Optima Voice: how a HIPAA-compliant voice agent is architected end to end.
Building a voice AI platform is relatively easy. Building one that can securely process protected health information is something else entirely.
When most teams build their first voice AI prototype, they optimize for speed. Pick an LLM. Connect speech-to-text. Add text-to-speech. Deploy. Within a weekend, you have something that answers phone calls.
The problem is that the stack good enough for a demo is often nowhere near good enough for healthcare.
We realized that early while building Optima Voice. If we wanted to work with hospitals, health insurers, or federal agencies like CMS or the VA, HIPAA couldn’t be an afterthought. It had to influence every architectural decision from day one. Here’s the stack we ended up with, and why.
Why most AI voice stacks aren’t enough
A typical AI voice application today might use:
- OpenAI or Anthropic for the language model
- ElevenLabs for voice synthesis
- OpenRouter for model routing
- A generic cloud provider for everything else
It’s an excellent setup for experimentation. But handling Protected Health Information (PHI) introduces a completely different set of requirements. Once patient information enters the conversation, you need to think about Business Associate Agreements (BAAs), encryption, audit trails, access controls, logging policies, and data retention. The architecture stops being just a technical problem. It becomes a legal and operational one. That’s why we decided to design the platform around HIPAA requirements instead of trying to retrofit compliance later.
The architecture we chose
After evaluating different options, we standardized almost everything on AWS. Keeping the stack inside one cloud provider dramatically simplified security and compliance. Instead of stitching together half a dozen vendors, we could rely on a consistent identity model, encryption strategy, monitoring platform, and access controls.
Core components of the stack and the services behind them.
How a call moves through the system
At a high level, every phone call follows a simple path:
The security decisions behind it are not.
Four decisions that matter more than the AI model
Choosing Claude or Llama isn’t what determines whether your system is enterprise-ready. These decisions matter far more.
1. Don’t store PHI unless you absolutely need to
Every additional copy of patient information becomes another security responsibility. Where possible, transcripts shouldn’t become permanent logs. Audio recordings should be encrypted, access-controlled, and retained only when there’s a legitimate business or regulatory need. The less sensitive data you keep, the lower your risk.
2. Give every service the minimum permissions it needs
Every component should operate under the principle of least privilege. Speech services shouldn’t have database access. LLMs shouldn’t access storage buckets directly. Each service should do one job and nothing more. This reduces both operational mistakes and security exposure.
3. Isolate customer data
Healthcare organizations expect their data to remain completely separated from everyone else’s. Whether that means separate storage prefixes, dedicated databases, or even separate AWS accounts depends on your architecture. What matters is that tenant isolation is built in from the beginning, not added later.
4. Encrypt everything
Encryption shouldn’t be another item on the roadmap. It should exist:
• In transit
• At rest
• In backups
Modern cloud providers make this relatively straightforward, so there’s little reason not to enable it everywhere.
The four HIPAA-driven principles behind the architecture.
What about FedRAMP?
HIPAA is only part of the picture if you’re planning to work with the U.S. federal government. Many agencies also require solutions to operate within FedRAMP-authorized cloud environments. One reason we chose AWS is that the services we rely on are available within AWS’s FedRAMP-authorized infrastructure. That doesn’t automatically make your application FedRAMP compliant. You still need to document your security controls, maintain operational procedures, perform access reviews, monitor your environment, and prepare for independent assessments. The cloud provider secures the infrastructure. You’re still responsible for your application.
Compliance isn’t the expensive part
One misconception surprised me. People often assume HIPAA dramatically increases infrastructure costs. In our experience, that’s not where the cost comes from. Using encrypted storage, IAM, audit logging, and managed AWS services doesn’t significantly change the monthly bill. The real investment is in planning.
Writing security policies. Designing access controls. Documenting procedures. Reviewing architecture. Testing assumptions.
That work takes time, but if you build the system correctly from the beginning, it’s largely a one-time investment. Most teams overestimate the cost of infrastructure and underestimate the cost of documentation.
Why this matters for us
Healthcare-related agencies represent one of the largest segments of federal contact center spending. If your platform can’t process healthcare conversations securely, you’re effectively excluding yourself from a significant portion of that market before you even begin. For us, HIPAA wasn’t another feature on the roadmap. It became one of the design constraints that shaped Optima Voice from day one.
If I were starting today
Knowing what I know now, I’d make four decisions immediately:
1. Choose a cloud provider that supports healthcare workloads.
2. Verify every third-party service before sending PHI through it.
3. Build encryption, identity management, and logging before writing business logic.
4. Treat compliance as part of your architecture, not as a certification you’ll worry about later.
Retrofitting security is almost always harder than designing for it from day one. In healthcare, it’s also far more expensive.
This article reflects the architecture and design decisions we made while building Optima Voice. It is not legal or compliance advice.
Oleksii Kocherev
CEO, Gravity PRO LLC
Building Optima Voice — AI Voice Agents for Business & Government
Originally published on Medium.