PHI is the HIPAA-defined category of patient data: name, date of birth, address, phone number, medical record number, diagnosis, treatment, anything that links an individual to a health event. Eighteen specific identifiers are enumerated in the regulation.
For a voice agent serving a clinic, almost every interaction touches PHI. The caller saying their name is PHI. The reason for the call is often PHI. The reschedule note that goes into the EHR is PHI. There is no realistic clinical AI deployment that avoids PHI; the question is whether the vendor handles it correctly.
Correct handling means: encrypted in transit, encrypted at rest, scoped to the minimum necessary, redacted from telemetry and training data, retained only as long as the BAA permits, and deleted on patient request. A vendor that says they "do not store PHI" but transcribes calls to an LLM with retention enabled is mishandling PHI whether they realize it or not.
Vorel treats all clinic call audio and transcripts as PHI by default. Telemetry, model logs, and analytics are redacted at the source; full audio retention is opt-in per tenant and bounded by the BAA terms.