HIPAA and PCI DSS When AI Answers the Phone

If your calls involve a patient’s condition or appointment, or a customer’s card number, the AI that answers them is handling regulated data, and so is every vendor behind it. Neither HIPAA nor PCI DSS prohibits an AI front desk. Both require that you know exactly where the data goes and that you have the agreements and controls to match. This page explains the two frameworks in plain English and sets out the routing rules Redial applies until a platform’s posture is documented. Not legal advice; last reviewed October 12, 2026.

HIPAA: The Business Associate Chain

Under HIPAA, a covered entity such as a medical or dental practice may share protected health information with a business associate only under a business associate agreement. The US Department of Health and Human Services is explicit that the obligation runs downstream: a business associate must have a business associate agreement with any subcontractor before disclosing protected health information to it, and downstream subcontractors are themselves business associates with the same obligations ¹.

For an AI front desk, the chain is longer than it looks. A patient’s call may pass from your practice to the service provider that operates the front desk, to the company that developed the platform, to the speech-recognition and language-model vendors the platform uses, and to whatever stores the recordings and transcripts. Every link that touches protected health information needs an agreement, and the agreements need to prohibit uses such as model training unless you have authorized them.

Even with the chain complete, “HIPAA compliant” is a description of a program, not a certification, because HHS does not certify compliance. Redial describes its programs as aligned with HIPAA and documents the basis.

What an AI Should and Should Not Handle for a Practice

Appointment scheduling, reminders, hours, directions, and insurance-accepted questions involve limited protected health information and are the natural first tier. Anything clinical (symptoms, results, medication, treatment advice) should go to a person by rule, both because of HIPAA and because the Texas Responsible AI Governance Act and Utah’s regulated-occupation rule impose up-front AI disclosure duties on health care providers specifically ^{2 3}. An AI front desk in a practice should disclose that it is an AI at the start of every call regardless.

PCI DSS: Card Data in Recordings

PCI DSS prohibits storing sensitive authentication data, including the card validation code, after authorization, and the PCI Security Standards Council applies that rule to call recordings. Its June 2025 FAQ states that every effort must be made to prevent sensitive authentication data from being recorded; that where a recording system offers suppression or redaction (pause-and-resume or automated masking), it should be enabled; and that if recording cannot be prevented, the data must be securely deleted immediately upon authorization and must not be retained in digital audio files ⁴. A transcript is a digital record of the same conversation and should be treated the same way.

For an AI front desk that means payment capture must be designed so card data never enters the recording or the transcript: a secure payment link sent by text, a DTMF or tokenized capture that the AI never “hears,” or a handoff to a person using a PCI-aligned payment process. Until one of those is in place and documented, payments go to a person by rule.

The Routing Rules Redial Applies

Until a platform’s HIPAA and PCI DSS posture is documented link by link, Redial applies three rules in any program with health or payment data: clinical calls go to a person; payments go to a person using a PCI-aligned process; and the AI discloses that it is an AI and that the call is recorded at the start of every call. These are design choices, not limitations of the technology, and they are the same choices a careful practice manager would make.

How Redial Fits

Redial has run healthcare programs since 2017, including insurance verification and patient-facing support, and describes those programs as aligned with HIPAA and PCI DSS with documented controls ⁵. In a 90-day engagement for a national dental provider, Redial stood up 112 agents in South Africa, cut insurance verification time by 31%, and reduced cost by 38% while maintaining 93% patient satisfaction, with no involuntary layoffs at the client ⁶. The AI front desk it is previewing, IzzyOps (working name), will be offered to practices only once the business associate chain is documented, with clinical and payment calls routed to a person by rule until then.