Four regimes touch almost every voice deployment: HIPAA if you handle patient information, TCPA if you dial out, PCI if you take payment, and state recording-consent law regardless. Each one has a specific control that keeps it in bounds, and each control has a cost in conversation design.
We act as a business associate to your practice and sign a BAA before any patient information moves. The agent is built to minimum-necessary disclosure and will not read patient details back to an unverified caller. Transcripts are redacted before they reach any logging system, and retention follows your policy rather than ours.
Inbound answering is not the exposure; outbound dialling is. Outbound campaigns run only against contact lists you certify as consented, honour do-not-call state immediately rather than at the next sync, and log consent provenance per number. Time-of-day windows are enforced by the dialler, not by the operator remembering.
The cleanest control is never to hear a card number. The agent does not capture card details on the call line; payment is handed to a hosted Stripe link delivered over SMS while the caller stays on the line. That keeps card data out of transcripts, out of logs, and out of your PCI scope altogether.
Two-party consent states require disclosure before recording begins, so the disclosure is part of the greeting and is configured by the number's state rather than set globally. Callers who decline are routed to a non-recorded path. This costs about four seconds of greeting and removes an entire class of legal risk.