HIPAA compliant voice AI agents: What enterprises should check in 2026
Bland, 6 min read
A HIPAA compliant voice AI agent needs a vendor that signs a Business Associate Agreement (BAA), the contract HIPAA requires of any company handling patient information for a healthcare organization. Bland is HIPAA compliant, includes a BAA on Enterprise, and is full stack, running its own language, speech, and transcription models, so a patient call reaches one AI company.
Patient calls carry protected health information (PHI), and every company that touches it needs coverage. Three checks decide most reviews: what the BAA is attached to, which outside AI companies hear a call, and where recordings and transcripts end up. This page works through each as of November 2026.
What should a HIPAA compliant voice AI agent vendor agree to?
A HIPAA compliant voice AI agent vendor should sign a BAA, name every AI company on a patient call, and say what happens to recordings and transcripts. HIPAA rules for call centers is a useful checklist to keep beside those three questions, and Best HIPAA compliant AI voice agents widens the shortlist.
On the BAA, Bland includes one on Enterprise, which is priced to volume, and says "HIPAA compliant, with BAA" alongside a data processing agreement (DPA, the contract governing how a vendor handles customer data) and a sub-processor list of the outside companies that handle that data.
A signed BAA starts a security review rather than ending it, because what it is attached to matters as much as its signature. For background on whether a phone call itself is covered, see are phone calls HIPAA compliant.
On outside companies, Bland says "Zero AI sub-processors in the call path. One DPA covers it." Bland runs its own SIP signaling and media servers, so no third-party telephony provider sits in the call path, and a customer's own carrier and connected business systems still need covering, so the claim is about AI companies only.
On records, Bland offers real-time PII redaction on call recordings and transcripts, where PII means personal details such as a caller's name, address, or date of birth. Bland also offers zero-retention processing for sensitive workflows. Enterprise customers get dedicated orchestration and dedicated GPUs run by Bland. See trust and security.
Which voice AI providers sign a BAA, and on what terms?
Bland, Retell, Vapi, Synthflow, ElevenLabs, and PolyAI all offer a BAA in some form, and they differ on price and on conditions.
What these rows mean
- HIPAA with a BAA: A Business Associate Agreement, or BAA, is the contract that lets a vendor handle patient information under HIPAA. Bland includes its BAA on Enterprise. Vapi sells HIPAA mode as a $2,000 monthly add-on. Zero Retention only means ElevenLabs' BAA applies only while Zero Retention Mode is on, which limits the language models and analytics a customer can use.
- SOC 2 Type II: SOC 2 Type II is an independent audit of how well a company's security controls work over time.
The fine print attached to each BAA is where providers separate. Vapi sells HIPAA handling as a paid add-on at $2,000 a month, and says "only HIPAA compliant providers may be chosen" once HIPAA mode is on.
Vapi also says HIPAA mode "limits access to certain features, such as reviewing call logs or transcriptions" and calls HIPAA mode and zero data retention "mutually exclusive." Retell charges $0.01 for PII removal on top of its usage rates.
ElevenLabs offers a BAA on Enterprise subscriptions only, and expects a customer to have the BAA signed and Zero Retention Mode switched on. Under that mode only language models from providers with a BAA in place are preconfigured, and a customer wanting any other model has to sign a BAA directly with that model's provider.
An ElevenLabs customer stays responsible for compliance with every obligation that applies to it.
Synthflow executes its BAA at contract signing for customers using its HIPAA Setting, and that setting is disabled by default. PolyAI advertises itself as HIPAA compliant and BAA-backed by default, while its data processing terms bar a customer from providing restricted data unless the agreement says otherwise, a category that covers sensitive personal data.
Retell titles its healthcare page "HIPAA-Compliant Patient Calls," while its terms say the services are not designed for medical, emergency, or other safety-critical environments. A buyer should ask Retell in writing which patient calls that covers.
Decagon and Sierra both hold HIPAA compliance, so a buyer should ask each for its governing BAA before building anything.
Which outside AI companies hear a patient call?
On Bland, no outside AI company hears a patient call, because Bland runs its own language, speech, and transcription models, and it operates a closed-source language model it developed itself. Every outside AI company that handles patient information on another platform is one more company a BAA chain has to cover.
What these rows mean
- AI on each call: This row shows whether the language model, speech, and transcription behind each call belong to the platform or to other companies: Full stack means all three are the platform's own, Outsourced means its language model and transcription come from other companies, and Mixed means it runs some of its own models alongside outside ones. Bland builds and runs its own language, speech, and transcription models, so a call never passes through an outside AI provider. ElevenLabs runs its own speech and transcription, and pairs them with a language model that is one of its own Realtime models (Eleven Realtime v1 Mini or Eleven Realtime v1 Max) or one the customer chooses in Custom mode.
- Language model: A language model decides what an agent says on each turn. Bland builds and runs its own. Retell runs models from other companies, such as GPT, Claude, or Gemini. Vapi runs a model the customer picks from another company, such as OpenAI. Synthflow offers its own model, and GPT models on Enterprise only. ElevenLabs offers its own Realtime models (Eleven Realtime v1 Mini and Eleven Realtime v1 Max), and in Custom mode a customer chooses the language model, which is billed on top. PolyAI offers its own Raven model alongside OpenAI and Amazon Bedrock models.
- Speech generation: Speech generation produces the voice callers hear. Bland builds its own voices as part of a full stack, so there is no separate voice vendor to price or review. Retell offers its own platform voices and voices from ElevenLabs, Cartesia, Minimax, and OpenAI. Vapi offers its own curated Vapi Voices and voices from providers such as ElevenLabs, Cartesia, and OpenAI. Synthflow's default voice is an ElevenLabs model, and it also offers its own Synthflow TTS. ElevenLabs builds its own voices. PolyAI offers its own voices and outside providers such as ElevenLabs and Cartesia.
- Transcription: Transcription turns what a caller says into text. Bland runs its own. Retell uses a provider such as Deepgram, Azure, Soniox, or AssemblyAI. Vapi uses a provider such as Deepgram, billed at cost on top of its hosting fee. Synthflow offers its own transcription or Deepgram. ElevenLabs runs its own. PolyAI offers its own Owl model, or a provider chosen by language.
A platform's BAA does not make the companies behind it go away. An outsourced stack rents its language model, speech, or transcription from others, and on patient calls that brings two risks beyond a longer chain.
A language model controlled by another company can be changed or retired, and an agent's behavior with patients changes with it, along with whatever a compliance team approved. A model lab outage leaves an agent depending on a failover, and a fallback model is another company handling patient information that needs a BAA of its own.
An outsourced stack is a poor fit for patient calls when a team needs an approved model to stay fixed until it decides otherwise, or cannot get proof of a BAA covering every AI company that hears a patient.
Whichever vendor is under review, it should name every company on a patient call and show the BAA covering each one.
What does a HIPAA compliant voice AI agent cost per minute?
Bland charges $0.14 a minute on its self-serve Start plan and $0.12 a minute on its self-serve Build plan, with a $299 monthly platform fee on Build, for all of its AI, and phone is billed separately. A BAA comes with Enterprise. Enterprise pricing is custom, set with Bland's sales team. A buyer should ask for a quote that names it. See pricing for the published plans.
Other providers charge for HIPAA in different ways. Vapi's BAA add-on is $2,000 a month on top of usage rates, and ElevenLabs limits a BAA to Enterprise subscriptions. A buyer comparing providers should ask each one what its BAA costs beyond usage, and which features its HIPAA mode switches off.
What results do regulated teams get from Bland?
Bland handled over 1.3 billion calls for more than 250 enterprise customers as of November 2026, and its customers include public-sector teams where a call has to go right. Voice AI agents for healthcare front desks covers patient scheduling in detail, and the healthcare page and customer stories have more.
Idaho Housing and Finance Association saves $750,000 a year by replacing its IVR with Bland, which handles 4,000 inbound calls a day and cut average call time by 20%.
"We save thousands of dollars a day."
Greg Blake, Chief Information Officer, Idaho Housing and Finance Association
Patient calls also depend on how an agent sounds. Bland Speech v3 ranked 1st of 13 AI voices at 1365 on Design Arena's Audio Realism Bench on 4 August 2026, second only to real human recordings in a blind listening test.
Frequently asked questions
Where can a team start?
A demo built on a real patient workflow is the quickest next step, and pricing sets out what each plan includes. PCI compliant voice AI covers callers who read out card numbers, and Voice AI PII redaction covers personal details.
Is Bland HIPAA compliant?
Yes, Bland is HIPAA compliant, says "HIPAA compliant, with BAA," and a Business Associate Agreement is included on Enterprise. A demo with a security questionnaire is the quickest way to map what applies to a specific set of patient calls.
What is a BAA?
A Business Associate Agreement is a contract between a healthcare organization and a vendor that handles patient information, setting out how that vendor must protect it.
Does an AI model provider need a BAA too?
Generally, yes, because HIPAA extends to subcontractors that handle patient information, so any outside model provider on a call needs coverage, and a compliance team should confirm the details. On Bland, language, speech, and transcription are all Bland's own.
Is Bland only for outbound calls?
No, Bland runs inbound and outbound calls, including AI receptionist and contact center work, and it also runs SMS, web chat, and native branded iMessage agents on Enterprise.
Sources
trust and security, pricing, customer stories, and Design Arena's published results. Each vendor's documents below were read on 5 November 2026:
- Retell: pricing page, healthcare page, terms of service, and documentation on language models, voices, and transcription
- Vapi: HIPAA documentation, pricing page, and documentation on language models, voices, and transcription
- Synthflow: BAA documentation, and voice and general configuration documentation
- ElevenLabs: HIPAA documentation, enterprise page, and language model documentation
- PolyAI: compliance documentation, data processing agreement, and model documentation
- Decagon: security page
- Sierra: trust and reliability page, and trust center
