If you run a health practice and you are thinking about an AI receptionist, one question comes up fast: is it HIPAA compliant? It is the right question to ask. The honest answer is a little more involved than yes or no. This article walks through the basics in plain words, so you can have a better conversation with any vendor and with your own advisor.
No tool is “HIPAA compliant” on its own
You will see vendors describe their product as HIPAA compliant. Treat that phrase with care. HIPAA does not certify software. Compliance depends on how a tool is set up, how it is used, what agreements are in place, and what your own practice does day to day. A well-built tool can be used in a way that creates risk. A careful setup can reduce it.
So a better question than “is it compliant?” is “can it be set up and used in a way that supports our HIPAA obligations, and what will the vendor commit to in writing?”
Who HIPAA generally applies to
In broad terms, HIPAA applies to what it calls covered entities. That includes many health care providers, such as dental, chiropractic, and physical therapy practices, particularly those that bill insurance electronically. It also applies to their business associates: outside companies that handle protected health information on their behalf.
Some businesses are less clear cut. A cash-pay business, such as some med spas, may or may not be a covered entity depending on how it operates. Other privacy and consumer protection laws may still apply either way. This is exactly the kind of question to confirm with your advisor rather than guess at.
What a business associate agreement is
A business associate agreement, or BAA, is a written contract between your practice and a vendor that will handle protected health information for you. In plain words, the vendor agrees to protect that information, use it only for the work you hired them for, and tell you if something goes wrong, such as a breach.
If a vendor will handle protected health information for a covered practice, a BAA is generally expected. If a vendor will not sign one, that tells you a lot. It usually means they do not intend their product to be used with patient information.
Questions to ask any vendor
Before you buy, ask these questions and get the answers in writing:
- Will you sign a BAA? And does it cover every part of the service we will use?
- Where is call data stored? This includes recordings, transcripts, messages, and any notes the system creates.
- Who can access it? Which of your staff, and which of their staff, can see or listen to it, and is access logged?
- How long is it kept? Can we set how long recordings and transcripts are kept, and can we delete them?
- Can we limit what it collects? Can we turn off recording, or tell the system not to ask for certain details?
- Does the AI model provider see the data? Many AI receptionists use an outside AI model. Ask whether that provider receives call content, whether it is covered by an agreement, and whether the data is used to train models.
- What happens if something goes wrong? How and how fast will they tell you about a security problem?
Design choices that reduce risk
How you set up an AI receptionist matters as much as which one you choose. A few design choices go a long way:
- Collect only what is needed. To book an appointment, the receptionist may only need a name, a phone number, and a preferred time. It does not need a full health history.
- Keep clinical details out of the receptionist. Set it up so it does not ask about symptoms, diagnoses, or treatments. If a caller starts sharing that kind of detail, it can politely say a staff member will follow up.
- Hand off to staff. Medical and clinical questions always go to licensed staff. Insurance specifics and billing go to your team. Urgent calls follow the instructions you set.
- Keep messages general. Reminder and follow-up texts can say “your appointment tomorrow at 10” without naming the reason for the visit.
- Limit access on your side. Only the people who need call records should be able to see them.
When we build an AI receptionist for a practice, we design around these principles from the start. That still does not make any system compliant by itself. It makes it easier for you to meet your obligations.
What stays your responsibility
Even with a careful vendor and a careful setup, some things always stay with your practice. These generally include:
- Knowing whether HIPAA applies to you, and how.
- Your own privacy and security policies, and training your team.
- Deciding who on your staff can access what.
- Keeping your signed agreements on file and up to date.
- Reviewing how the system is actually being used over time.
- Getting qualified advice when you are unsure.
A good vendor or consultant should make this easier and be open about what they do and do not cover. Be wary of anyone who promises that a tool takes care of compliance for you.
How to start
Write down the questions above and bring them to every vendor conversation, including one with us. Before you invest, it also helps to know what is at stake. Our free hidden cost calculator uses your own numbers to estimate what missed calls and slow follow-up may be costing your practice. You can read more about how we work with specialty health practices, and when you are ready, we are glad to talk it through. We meet in person across northwest Houston, and by video call anywhere else.