Configurable Compliance

Customizable Conversation Rules

Every practice has its own policies about what information can be shared over the phone, which topics require human escalation, and how certain patient requests should be handled. VIGMA doesn't impose generic conversation rules — it lets you define them.

Practice-Controlled Conversation Configuration

Define what VIGMA can and cannot say. Configure approved responses, prohibited topics, and conditional logic for different caller scenarios.
Configurable escalation triggers. Set rules for when VIGMA should transfer to a human: certain keywords, specific request types, patient distress indicators, or ambiguous situations.
Specialty-specific conversation flows. A pediatric practice and a surgical clinic don't handle calls the same way. VIGMA adapts to your workflow, not the other way around.
Prohibited topic handling. Explicitly define topics VIGMA should never address (e.g., detailed medical advice, dosage adjustments, diagnostic interpretation) and automatically escalate instead.
Tone and formality controls. Adjust VIGMA's communication style to match your practice's culture — from warm and conversational to formal and clinical.

Compliance isn't about what the AI can do — it's about what your practice allows it to do.

VIGMA gives you control over the boundaries, so you can configure the system to align with your risk tolerance, patient population, and regulatory environment.

Call Recording Consent

Call recording laws vary significantly by state. Some states require only one party to consent (the practice). Others require all parties (the caller must be informed). VIGMA provides configurable consent handling to support compliance with the laws applicable to your practice.

State-by-State Consent Configuration

Automatic consent disclosures. When call recording is enabled, VIGMA can automatically inform callers at the beginning of the call that the conversation may be recorded.
One-party consent states. In states like Indiana, where only one party (the practice) must consent to recording, disclosures can be configured as optional courtesy notifications rather than legal requirements.
Two-party consent states. In states that require all-party consent (e.g., California, Florida), VIGMA can be configured to provide explicit consent disclosures and offer opt-out mechanisms.
Opt-out handling. If a caller declines to be recorded, VIGMA can continue the conversation without recording or transfer to a non-recorded line, depending on your practice's policy.
Consent logging. Every consent interaction (disclosure provided, caller response, recording status) is logged for compliance documentation.

Recording consent isn't a checkbox — it's a legal requirement that varies by jurisdiction. VIGMA's configuration options let you comply with the specific laws that apply to your practice location and caller base.

Escalation Controls

AI should handle routine calls efficiently — but it should also know when to get out of the way. VIGMA's escalation system gives practices granular control over when and how calls are transferred to human staff.

Configurable Transfer Triggers

Emergency keywords. Words or phrases that indicate a medical emergency (chest pain, difficulty breathing, severe bleeding) trigger immediate transfer to staff or emergency protocols.
Patient distress detection. If a caller appears confused, upset, or frustrated, VIGMA can be configured to escalate rather than continue the automated interaction.
Complex medical questions. Questions about diagnoses, test results, medication interactions, or symptoms can be flagged for automatic transfer to clinical staff.
Configurable trigger phrases. Define your own escalation keywords based on your practice's policies: "speak to a nurse," "I need help now," "this is urgent," or specialty-specific terms.
Fallback escalation. If VIGMA is uncertain about how to respond or the conversation exceeds a configured complexity threshold, it defaults to transferring to a human.

The goal isn't to replace your staff — it's to free them from routine calls so they can focus on situations that genuinely require human judgment.

Audit Trails

Compliance reviews, incident investigations, and quality assurance all require one thing: a complete, tamper-proof record of what happened. VIGMA provides comprehensive audit logs for every patient interaction and system event.

Complete Interaction Logging

Every call handled by VIGMA generates a structured audit record that includes:

Timestamp. Precise date and time of call initiation, duration, and completion.
Caller identification. Caller ID, phone number (if available), and any patient identifiers confirmed during the call.
Call outcome. Whether the call was resolved by VIGMA, transferred to staff, escalated for emergency, or resulted in a voicemail.
Actions taken. Appointment scheduled, callback requested, information provided, prescription refill noted, etc.
Data accessed. If VIGMA accessed patient records, appointment calendars, or other systems, those access events are logged.
Escalation triggers. If the call was transferred, the reason (keyword detected, patient request, system uncertainty) is recorded.

Audit logs are exportable in standard formats (CSV, JSON) for compliance reviews, external audits, or integration with practice management systems. Logs are retained according to your configured data retention policy and cannot be modified or deleted by end users — only by authorized administrators with appropriate justification.

Data Retention Policies

How long should call recordings be kept? What about transcripts? Summaries? Metadata? The answer depends on your specialty, state regulations, and internal policies. VIGMA lets practices configure retention windows for each data type independently.

Practice-Controlled Retention Windows

Configurable per data type. Set different retention periods for call recordings (90 days), call transcripts (1 year), call summaries (3 years), and metadata (7 years) based on your compliance requirements.
Automatic deletion schedules. When data reaches the end of its retention window, it is permanently deleted — not archived, not moved to cold storage. Gone.
Selective retention. Choose to retain only certain types of data. For example, keep call summaries for operational purposes but automatically delete full recordings after 30 days.
Legal hold support. When required by litigation or regulatory investigation, specific data can be placed on legal hold to prevent automatic deletion until the hold is released.
Compliance templates. VIGMA provides suggested retention schedules based on common healthcare compliance frameworks (HIPAA minimum necessary, state medical record retention laws).

Data retention isn't just about keeping data long enough — it's also about not keeping it longer than necessary.

Minimizing data retention reduces your practice's exposure in the event of a breach, audit, or legal discovery request.

Regulatory Adaptability

Healthcare regulations are not static. New telehealth laws, evolving AI governance frameworks, and changing state-level requirements mean that compliance is a moving target. VIGMA is designed to adapt to regulatory changes without requiring you to replace the system.

Built for Evolving Regulations

TCPA compliance for outbound calls. If your practice uses VIGMA for outbound appointment reminders or follow-ups, the system supports opt-in consent management, do-not-call lists, and calling time restrictions required by the Telephone Consumer Protection Act.
State telehealth regulations. VIGMA's conversation rules can be configured to comply with state-specific telehealth consent, patient identification, and documentation requirements.
ADA accessibility considerations. Voice AI must be accessible to patients with hearing impairments or speech disabilities. VIGMA supports TTY/TDD relay services and can be configured to offer alternative communication channels.
Evolving AI regulation readiness. As federal and state AI regulations emerge, VIGMA's transparency features (audit logs, explainable escalation logic, human oversight controls) are designed to support compliance with anticipated governance frameworks.
Configuration updates without downtime. Compliance rule changes can be deployed through configuration updates — no software reinstalls, no service interruptions, no re-training staff.

Compliance isn't a one-time checkbox. It's an ongoing process of adapting to new rules, monitoring for violations, and updating policies as regulations evolve. VIGMA gives you the tools to stay compliant without rebuilding your phone system every time a law changes.