A Practical Guide to AI Voice Agents for Medical Practices

In May 2026, TechCrunch reported that AI voice startup Vapi had raised a $50 million Series B led by Peak XV Partners, at a valuation of around $500 million according to a person familiar with the deal. The headline customer was Amazon's Ring, which evaluated more than 40 AI voice vendors and now routes its inbound support calls through Vapi's platform.

Big companies moving their phone lines to AI agents is the news. The useful question for a med spa, clinic or dental office is narrower: which calls should an AI agent answer, which should it hand off, and what legal ground rules apply before it picks up the phone. This guide covers all three.

What an AI voice agent actually does

An AI voice agent answers or places phone calls using speech recognition, a language model and a synthetic voice. Unlike an old phone tree, the caller talks normally and the agent responds in full sentences. The better setups connect the agent to a calendar, a CRM or a practice management system so it can do things, not just talk.

For a practice, the agent usually sits in one of three places:

After hours and overflow: it answers when the front desk can't, so calls stop going to voicemail.
First line on every call: it greets, handles simple requests and routes the rest.
Outbound: reminder calls, rebooking calls and follow-up after an inquiry.

The inbound and outbound cases carry different legal rules, covered below.

What voice agents handle well

Voice agents are strongest on calls that are frequent, predictable and low risk. In most practices that is a large share of the phone volume.

Hours, location, parking and directions.
Booking, rescheduling and canceling, when the agent can read and write to the real calendar.
Basic service questions answered from a script the practice has approved, such as what a consultation includes or how long a visit takes.
Capturing new-patient details (name, callback number, reason for the visit in the caller's own words) and passing them to staff.
Routing: "billing", "a provider's office", "a pharmacy calling back" each go to the right person or queue.
Answering at 9 p.m. on a Saturday, when a missed call often turns into a booking somewhere else.

The common thread is that the right answer is already written down. The agent should answer from an approved knowledge base, not from whatever the underlying model happens to know.

What they handle badly

Voice agents are weakest where judgment, empathy or clinical knowledge is required. Practices that go live without fencing these off tend to find out the hard way.

Clinical questions and symptoms. An agent should not tell a caller whether a reaction is normal, whether to take a medication, or whether something can wait. That is a clinician's call.
Emergencies. Many practices script the agent to tell anyone describing an emergency to hang up and call 911, and to stop there.
Billing disputes and insurance specifics. Coverage questions often depend on details the agent can't see.
Upset or confused callers. Repeating the same scripted answer to an angry patient makes things worse.
Poor audio, heavy background noise and some accents. Speech recognition errors compound quickly on a bad line.
Anything off-script. Language models can produce confident wrong answers. If it isn't in the approved material, the agent should say so and offer a person.

Design the escalation path first

The handoff to a human is the most important part of the build. Before launch, write down the triggers that send a call to staff:

The caller asks for a person, in any wording.
The caller mentions symptoms, a reaction, a complication or an emergency.
The caller is a provider, pharmacy, lab or payer.
The agent fails to understand the caller twice in a row.
The topic is billing, a complaint, or a records request.

Then decide what happens on each trigger. A warm transfer to a live line works during business hours. After hours, the agent can take a message, tag it urgent in the CRM and alert the on-call contact. Either way, the caller should never be stuck in a loop, and staff should get a written summary so the patient does not have to repeat everything.

Review a sample of call transcripts every week for the first month. That is where you find the questions your script missed.

Call recording consent

Most voice platforms record and transcribe calls by default, which brings recording law into play.

Federal law (18 U.S.C. 2511) uses a one-party consent rule: a recording is generally lawful if one party to the call consents. States can be stricter. According to the Reporters Committee for Freedom of the Press, about 11 states generally require consent from everyone on the call, including California, Delaware, Florida, Illinois, Maryland, Massachusetts, Montana, New Hampshire, Pennsylvania and Washington, with Michigan's rule unsettled. Connecticut and Nevada apply an all-party rule to phone calls in particular.

Callers don't always live where the practice is, and courts disagree about which state's law governs a call that crosses state lines. For that reason, many businesses simply announce the recording at the start of every call ("this call may be recorded") so that callers who stay on the line have been told. Talk to counsel about the wording and about how long recordings are kept.

Outbound calls and the TCPA

In a Declaratory Ruling released February 8, 2024 (FCC 24-17), the Federal Communications Commission confirmed that AI technologies that generate human voices count as an "artificial or prerecorded voice" under the Telephone Consumer Protection Act. The practical effect: outbound calls that use an AI voice need the called party's prior express consent unless an emergency purpose or exemption applies, and calls that include advertising or telemarketing need prior express written consent.

FCC rules also require artificial or prerecorded voice messages to identify the business responsible for the call at the start of the message.

The ruling is about calls the business places, so an agent that only answers inbound calls is not its main target. Reminder calls, reactivation campaigns and "we noticed you didn't book" follow-ups are outbound, and the consent records behind them matter. Healthcare calls have their own provisions in the FCC's rules, so this is a good topic to review with counsel before switching on any outbound campaign.

HIPAA and business associate agreements

If the practice is a HIPAA covered entity, a voice agent that hears, records, transcribes or stores patient information is handling protected health information. Generally, a covered health care provider is one that submits standard transactions such as claims electronically. Some cash-pay med spas fall outside that definition, though state privacy laws may still apply, so confirm your status with counsel rather than assuming.

For covered entities, the vendor running the voice agent is usually a business associate, which means a business associate agreement (BAA) needs to be in place before patient information flows through it. HHS has said that a cloud provider storing electronic PHI is a business associate even if the data is encrypted and the provider holds no key, and that such a provider does not fit the narrow "conduit" exception.

Voice agents usually involve several vendors stacked together. Questions worth asking:

Does the voice platform sign a BAA, and on which plan?
Which telephony, speech-to-text and language model providers sit underneath it, and are they covered by BAAs too?
Where are recordings and transcripts stored, for how long, and who can access them?
Is customer data used to train the vendor's models, and can that be switched off?
Does the CRM or booking tool that receives the call summary also have a BAA in place?

A short launch checklist

Write the approved knowledge base and the list of topics the agent must not answer.
Define escalation triggers and test each one with real staff on the other end.
Add a recording notice to the greeting and set a retention period.
Confirm consent records before any outbound calling.
Get BAAs signed for every vendor that touches PHI, if you are a covered entity.
Review transcripts weekly for the first month, then monthly.

Where NutriCove fits

NutriCove sets up AI automation for medical offices, including an AI receptionist, missed-call text back, follow-up and online booking. Our medical page notes that GoHighLevel, the platform behind these systems, needs its HIPAA add-on and a signed BAA before any patient information goes in. If you're weighing an AI agent for your phones, see how we set it up for medical offices.

Sources

This article is general information, not legal or medical advice. Talk to a qualified attorney or licensed professional about your situation.