Review the actual workflow, data path and jurisdictions—not a generic claim that the platform is compliant. The following is an issue-spotting checklist for qualified reviewers, not legal clearance.
Which calling rules are relevant?
| Issue | Established source position | DIY action |
|---|---|---|
| Outbound AI-generated voice | The FCC’s 8 February 2024 ruling places AI-generated voices within TCPA artificial/prerecorded-voice restrictions. Applicable consent requirements and exemptions still matter. | Obtain workflow-specific approval before enabling outbound calling. (docs.fcc.gov) |
| Telemarketing | FCC delivery restrictions and FTC telemarketing rules address matters including consent, do-not-call controls and applicable opt-out requirements. | Have counsel map both regimes and relevant state rules to the campaign. Do not treat a captured telephone number as sufficient authorisation. (ecfr.gov) |
| Recording and interception | California’s Attorney General explains that its privacy law protects confidential telephone calls against recording without the other party’s consent, subject to applicable exceptions. | Review caller and business locations, recording, transcription and notices separately. Do not assume one nationwide script settles every issue. (oag.ca.gov) |
| AI disclosure | The FCC’s 2024 AI-calling disclosure document was a proposal, not by itself proof of an operative universal disclosure rule. | Disclose automation as a design policy, and have counsel verify the current federal and state requirements for your launch. (docs.fcc.gov) |
Treat a missed-call callback as a separate outbound workflow for approval. Do not silently add lead follow-up, appointment reactivation or marketing calls to an inbound pilot. The legal review should specify the permitted purpose, evidence of consent where required, suppression controls and revocation process. (ecfr.gov)
An illustrative greeting for review—not a legally approved script—is:
You’re speaking with the automated assistant for [business]. I can help with [approved tasks] or help you reach our team.
Have counsel add the necessary recording and privacy language. Design what happens when a caller declines recording or automation; do not let the conversation continue into an unapproved processing path.
What changes for dental and healthcare scheduling?
HHS states that a cloud provider creating, receiving, maintaining or transmitting electronic protected health information on behalf of a covered entity or business associate is generally a business associate, even where it holds only encrypted information and lacks the key. Appropriate agreements and the organisation’s own risk analysis remain necessary. (hhs.gov)
Before patient data enters the system:
- Map telephony, speech processing, model providers, orchestration, integration middleware, storage, analytics and support access.
- Confirm which entities require business associate arrangements and who contracts with each subcontractor.
- Verify that the selected product, configuration and features are covered—not merely that the supplier offers a BAA somewhere.
- Use synthetic patient records during initial development.
- Have the practice approve identity checks and information that may be disclosed before verification.
- Route clinical questions to the approved human process rather than inventing advice.
HHS also distinguishes the covered entity’s relationship with its business associate from the business associate’s responsibility for relevant subcontractor agreements. Do not assume the buyer must contract directly with every subprocessor, or that one top-level signature resolves the whole chain. (hhs.gov)
What should you do about payments and voice identification?
Keep payment-card collection outside the first pilot unless you have a separately approved payment architecture. PCI SSC states that storing card validation values in digital audio after authorisation violates the relevant storage prohibition. Transfer callers into an approved payment path rather than relying on later transcript redaction. (pcisecuritystandards.org)
Treat voice-based identification as a separate approval request. Illinois’s Biometric Information Privacy Act expressly includes voiceprints and contains collection, retention and disclosure provisions, with defined exclusions. Do not assume that ordinary transcription and biometric identification are the same processing activity. (ilga.gov)
What contractual details should security and procurement verify?
Request a written answer for each of these proposed controls:
- Which audio, transcripts, metadata and tool responses are retained?
- Where are they processed and stored?
- Who can access them, including supplier support personnel?
- Is customer data used for model training, evaluation or service improvement?
- Which controls apply to subprocessors?
- What does deletion cover, and what exceptions apply?
- What happens to backups, exports and integration logs?
- Which agreement prevails if the order form, standard terms and privacy documents differ?
A current example shows why precise wording matters. Retell’s terms, last updated 7 October 2026, describe permission for certain de-identified and aggregated service-model development and training uses where recording has not been opted out. Separately, its 22 July 2026 trust-centre notice says two named subprocessors may not train their own models on customer data without explicit written consent. These statements address different actors and uses; neither justifies a blanket conclusion that every form of training is prohibited. Ask the supplier to reconcile the applicable terms for your configuration in writing. (retellai.com)
Deliverable: an approved data-flow diagram, contract register, access matrix, retention schedule and incident-response contact list.