Blog · Compliance
A BAA and recording checklist before the first protected call
If you handle protected health information, turn recording, transcripts, and AI summaries on only after the paperwork and the pause-resume habit are real.
July 15, 2026 · 3 min read · Avaga desk
This is not legal advice. It is the operator checklist we walk before a healthcare or benefits team puts protected information on an Avaga line. SOC 2, GDPR, HIPAA readiness, and SSO/SAML are on the trust list. A Business Associate Agreement is a sales conversation, not a self-serve checkbox on Lite.
Before the first recording
- Confirm whether you need a BAA. If you do, talk to sales. Do not self-serve checkout and hope.
- Decide who can play recordings. Not every agent seat needs the archive.
- Turn on pause and resume for card numbers and identity documents.
- Write the disclosure the caller hears. Match it to the states and channels you actually use.
- Know where transcripts, summaries, and CRM logs land. AI notes are still records.
On the live call
Avaga Calling includes recordings, and pause/resume when a card is read. Assist Pro can still write a summary after you pause. Train the team to pause before the digits, not after. A perfect transcript of a card number is a perfect incident.
If after-hours overflow goes to an AI employee, give that seat the same recording rules as a human. The model does not get a free pass because it is fast. Enterprise plans add custom SLA, security review, and BAA language. Growing teams that are not ready for that layer should keep PHI off the line until the review is done.
Screenshots and comparison tables are a guide, not a contract. If a capability matters to a regulated floor, confirm it with us before you buy.
Print this list. Walk it with whoever owns compliance. Then turn recording on. The other order is how inboxes fill with data you were not ready to hold.