Vocal ER — State-of-the-Art Landscape (researched 2026-08-03)

Three parallel research sweeps: (1) realtime voice-AI + voice analysis, (2) HIPAA-ready stack, (3) market, competitors + reimbursement. Compiled from live web research August 2026; source links at the end of each section.

1. Voice AI — the triage nurse & the listening coach

Full detail + all sources: research/voice-ai.md.

Platform options for the phone-call-style triage nurse

Recommended v1 build (cheapest credible)

Next.js route mints ephemeral key → OpenAI Agents SDK RealtimeSession over WebRTC with gpt-realtime-2.1-mini (~$0.02–0.05/min). The triage tree lives in our code as a deterministic state machine; the model's only power is choosing transitions via typed function tools — it never invents questions or exercises. Visual = WebAudio analyser driving an animated blob (no avatar vendor). Deliberately collect zero PHI in v1 (persist only the routing outcome) — that sidesteps the Realtime-audio BAA problem entirely. Want Nina's cloned voice day one → swap to ElevenLabs Agents and accept $0.08/min. If/when HIPAA becomes real → migrate to a cascaded STT→LLM→TTS stack on LiveKit Scale or Pipecat/Daily with a BAA'd STT (only path where every hop is BAA-covered today).

Voice cloning legalities: written signed release from Nina (cloning, commercial use, revocation, deletion). EU AI Act Art. 50 disclosure duty live since Aug 2, 2026 — if the agent speaks in her cloned voice, say it's AI, in-audio and on-screen. NO FAKES Act advancing but not law; state statutes already bite.

Guardrails (layered + code-enforced, not prompt-only)

1. Tool-enforced decision tree (highest-leverage single guardrail)
2. RAG-grounded exercise content from Nina's real material — never model memory
3. Topic allowlist + pre-synthesized refusal audio
4. Hard-coded red-flag list → stop → "see an ENT/SLP" → human handoff with context (voice loss >2 wks, pain on phonation, breathing/swallowing difficulty, hemoptysis, recent neck surgery/intubation, sudden onset)
5. Spoken + on-screen disclaimer gate, acceptance logged
6. Adversarial test suite pre-launch; transcript QA post-call

Off-the-shelf: OpenAI Agents SDK guardrails, NVIDIA NeMo Guardrails, Guardrails AI / LLM Guard. FDA line (guidances updated Jan 6, 2026): wellness tools are fine; software making triage recommendations is SaMD territory — stay wellness-side (no diagnosis/treatment claims; route clinical anything to professionals).

The listening coach — honest feasibility

• Feasible today: F0 mean/range/stability, loudness envelope, CPPS trend (most robust dysphonia measure; AUC ~0.91 in literature), HNR/spectral-tilt as breathiness proxy, speaker-normalized F1/F2 as resonance-placement proxy — all framed vs. the user's own baseline, not absolute clinical scores.
• Research-grade (not yet product): absolute GRBAS-equivalent ratings, strain detection, anything diagnostic. General-purpose audio LLMs are unreliable for fine-grained voice quality.
• Tooling: Praat/Parselmouth, openSMILE eGeMAPS; modern recipe = speech-foundation-model embeddings (Whisper/WavLM) + classic descriptors (the VOQANet+ pattern). Bridge2AI-Voice v3.1 (NIH, May 2026, 833 adults) usable for benchmarking with access controls. Blockers: consumer mics, AGC, lossy codecs. TruVox (free research web app, real-time resonance/pitch biofeedback) is the model for our v1 feedback UI.

Groundwork on Nina's recordings (start immediately)

1. Consent first — her signed release + per-student consent (two-party-consent states)
2. Transcribe + diarize the backlog — AssemblyAI (~$0.15–0.27/audio-hr, BAA available) or self-hosted WhisperX + pyannote for near-zero cost
3. Archive lossless — 48 kHz WAV/FLAC originals; standardize mic + calibration tone going forward
4. Structure the corpus — per-lesson metadata (presenting issue → exercise → cue → outcome), embed into pgvector; this grounds the triage agent AND captures her phrasing for the persona
5. Label — Nina rates a few hundred clips (breathiness/strain/resonance, 0–3); frozen encoder + small regression head = the realistic v1 listener

2. HIPAA — what's actually required & the stack

Full vendor map + all sources: research/hipaa-stack.md.

Reality check

There is no government HIPAA certification — anyone selling a "certificate" is selling paper. Compliance = being in a regulated category (covered entity / business associate) + BAAs up and down the chain + Security Rule safeguards + breach notification. HITRUST/SOC 2 are optional attestations that matter later for payers/procurement (the insurance-reimbursement goal). The 2025 Security Rule update (mandatory MFA, encryption, audit) slipped to ~July 2027 — build to it anyway; it's all cheap on day one.

Is Barry right? Mostly — with a crucial nuance

Genuinely painful to retrofit: tenancy/data isolation, audit logging (history you never captured can't be reconstructed), the access-control model (patient↔provider scoping in every query), encryption/key management + where PHI can flow (logs, analytics, error trackers), and lock-in to vendors that won't sign BAAs. Easy to add later: policies, training, risk assessment, signing BAAs on vendors that already offer them. Translation: we must architect for HIPAA now, but we don't have to pay for HIPAA infrastructure until a clinician is on the platform.

Where the PHI boundary actually is

• Tier 1 consumer (no provider in the loop) is generally NOT HIPAA-regulated — a consumer's self-reported hoarseness or self-uploaded practice video isn't PHI. But it IS consumer health data under the FTC Health Breach Notification Rule (+ state laws like Washington's My Health My Data): no ad pixels/trackers on health screens, minimal triage-transcript retention, honest privacy policy, breach plan.
• The line crosses the moment a clinician manages identifiable patients (rosters, provider-directed uploads, laryngoscopy videos, telehealth sessions, care reminders). Vocal ER then becomes a business associate of each provider — a BAA with every clinic, and BAAs with every subprocessor.
• Design the gray zone deliberately: consumer→clinician sharing goes through a one-way, logged "import into clinical record" gate. Keep the tiers in separate projects/orgs so Tier 1 never inherits PHI obligations.

Concrete stacks + costs

v1 consumer (now): ≈ $75–250/mo. Next.js on Vercel Pro ($20) + a dedicated Supabase Pro project ($25 — NOT the shared ICG multi-tenant instance) + Mux or Cloudflare Stream for the lesson library + Claude API for triage. Architected PHI-ready: RLS everywhere, UUIDs, an audit_log table from day one, zero health data in logs/analytics, every vendor chosen BAA-upgradeable.

Tier 2 PHI (when the first paying clinic signs):

• Minimum-rebuild: Vercel Pro + HIPAA add-on (~$350/mo, self-serve since Sept 2025) · separate Supabase Team + HIPAA add-on (≈$950/mo floor) · Daily.co HIPAA video ($500/mo) · S3+CloudFront under the free AWS BAA for patient/laryngoscopy video · Paubox email (BAA on every plan, even free) · Claude via Bedrock. ≈ $1,850–2,100/mo.
• Cheapest-infra: all-AWS under the free BAA (ECS/RDS/Cognito/S3/Bedrock) + Daily + Paubox. ≈ $700–1,000/mo, more DevOps. Neon Postgres (Scale plan, self-serve BAA, currently no surcharge) is the budget alternative to Supabase-HIPAA.

Vendor rulings that shape design: Mux has no BAA → lesson library only, never patient video. Postmark/Resend → no BAA (Paubox yes). Twilio SMS BAA needs Security Edition → keep PHI out of message bodies regardless ("You have a session tomorrow — log in"). Firebase Auth is NOT under Google's BAA (Identity Platform is). Anthropic signs BAAs for the Claude API; easiest small-team path is Claude on AWS Bedrock under the free self-serve AWS BAA. AssemblyAI offers a BAA for transcription.

Compliance ops for a two-person team

Non-negotiables when Tier 2 starts: written security risk analysis (OCR's free SRA Tool), policies & procedures, documented annual training (both of you), incident/breach plan, BAA inventory, 6-year documentation retention, MFA + encryption + audit logs now. Automation (Sprinto ~$4k/yr cheapest; Vanta ~$7–14k) only when a clinic's security questionnaire shows up. Barry's review checklist: PHI data-flow map vs. signed BAAs · tenancy/RLS on every patient-scoped query · immutable audit coverage (who viewed which video, when) · MFA/session handling · encryption + keys · no PHI in logs/analytics/LLM prompts outside BAA'd endpoints · reminder content · deletion that actually deletes video objects.

3. Market, competitors & the money

Consumer landscape

Vocal Image is the incumbent to beat: ~$12M ARR (Aug 2025), ~50K paid users, 160K MAU, 4M downloads, ~$12.99/mo / ~$79/yr. Its "AI coach" scores pitch/clarity/pace/"confidence" from short recordings and generates daily micro-lesson plans off a 1M+ labeled-clip dataset. Crucially, it positions as communication self-improvement and explicitly disclaims the medical lane ("educational programs… cannot be regarded as a medical treatment tool"). Reviewers note it's "not ideal for people who need medical speech therapy."

Everything else is adjacent, not on top of us:

• Singing technique, no health layer: Vanido (~$2.99/mo), Sing Sharp (freemium, has a "Therapeutic WarmUp" but no clinician) — these set consumer price floors brutally low.
• Measurement utilities: Voice Analyst (~$14.99 one-time) — pitch/volume biofeedback SLPs actually use; a tool, not a program.
• Clinical-grade consumer anchor: Constant Therapy — $29.99/mo / $299.99/yr for speech/cognitive rehab (aphasia/stroke — not voice). Best evidence of what "clinical-grade consumer app" pricing supports.
• Speaking-AI: Yoodli ($8–20/mo, pivoted to sales/interview roleplay); Poised absorbed into Deepgram (2024) — the standalone AI-communication-coach category consolidated.
• 2024–26 vocal-health entrants, all early: Singer Savvy (vocal-dose tracking), VOCA (physician-built, research stage), VoiceFit, Singing Carrots. None at scale.

The gap (real): nobody owns injury recovery / vocal fatigue for working voice users with a named, credible human expert. Vocal Image's content is AI-generated with no accountable clinician-adjacent human — and it disclaims the exact lane Vocal ER wants. "Built by a real voice coach who works with touring singers, with triage toward real clinicians" is unoccupied.

Pricing reality check: consumer comps top out ~$30/mo. "Under $175/mo" works as a sales narrative vs. one SLP session ($100–$250 cash in 2026), not as a mass consumer price. Realistic: $29–49/mo consumer, $99–149/mo human-touch tier (async feedback from Nina) — that's where the "less than one session" framing genuinely lands.

Provider platforms (Tier 2 models to copy)

• Physitrack/PhysiApp — the exact template: ~$22–24/practitioner/mo, free patient app, 6,000+ exercise videos plus providers upload their own, assign programs, track adherence, telehealth built in. This is "PhysiApp for voice."
• Medbridge: from ~$349/yr per clinician (CE + home-exercise programs); org tier ~$169/seat/yr + $1.50 per assigned episode; markets RTM enablement.
• Constant Therapy Clinician: assign-from-their-library (patient pays), not upload-your-own.
• Tactus Therapy: SLP-built apps, $5–75 one-time; Virtual Rehab Center ~$17/mo — proof SLP-authored content commands loyalty at low prices.
• Practice-management incumbents SLPs already pay (complement, don't replace): Theraplatform $39–79/provider/mo (SLP-centric), SimplePractice $49–99/mo, Healthie $19–149/mo.
• Exer AI: FDA-registered Class II software device using phone camera, sold explicitly as an RTM billing enabler for MSK — the regulatory/business blueprint for "mic/camera as monitoring device."

Pattern: provider-brings-patients platforms = $20–80/provider/mo SaaS + free patient app. No voice-specialty platform with provider-uploaded video + patient management exists — voice SLPs cobble together Theraplatform + YouTube/PDFs + Voice Analyst.

Insurance reimbursement path (US, 2026)

• Telepractice: the Consolidated Appropriations Act 2026 resolved the telehealth cliff — SLPs are authorized Medicare telehealth providers through Dec 31, 2027, at parity with in-person; 2020-era covered services now permanently on the telehealth list.
• RTM (Remote Therapeutic Monitoring) — SLPs can bill it (ASHA-confirmed):
  • 98975 initial setup + patient education (once per episode of care)
  • 98977/98978 device supply — requires 16–30 days of data in 30 days; new-for-2026 98984–98986 cover 2–15 days (98986 flagged as the natural SLP home-exercise fit — the old "16-day cliff" is fixed)
  • 98980 first 20 min/mo treatment management ($54), 98981 +20 min ($42), new 98979 for 10–19 min; all require ≥1 real-time interaction that month
  • Hard constraint: the monitoring software must meet the FDA definition of a medical device (SaMD) — Exer AI registered Class II for exactly this reason.
• Design-in-early checklist (so RTM is possible without a rebuild):
  1. Per-patient, per-30-day days-of-use counter + episode-of-care data model
  2. Exercise-completion/adherence telemetry rich enough to be "therapeutic data"
  3. Clinician time-tracking log (cumulative monthly minutes) + in-platform synchronous video auto-logged as the required "interactive communication"
  4. CPT-ready billing/superbill export
  5. Architecture that can survive future FDA SaMD registration (quality system, careful claims)
  6. Keep the consumer tier wellness-framed so the regulated pathway is a deliberate Tier 2/3 move
• RTM prize is modest (~$50–110/patient/mo) — it legitimizes Tier 2; it doesn't fund the company alone.

Conferences (time-sensitive)

• ASHA Convention 2026 — Nov 19–21, Indiana Convention Center, Indianapolis. ~10K+ attendees. Registration opened Aug 3, 2026; early-bird pricing through Aug 31 → Nina should register now. Voice clusters around the former SIG 3 (Voice & Upper Airway Disorders) community/topic track.
• Fall Voice Conference — Sept 24–26, 2026, Hyatt Regency Denver. Laryngologists + voice SLPs + voice teachers in one small room; explicitly multidisciplinary; arguably higher value per conversation than ASHA — and it's before November.
• Voice Foundation Annual Symposium — the premier "care of the professional voice" venue; 2026 edition already ran (May 27–31, Philadelphia); next ~late May 2027.

Positioning take

Sharpest wedge: touring/working singers recovering from vocal injury or chronic fatigue — "the recovery layer between the laryngologist visit and the stage" (the way PTs give athletes return-to-play protocols). AI guidance tells you what's trainable vs. a red flag needing an ENT/SLP.

Top risks:

1. Vocal Image's distribution machine — $12M ARR funds paid acquisition we can't match; if vocal-health keywords convert they can bolt on a program. Defense: named-expert credibility, artist community, provider network — things an AI-content app structurally lacks and currently disclaims.
2. Scope of practice — voice rehabilitation of diagnosed disorders is licensed SLP practice; the "singing voice specialist" role works in collaboration with the medical voice team. Use habilitation/wellness language ("recovery support," "guidance" — never "diagnosis"/"therapy" in the consumer tier), route red flags to clinicians, let the SLP tier legitimize. A "triage" AI can itself drift into regulated medical-device claims if worded carelessly.
3. Two-sided cold start + modest RTM economics — providers won't join without patients and already pay for practice tools. Sequence: consumer wedge first; recruit a handful of marquee voice SLPs/laryngologists as content partners, not customers at Fall Voice/ASHA 2026; design churn around episodes of care (injury resolves → alumni/maintenance tier).

Sources (market)

Full URL list in research/market-reimbursement.md. Highlights: Sacra (Vocal Image), ASHA reimbursement/telehealth/coding pages, speechpathology.org 2026 Medicare coding changes, Physitrack/Medbridge/Theraplatform/SimplePractice/Healthie pricing pages, Fall Voice Conference, Voice Foundation.

4. Added 2026-08-03 (evening): the avatar and the listening coach

Two deeper studies now live alongside this document:

• research/avatar-cloning.md — cloning Nina's voice + likeness. Verdict: ElevenLabs Creator ($22/mo; instant clone same-day, professional clone from 30 min+ of takes, voice-CAPTCHA identity verification; the clone works in TTS and their $0.08/min realtime Agents cascade — OpenAI still has no custom voices). Video: HeyGen Digital Twin ($29/mo) pre-rendered → Tavus CVI ($59/mo, sub-600 ms) interactive. Consent architecture: written release with separate consideration (CA AB 2602 as the model), vendor consent ceremonies are mandatory, EU AI Act Art. 50 disclosure in force. Capture tooling: /demos/avatar-studio.
• research/listening-coach.md + the working plan LISTENING-COACH-PLAN.md — building the model that hears what Nina hears. Verdict: breathiness/severity clearly feasible (published recipes reach ~0.87–0.91 correlation with clinicians on the free PVQD dataset); strain is capped by human agreement itself; resonance placement is genuine R&D that only her data can define. The unlock: predict Nina's rating specifically (rater-conditioned modeling), mine her session transcripts to find labelable moments (never to label), and validate as "agrees with Nina as well as another expert does."

The convergence worth noticing

Ian's own physical therapist's home-exercise app — the product Nina pointed at in the meeting and said "this is what I want to do" — is exactly the Physitrack/PhysiApp category this research independently identified as the Tier 2 template (~$22/provider/mo, free patient app, provider-uploaded video, adherence tracking, RTM-ready). The founding instinct and the market research agree: build "PhysiApp for voice."