HIPAA mode
HIPAA mode for your AI voice agents
Turn it on for any agent that takes patient calls. Trillet stops recording that agent’s calls and stops storing their transcripts on its servers. Patient health information still needs a signed BAA.
How it works
From switch to signed BAA.
HIPAA mode is a setting on each agent. Here is what changes when you turn it on, and what to sign before patient data flows.
Open the agent’s Advanced Settings, go to HIPAA & Compliance and switch on HIPAA compliance mode. It applies to that agent only: your other agents keep their own settings.
Call recording and public recording links switch off and are greyed out. While the mode is on, Trillet won’t start a recording for that agent, whichever of your numbers the call comes in on.
When a call ends, its transcript is cleared from Trillet’s servers. The call stays in Call History, marked HIPAA Protected.
Patient health information needs an executed Business Associate Agreement (BAA) and an Order Form that names the workflow. BAAs are available on Agency and Enterprise.
Controls
Set it per agent. It holds.
HIPAA mode is one switch on the agent, and the platform enforces it on every call that agent takes.
Per-agent switch
Turn it on for the agents that take patient calls. Agents for sales or support in the same workspace can keep recording.
Recording locked off
Trillet won’t start a recording for an agent in HIPAA mode, whatever its recording setting says, and no recording link is attached to the call.
Phone numbers can’t turn it back on
Connecting the agent to a phone number doesn’t bring recording back: the number’s setup shows that the agent can’t record calls.
Redaction is its own switch
“Redact sensitive details from transcripts” sits beside HIPAA mode in the same panel and is turned on separately. HIPAA mode itself doesn’t redact.
Guardrails
Nobody turns it down by accident.
The AI Assistant and Call History respect the setting, so a quick change can’t undo it.
The Assistant only turns it on
The AI Assistant can propose turning HIPAA mode on, for you to approve. It never turns it off: that goes through support.
Nothing new gets call data
On an agent in HIPAA mode, the Assistant won’t propose turning recording on, turning redaction off, or adding transfers, redirect numbers, in-call APIs or webhooks that send call data somewhere new. It points you to support instead.
Marked in Call History
Calls from the agent show as HIPAA Protected, with no recording and no transcript, and their analysis can’t be re-run.
Agreements
The paperwork patient calls need.
The switch controls what Trillet stores. Patient health information also needs the right agreements in place.
BAA on Agency and Enterprise
Patient health information needs an executed BAA and an Order Form identifying the covered workflow. BAAs are available on Agency and Enterprise after Trillet’s standard process. You don’t need one to turn HIPAA mode on or to test with non-PHI data.
SOC 2 Type II and ISO 27001
Trillet holds SOC 2 Type II and ISO 27001 certifications, with audit trails and access controls across the platform.
Stricter deployments on Enterprise
On Enterprise, a fully no-storage deployment can be scoped, and on-premise, private cloud and data residency are available by agreement.
Frequently asked questions
Can Trillet handle patient calls under HIPAA?
HIPAA mode is available on Studio, Agency and Enterprise, with a Business Associate Agreement (BAA) on Agency and Enterprise. Processing patient health information requires an executed BAA and an Order Form that identifies the covered workflow. SOC 2 Type II and ISO 27001 certifications are in place.
What does HIPAA mode do?
HIPAA mode stops call recordings and transcripts being stored on Trillet’s servers. For an agent with it on, no recording is started, and the transcript is cleared after each call.
Do we need a BAA?
To process patient health information, yes: an executed BAA and an Order Form identifying the covered workflow. BAAs are available on Agency and Enterprise after Trillet’s standard process. You don’t need a BAA to turn HIPAA mode on or to test with non-PHI data.
Can some agents record calls and others not?
Yes. HIPAA mode is set per agent, so an agent that takes patient calls can have it on while other agents in the same workspace keep recording.
Does HIPAA mode redact transcripts?
No. Redaction is a separate setting in the same panel, “Redact sensitive details from transcripts”, which you turn on yourself.
Will our calls still show in Call History?
Yes. Each call is listed and marked HIPAA Protected, with no recording and no transcript, and its analysis can’t be re-run.
What about data we send to our own systems?
HIPAA mode covers what is stored on Trillet’s servers. Data you send elsewhere, such as to your webhooks, in-call APIs or connected systems, is in your own scope, and the mode doesn’t extend to subprocessors or all operational metadata.
Can nothing be stored at all, or can it run on our own servers?
On Enterprise, a fully no-storage deployment can be scoped, and on-premise or private cloud deployment is available by agreement. Speak to sales to scope it.
Which plans include HIPAA mode?
Studio, Agency and Enterprise. BAAs are available on Agency and Enterprise.
See HIPAA mode on a live agent.
Book a demo and we’ll turn HIPAA mode on for an agent, place a test call, and walk you through the BAA.