Is an AI Receptionist HIPAA Compliant?

An AI receptionist is not HIPAA compliant because a vendor says so, and it is not noncompliant because the interface looks modern. No product is compliant by existing. If a practice is covered by HIPAA, compliance is the set of decisions around a specific workflow: the minimum information you collect, what you record, who can read the transcript, where the audio lives, and whether each vendor that touches it is under a business associate agreement.

This page is not legal advice. It does not decide whether your office is a covered entity, and it does not clear a product. It is the list we expect a clinic, a dental office, or a med spa to take to counsel and to the vendor before any patient audio is stored. The phone build itself is AI receptionist for small business. How a call is supposed to run, before privacy is layered on, is in what an AI receptionist does.

Compliant is not a feature you can buy

Sales pages like the phrase "HIPAA compliant AI." The phrase skips the work. A voice tool can store a name, a reason for a visit, a recording, and a text confirmation. Those artifacts might be protected health information in your practice, or they might not. The difference is legal classification plus what the call actually captured. A vendor cannot stamp that for you.

Treat any badge on a website as a prompt to ask questions, not as an answer. Ask which components the badge is supposed to cover: the voice vendor, the transcription vendor, the model provider, the SMS carrier, the cloud storage, and the dashboard your staff log into. A letter about one of those is not a letter about all of them.

We will not put a compliance badge on a CodeHunterz page for this reason. The AI Receptionist plan starts at $600 per month after a 20% launch offer (regular starting price $750 per month), plus setup. A narrow phone workflow is still quoted after the hours and the handoff are known. Limited-time launch offer, final quote after free strategy call. The quote is not a legal opinion. If counsel tells you the workflow should not exist, we do not build it.

Start with whether this call is even in scope

HIPAA applies to covered entities and to their business associates, in the situations the statute and the rules describe. A dental practice that conducts standard electronic transactions, such as billing a health plan, is the sort of organization that usually needs a real analysis. A cash-pay cosmetic studio might sit in a different place. A med spa with a physician, a mix of medical and cosmetic services, and some insurance billing might be covered for some of what it does and not for the rest. Those are counsel's distinctions. They are not distinctions a marketing site should settle with a paragraph.

State law can be stricter than HIPAA on recordings, on consumer health data, or on both. Two-party consent states care about whether everyone on the call knows it is recorded. Your greeting has to match what counsel says about the states you call, not what a default script from another state said.

Write down the workflow in one paragraph before the legal conversation. "After 5 p.m. the assistant books hygiene from public openings, answers plan names from our list, and transfers swelling calls to the on-call phone. It stores a transcript for 30 days that the office manager can read." Counsel can react to that paragraph. Counsel cannot react to "we want an AI receptionist."

Minimum necessary, in practical terms

The minimum necessary standard is a reason to collect less, not a slogan. On a scheduling call, the facts that move the visit forward are usually small.

• The caller's name.
• A callback number.
• Whether they are a new or returning patient, if your desk uses that distinction.
• A visit type from a menu you approved.
• A preferred window, or a real opening if the scheduler exposes one.
• A plan name, if insurance participation is one of the allowed answers, taken from the list the practice maintains.

That set is enough for many front desks to confirm the visit in the morning. It is not a chart.

What the script should stop asking

A model will happily keep interviewing. Turn that instinct off.

• Do not take a medical or dental history on the open line.
• Do not build a medication list or discuss doses.
• Do not collect a Social Security number, a full card number, or a photo of an insurance card by text unless counsel and your current process already do that on a channel you trust.
• Do not ask the caller to narrate symptoms so the assistant can "understand the urgency" beyond the emergency phrases a clinician listed.
• Do not discuss another person's care, including a child's, unless the call follows the identity process your desk already uses.

If a field is only nice to have, leave it for the office, where staff can confirm who is speaking and write into the chart under your current rules. The phone is a noisy channel. People are in cars. Other people are in the room. A transcript of a long clinical story is a record you now have to protect, often for a booking you could have made with four facts.

The dental version of this boundary, including insurance answers and emergency transfers, is AI receptionist for dental offices. The industry page is AI receptionist for dentists.

Recordings and transcripts

Assume the audio and the transcript are sensitive if the call mentions a visit, a condition, or a plan. Then design storage as if that assumption is true, unless counsel tells you a specific call type is outside the rule.

Audio

Know where the file sits, which vendor holds it, and for how long. "In the cloud" is not a location. You want the provider name, the region if they will tell you, the retention setting, and whether you can delete a call when a patient asks or when your policy says to. You also want a straight answer on training: is this audio used to train a model, including a vendor's general model? If the answer is vague, do not turn the line on.

The greeting should disclose recording when counsel says disclosure is required. Use their sentence. Do not add a joke. Callers who do not want to be recorded need a path, which may be a transfer to a person or a callback. Trapping them in a recorded bot after they object is a bad operation even before a lawyer sees it.

Text of the call

Transcripts are easier to copy than audio, which makes them easier to misuse. Decide the retention in days or months, not "until we need space." Decide whether the scheduling note your desk sees is the full transcript or a shorter summary: name, visit type, time requested, transfer yes or no. A shorter note is often enough, and it spreads less information into the inbox.

Text confirmations are part of the same problem. A message that says "you are on the schedule" is narrower than a message that repeats a procedure tied to a diagnosis. Write the confirmation from the visit type you are willing to see on a lock screen. Phone lock screens are not private. Counsel should see the template.

Business associate agreements

A business associate agreement is a contract with a vendor that handles protected health information for a covered entity. It is a question for counsel and for the vendor, not a logo. Ask it for every company in the path.

• The voice platform.
• The company that transcribes.
• The model provider, if call content is sent there and that provider is not already covered by the platform's contract in a way counsel accepts.
• The SMS provider, if texts contain information counsel treats as protected.
• Cloud storage, if recordings land in a bucket you or the vendor control.
• Any agency login, including ours, if that login can open patient audio.

Ask each vendor whether they will sign. Ask which product and which subprocessors the signature covers. A signature on a pilot account that does not cover production is not the signature you need. If counsel says you need the agreement and the vendor will not sign, stop. Pick a different vendor or do not use software for that call.

A signed agreement does not make the workflow compliant. You can have the paper and still collect a history you do not need, leave transcripts open to the whole staff, or keep audio forever. The agreement is one control. Minimum data, access, and retention are others.

We will introduce the question. We will not tell you that you are covered. Put the contracts in the practice's name so you can show them to counsel and to an auditor without asking a vendor for permission to see your own paperwork.

Who can read the transcript

Access is a list of roles, not a shared password.

Inside the practice

The people who schedule usually need the scheduling note. A clinician may need the emergency calls. The owner does not need every hygiene transcript on a personal phone, and a marketing coordinator does not need the reason for a visit. Write the roles down. Remove access when someone leaves. If the dashboard cannot do role-based access, that is a product limit you should see before go-live, not after the first uncomfortable export.

At the vendor

"Support can impersonate your account" is a common line, and it means a stranger can open a call. Ask when that happens, whether it is logged, and whether you can turn it off and grant access ticket by ticket. Ask whether subcontractors listen to calls for quality. If they do, counsel needs to know, and those people belong in the contract conversation.

In an agency or a report

A monthly report for a phone project should be counts: calls answered, bookings, transfers, and scripts you changed. It should not be a packet of patient stories. If a report needs an example of a bad call, redact it or play it on a call with the office manager, and do not paste it into a slide that will be forwarded.

Share the dashboard like you share the practice management system. Named users. No generic login on a sticky note. No forwarding of transcript email to a front desk alias that half the office can open, unless that alias is the process you intended.

Dental offices and med spas are not the same call

Both may want the phone answered. The allowed script is different, and the legal posture may be different. Do not copy a dental prompt into a med spa, or the reverse.

A dental office is usually booking exams and hygiene, answering insurance only from a plan list, recalling patients who already agreed to hear from the office, and transferring emergencies. Clinical talk is refused. The schedule write happens only when the system exposes a real opening. That setup is described in the dental guide linked above. The privacy questions are the same shape: minimum fields, recordings, agreements, access.

A med spa might book consults for services that are actually on the menu, answer price only from a fee sheet the practice is willing to speak, and send medical questions to a clinician. The public marketing around that menu, photos included, is med spa marketing ideas. It should not recommend a dose, promise a result, or decide that a caller is a candidate for a treatment. Contraindications are a clinician's conversation. A phone assistant that says "you should be fine" has started practicing.

Whether that med spa is a covered entity is the classification question from the start of this article. Some are medical practices. Some are cash-pay and cosmetic. Some are both, which means the script may need to treat the call as sensitive even when a lawyer is still sorting the billing side. The industry page for the phone build is AI receptionist for med spas. Use it as a scope for booking and handoff. Use counsel for the classification.

In both settings, refuse the same kinds of improvisation.

• Do not invent a diagnosis from a description.
• Do not tell the caller to stop or start a medication.
• Do not promise an outcome, a scar, a shade, or a recovery time.
• Do not quote a patient-specific insurance benefit.
• Do not book a service the practice does not offer because the caller asked for it by a popular name.

If the caller needs a person, transfer when a person is available. If nobody is available, take the minimum message and say when the office will call. Silence, or a fake clinical answer, is the failure mode.

What not to collect on an open line

An open line means you do not control who else can hear, and you may be recording. Collect the booking facts. Stop there.

Leave these for a channel and a person you already trust.

• Social Security numbers and full dates of birth paired with address and condition.
• Payment card numbers and security codes.
• Detailed histories and medication lists.
• Photos of a face, a tooth, or a lesion sent to a general text inbox.
• Insurance member IDs, unless your coordinator truly needs them before the visit and counsel agrees the phone is an acceptable place to hear them.
• Anything about a family member who is not part of a process you already run at the desk.

Also watch the questions that feel harmless. "Tell me what is going on so I can get you to the right provider" invites a diagnosis-shaped story. A better line is "I can book a visit type from this list, or I can have the office call you." The right provider, when it depends on a clinical read, is a human decision.

Website chat has the same temptation. A widget that asks for symptoms and then suggests a treatment is a bad idea on a health site. A form that requests a visit is enough. If you run both chat and phone, give them the same menu and the same refusals so they do not contradict each other.

What to ask counsel and the vendor

Use this list in a meeting. Write the answers down. Do not accept "we are HIPAA compliant" as a completed row.

1. Are we a covered entity for this line of business, or a business associate for someone else? Are any of these services outside that?
2. Does this call flow create, receive, maintain, or transmit protected health information?
3. What fields are the minimum for the job we described?
4. Which vendors need a business associate agreement, and which subprocessors does each agreement cover?
5. What does state law require us to say about recording, and what do we do if the caller refuses?
6. Where do audio and transcripts live, for how long, and who can delete them?
7. Is call content used to train a model?
8. Which roles inside the practice can read a full transcript, and which roles see only a scheduling note?
9. Can vendor staff open a call, and is that access logged?
10. What does the confirmation text say, and would we be comfortable if it appeared on a locked phone screen?
11. What is the emergency path, who wrote it, and does it avoid clinical advice?
12. What do we keep, and what is deleted, if we turn the system off?

If any answer is "the model will figure it out," the setup is not ready. The model does not know your office, your payers, or your duties. You write the limits. Counsel reviews the limits that touch the law. Then a pilot on a number that is not your public line can show whether the script stays inside them.

Choosing a vendor on operational grounds still matters: calendar truth, refusals, and a handoff a person will answer. Those buying questions are in how to choose an AI receptionist. Privacy does not replace that test. A system can be careful with data and still book a slot that does not exist. Run both checks.