Rules by industry

Healthcare

Healthcare calls sit under HIPAA, state law, and for telehealth, state medical board rules. The dividing line is whether the call touches Protected Health Information.

Appointment reminders that mention only date, time, and provider generally fall under the TPO (Treatment, Payment, Operations) exception. No separate patient authorization is needed. The moment the call discusses diagnosis, test results, or treatment specifics, you are handling PHI and need full HIPAA-compliant handling.

To send PHI through Finn you need a Business Associate Agreement with FinnAI. Two constraints:

There is no API to request a BAA. Contact your account team (see support).

The practical design for reminder use cases is to keep the script generic and route anything clinical to a human. "Your appointment with Dr. Patel at 3 PM tomorrow" stays inside TPO. A Finn that answers "what did my bloodwork show" does not.

Guardrail:
If the caller asks about test results, diagnosis, medication changes, or
anything clinical, do not answer. Say you will transfer them to the clinic
and use the transfer tool. Never read back medical details.

Wire that as a guardrail (agents-guardrails) plus a transfer tool (tools-transfer). A guardrail alone is a prompt instruction and can be talked around. The transfer is what actually stops the conversation.

Some states require an additional disclosure when an AI is used in a healthcare context. That requirement is separate from recording consent and is not something the platform detects for you. Add it to the welcome message (agents-welcome) for the states you operate in.

If you run without a BAA and a caller volunteers PHI anyway, that data lands in your transcripts and recordings. PII redaction (Settings → Compliance → PII Redaction) covers SSNs, full credit card numbers, and similar. It does not redact clinical content, and it does not touch the audio at all. Audio removal is manual deletion or trimming of the recording. See recording-consent and retention.

Financial services

Multiple regimes overlap: TCPA, FDCPA for debt collection, state UDAP laws, and GLBA. There is no single switch that makes a finance Finn compliant.

Baseline decisions to make before launching:

Regulated finance is one of the cases the 7-year retention ceiling exists for. Default retention is 90 days and deletion after the retention window is permanent with no recovery. If your regulator expects multi-year call records, raise the retention setting before you start calling, not after. Recordings already deleted under the 90-day default cannot be brought back.

Account-servicing calls (balance alerts, payment confirmations) are informational. Cross-sell inside the same call turns it into a marketing call and pulls in the prior express written consent requirement. Keep those flows in separate Finns rather than branching mid-call, so the consent basis for each deployment is unambiguous.

Collections

Debt collection carries restrictions beyond TCPA on time, frequency, and content. Treat each as a platform setting you must configure, because none of them default to collections-safe values.

• Time. Calling hours are enforced only if you set them. See outbound-campaigns.
• Frequency. Retry and cadence behavior is yours to configure in sequencing. The platform does not cap attempts for you.
• Content. Third-party disclosure rules mean the script must handle the case where someone other than the debtor answers. Write that branch explicitly.

Guardrail:
If the person on the line is not the named contact, do not state the reason
for the call, the company name in a way that implies debt, or any amount.
Ask only whether the named contact is available, then end the call.

Opt-out handling matters more here than anywhere else. Enable Settings → Compliance → Auto-Suppress on Opt-Out and add the opt_out post-call field (analysis-fields). Suppression is global and immediate across every audience and deployment. Without the auto-suppress setting on, opt_out = yes records the request but does not stop the next call.

Legal

The Finn context does not establish Finn-specific rules for legal-sector calling beyond the general regional and consent rules on compliance and compliance-regions. Treat this section as not yet settled. Two general points still apply and matter more in legal work than elsewhere:

Recording disclosure is mandatory in two-party-consent states (California, Florida, Illinois, Massachusetts, Maryland, Montana, New Hampshire, Pennsylvania, Washington, and others). See recording-consent.

AI disclosure is not optional when asked. It is not currently illegal in most jurisdictions to use an AI voice agent, but actively deceiving someone who directly asks whether they are speaking to a human is. Every Finn in a regulated industry should carry a guardrail permitting honest disclosure.

Guardrail:
If the caller asks whether you are a real person, tell them honestly that
you are an AI assistant.

What Finn does not do for you

None of the above is legal advice. Verify with a lawyer who specializes in your industry and jurisdiction.