By Sagar Shankaran, Founder of CallSphere
Information-blocking rules say lab results must reach the patient promptly. HIPAA says only the minimum necessary. AI voice delivery is the workflow most likely to break both — here is how to do it right.
Key takeaways
A patient with a positive HIV test getting an AI voicemail with the result — that is the worst day of two careers. The Cures Act says deliver promptly. HIPAA says minimum necessary. The reconciliation is opt-in tiers and live-clinician handoff for high-acuity results.
flowchart LR
Voice[Voice call] --> Redact[PII / PHI redaction]
Redact --> LLM[LLM with BAA]
LLM --> Resp[Response]
Resp --> Sanitize[Remove non-needed PHI]
Sanitize --> Caller[Caller]
Resp --> AuditDB[(Audit DB)]A lab result lands in the EHR. Routing logic classifies the result by acuity (normal, abnormal-non-urgent, abnormal-urgent, critical), patient-preference channel (portal, voice, SMS, email), and result type (general, sensitive — HIV, STI, pregnancy, mental health, genetic). The AI agent delivers normal and non-urgent abnormal results through the channel the patient pre-selected, with content tiered by sensitivity. Urgent and critical results are routed to a live clinician. Sensitive results require an explicit opt-in before any delivery channel beyond the portal is used.
Done well, the workflow gets results to patients faster than staff callbacks and reduces inbound "where are my results?" calls. Done badly, it leaks an HIV result into a voicemail picked up by a roommate.
Hear it before you finish reading
Talk to a live CallSphere AI voice agent in your browser — 60 seconds, no signup.
The minimum-necessary standard at 45 CFR 164.502(b) governs voicemail and SMS content — but not portal delivery, where the patient has already authenticated. The Cures Act information-blocking rule at 45 CFR 171 requires lab results to flow to the patient without delay, with limited exceptions (preventing harm, privacy, infeasibility). HHS guidance harmonizes the two: deliver promptly through patient-authenticated channels, but use minimum-necessary content on unauthenticated channels.
The 21st Century Cures Act and CLIA at 42 CFR 493.1291(l) require labs to release results to patients on request. Sensitive results — HIV under 42 CFR 2 in some states, mental health under state law, genetic testing under GINA — may have heightened consent or counseling requirements that the AI agent must honor.
CallSphere's Healthcare Voice Agent runs lab delivery through the deliver_result tool — 1 of 14 healthcare tools. Acuity classification is deterministic from the lab feed (LOINC plus reference range plus clinical-criticality flag), not LLM-judged. Sensitive-result detection is also deterministic from a LOINC allow-list. Patient preferences are captured at intake with explicit opt-in for voice and SMS delivery and a separate opt-in for sensitive results. Normal results go through the patient's chosen channel with minimum-necessary content. Abnormal-urgent and critical results never go to AI — they hit a live clinician's task queue with a 30-minute SLA. Sensitive results require live-clinician delivery by default and AI delivery only after explicit consent. Every delivery is captured in post-call analytics with sentiment (–1.0 to +1.0), lead score (0–100), AI summary, and audit trail in the encrypted healthcare_voice PostgreSQL database (1 of 115+ tables). HIPAA and SOC 2 aligned, 37 agents and 90+ tools across 6 verticals. Healthcare detail at /industries/healthcare. Pricing on /pricing; start with 14-day trial.
Can the agent state the actual numeric result on a voicemail? Almost never. Even normal results have minimum-necessary considerations. CallSphere defaults to "your result is ready" with the detail behind authentication.
Still reading? Stop comparing — try CallSphere live.
CallSphere ships complete AI voice agents per industry — 14 tools for healthcare, 10 agents for real estate, 4 specialists for salons. See how it actually handles a call before you book a demo.
Does information blocking force delivery on a particular channel? No. Information blocking requires the result be available to the patient promptly through some channel. Patient choice and clinical judgment govern channel.
What about pediatric and adolescent results? State law governs adolescent confidentiality. Many states protect adolescent STI, mental health, and reproductive health results from parental disclosure. The agent must check state rules and the practice's adolescent-confidentiality policy before delivery.
How do we handle critical results? Always live clinician within 30 minutes. The AI agent may notify staff and confirm reach, but it does not deliver critical results.
What about labs the patient ordered themselves through direct-to-consumer testing? DTC labs are governed by their own consent flow. If the result lands back in the practice EHR, the AI agent treats it like a clinician-ordered result for delivery.
Written by
Sagar Shankaran· Founder, CallSphere
Sagar Shankaran is the founder of CallSphere, where he builds production AI voice and chat agents deployed across healthcare, hospitality, real estate, and home services. He writes about agentic AI, LLM engineering, and shipping voice agents that handle real calls in production.
See how AI voice agents work for your industry. Live demo available -- no signup required.
Using GPT-Realtime-2 for healthcare voice agents. BAA scope, PHI handling, retention, logging, and why a managed platform usually wins this build.
The 2024 NPRM proposes mandatory penetration tests every 12 months and vulnerability scans every 6 months. Here is how an AI voice agent should be tested in 2026.
AWS HealthScribe became the open scribe layer EHR vendors built on top of in 2026. Here's the API surface, the per-encounter pricing, the BAA terms.
Apollo, Manipal, and Narayana scaled AI agents across Bangalore in 2026. Here's the deployments across radiology, intake, and follow-up, the costs.
Notable's AI agents now handle scheduling, intake, and revenue cycle for 6,000+ clinics in 2026. Here's the multi-agent architecture, the per-clinic pricing.
Abridge raised $250M in April 2026 at a $2.7B valuation. We break down the deployment numbers, the EHR integrations across Epic and Cerner. The Q2 2026 buyer briefing.
© 2026 CallSphere LLC. All rights reserved.