Timeout: Sessions expire after 15 minutes of inactivity
  • Session Revocation: Users can view and revoke active sessions from the security settings page
  • Force Logout: Administrators can force logout all users in case of security incident
  • Concurrent Session Limits: Users can have a maximum of 3 concurrent sessions

Principle of Least Privilege

We adhere to the principle of least privilege: users are granted the minimum level of access necessary to perform their job functions. Access rights are reviewed quarterly and adjusted as roles change.

6. Business Associate Agreement (BAA)

What is a Business Associate Agreement?

A Business Associate Agreement (BAA) is a written contract required by HIPAA between a covered entity (healthcare provider) and a business associate (service provider like Voxanne AI) that creates, receives, maintains, or transmits PHI on behalf of the covered entity.

The BAA ensures that the business associate:

  • Implements appropriate safeguards to protect PHI
  • Reports any security incidents or breaches to the covered entity
  • Ensures its subcontractors (if any) also comply with HIPAA
  • Returns or destroys PHI when the relationship ends
  • Allows the covered entity to audit compliance

When is a BAA Required?

A BAA is required whenever a business associate will create, receive, maintain, or transmit PHI on behalf of a covered entity. If you are a healthcare provider (doctor, dentist, chiropractor, therapist, etc.) using Voxanne AI to handle patient calls and appointments, you must have a signed BAA with us.

How to Request a BAA

Business Associate Agreements are available for all enterprise customers at no additional charge. To request a BAA:

  1. Contact our sales team at sales@voxanne.ai
  2. Provide your practice name, contact information, and intended use case
  3. Review our standard BAA template (we can accommodate reasonable modifications)
  4. Sign electronically via DocuSign or wet signature
  5. We will countersign and provide you with a fully executed copy within 3 business days

Our BAA with Infrastructure Providers

As a business associate, we are also required to have BAAs with our subcontractors that handle PHI. Voxanne AI has signed BAAs with the following infrastructure providers:

  • Supabase: Database and authentication provider (SOC 2 Type II certified, HIPAA-compliant infrastructure)
  • Twilio: Telephony and SMS provider (HIPAA-eligible, BAA available)
  • Google Cloud: Infrastructure provider for AI models and storage (HIPAA-compliant, BAA signed)
  • Vapi: Voice AI platform (HIPAA-eligible, BAA available)

Important: Wallet Funding Requirement

BAAs require an active, funded account. If you are a healthcare provider subject to HIPAA, ensure your wallet is funded before processing PHI. Contact sales@voxanne.ai to discuss BAA execution and compliance requirements.

7. Breach Notification Procedures

What is a Data Breach?

Under HIPAA, a breach is defined as the unauthorized acquisition, access, use, or disclosure of PHI that compromises the security or privacy of the information. Examples include:

  • Hacking or ransomware attack resulting in PHI exposure
  • Lost or stolen laptop/device containing unencrypted PHI
  • Accidental email of PHI to wrong recipient
  • Unauthorized employee accessing patient records
  • Vendor security incident affecting PHI

Our Breach Response Plan

If we discover a breach of PHI, we follow a comprehensive incident response plan:

Step 1: Detection & Containment (Within 24 Hours)

  • • Identify the source and scope of the breach
  • • Immediately contain the breach to prevent further exposure
  • • Preserve evidence for forensic investigation
  • • Activate incident response team

Step 2: Assessment (Within 48 Hours)

  • • Conduct forensic investigation to determine what PHI was exposed
  • • Identify all affected individuals and covered entities
  • • Assess risk of harm to individuals (identity theft, financial loss, etc.)
  • • Document findings in incident report

Step 3: Notification (Within 60 Days)

  • • Notify all affected covered entities (healthcare providers) without unreasonable delay
  • • Provide details: what happened, what PHI was exposed, steps we're taking
  • • Assist covered entities in notifying affected individuals (if required)
  • • Report breach to HHS if affecting 500+ individuals

Step 4: Remediation & Prevention (Ongoing)

  • • Implement corrective actions to prevent recurrence
  • • Conduct post-incident review to identify lessons learned
  • • Update security policies and procedures as needed
  • • Provide additional workforce training if human error was involved

Your Responsibilities as a Covered Entity

If we notify you of a breach affecting your patients, you are responsible for:

  • Notifying affected individuals without unreasonable delay (and no later than 60 days from discovery)
  • Providing notice in writing (first-class mail or email if the individual agreed to electronic notice)
  • Reporting the breach to HHS (if affecting 500+ individuals, within 60 days; if fewer than 500, annual report)
  • Reporting to media (if breach affects 500+ individuals in your state/jurisdiction)
  • Documenting the breach and your response for compliance audits

Contact Us for Security Incidents

If you suspect a security incident or breach involving Voxanne AI, please contact us immediately:

Emergency Hotline:Available 24/7 for security incidents

We take all security incidents seriously and will investigate promptly. Do not attempt to investigate the incident yourself as this may compromise evidence.

8. Patient Rights Under HIPAA

HIPAA grants patients specific rights regarding their PHI. As a business associate processing PHI on behalf of healthcare providers, we support these rights:

Right to Access

Patients have the right to access their PHI, including call recordings and transcripts. Upon request from a covered entity, we will provide copies of PHI within 30 days.

Note: Patients should make access requests directly to their healthcare provider, not to Voxanne AI. The covered entity is responsible for fulfilling access requests.

Right to Amendment

Patients have the right to request amendments to their PHI if they believe it is inaccurate or incomplete. We will make amendments upon instruction from the covered entity.

Right to Accounting of Disclosures

Patients have the right to receive a list of disclosures of their PHI. Our audit logs capture all disclosures, and we will provide accounting reports upon request from the covered entity.

Right to Request Restrictions

Patients have the right to request restrictions on how their PHI is used or disclosed. While we are not required to agree to all restrictions, we will accommodate reasonable requests when instructed by the covered entity.

Right to Confidential Communications

Patients have the right to request that communications containing PHI be sent to alternative locations or by alternative means. This is managed by the covered entity.

Right to Be Notified of Breaches

Patients have the right to be notified if their unsecured PHI is breached. We will notify covered entities of any breaches, and the covered entity is responsible for notifying affected patients.

9. Compliance Certifications

Voxanne AI and our infrastructure providers maintain industry-leading security certifications:

SOC 2 Type II

Our infrastructure providers (Supabase, Google Cloud) are SOC 2 Type II certified, demonstrating effective controls for security, availability, processing integrity, confidentiality, and privacy.

Voxanne AI is currently undergoing SOC 2 Type II audit (expected completion: Q2 2026).

HIPAA Compliance

All infrastructure providers have signed BAAs and maintain HIPAA-compliant infrastructure. Voxanne AI adheres to all HIPAA Security Rule and Privacy Rule requirements.

Annual security assessments conducted to verify ongoing compliance.

GDPR Compliance

For European and UK customers, we comply with GDPR requirements including data subject rights, data retention policies, and international data transfer mechanisms (SCCs).

Penetration Testing

We conduct annual third-party penetration testing to identify and remediate security vulnerabilities before they can be exploited.

Last penetration test: December 2025. Next scheduled: December 2026.

Ongoing Security Assessments

  • Annual Risk Assessments: Comprehensive review of security posture and risk mitigation strategies
  • Quarterly Vulnerability Scans: Automated scanning for known vulnerabilities in infrastructure
  • Monthly Security Reviews: Review of access logs, incident reports, and security metrics
  • Continuous Monitoring: 24/7 security monitoring with automated alerts for anomalous activity

10. Contact Information

For questions about HIPAA compliance, security measures, or to request a Business Associate Agreement:

Security Officer

For security incidents, vulnerability reports, and security-related inquiries.

Privacy Officer

For privacy policy questions, patient rights requests, and data access inquiries.

Business Associate Agreements

For BAA requests, enterprise contracts, and compliance documentation.

General Support

For general customer support, technical issues, and feature questions.

Mailing Address

Voxanne AI
A product of Call Waiting AI Ltd.
Collage House, 2nd Floor
17 King Edward Road
Ruislip, London HA4 7AE
United Kingdom

Ready to Get Started?

Join hundreds of healthcare providers using Voxanne AI to automate patient communications while maintaining HIPAA compliance.