Is an AI Receptionist HIPAA Compliant? What Dental Offices and Clinics Should Ask

Patient calls are full of sensitive details. Someone calls to move their root canal. Someone else asks whether their insurance covers a crown. Another patient mentions a medication they're taking before a procedure.

If your practice is a HIPAA covered entity, that kind of information can be protected health information. When a phone system answers those calls, it hears it, and depending on the setup it may record it, transcribe it, summarize it and store it. That's why the rules apply to the tool, not just your front desk.

Think about everything that happens to a single call. The audio travels through a phone provider. An AI model turns the speech into text and decides what to say back. A summary gets written and sent to your team. A booking lands on your calendar. A reminder text might go out the day before. Each of those steps can touch patient information, and each one is a place where it could be stored, shared or exposed.

None of this means you can't use an AI receptionist. It means you need to know where the information goes, who handles it and what they've agreed to in writing. That's the same thinking you'd apply to any other vendor who sees patient records, from your billing company to your scheduling software.

Many dental and medical practices are covered entities under HIPAA, especially those that bill insurance electronically. Some businesses may not be. For example, certain cash-only med spas may fall outside it, depending on how they operate.

Don't guess. Whether HIPAA applies depends on the details of your practice, and it's worth a conversation with your compliance adviser.

Even if HIPAA doesn't apply to you, protect patient information as if it did. Patients don't care which law covers you. They care whether their details stay private. And treating the data carefully from day one is a lot easier than tightening things up after a problem.

Here's the part that surprises a lot of owners: there's no official HIPAA certification for software. The government doesn't hand out a seal of approval for phone systems or AI tools.

So when a vendor's website shows a "HIPAA compliant" badge, that doesn't settle anything. It might mean they've done serious work. It might mean someone made a logo. You can't tell from the badge.

What matters is the written agreement you sign with the vendor, and how the system is actually set up and used day to day. A well-built tool can still be used carelessly. A careful setup with the right agreement is what protects you and your patients.

Some vendors point to security audits or third-party reports. Those can be useful, and it's fair to ask for them. Just know what they are: evidence about how a company runs its security, not a government stamp that says HIPAA is handled. They don't replace the agreement, and they don't replace setting the system up carefully for your practice.

A better question than "are you HIPAA compliant?" is "walk me through what happens to a patient's call, from the moment it rings to the moment the record is deleted." A vendor who's done this before can answer that clearly.

If a vendor handles protected health information for you, HIPAA requires a written business associate agreement, usually called a BAA, before you share that information with them. It spells out how the vendor may use the data, how they'll protect it and what they'll do if something goes wrong.

It doesn't stop with the vendor you hire. An AI receptionist usually relies on other companies behind the scenes, like a phone provider and an AI model provider. The vendor's own subcontractors that touch the data need the same protections in place.

HHS has a plain-language Business Associates FAQ that's worth reading before you talk to vendors.

Read the agreement, don't just file it. Look at how long the vendor keeps data, what they'll do with it when your contract ends, and how fast they'll tell you about a problem. Your compliance adviser can tell you what to look for in your situation.

If a vendor won't sign a BAA, that's your answer. Don't send patient calls through their system.

Put these questions to every vendor, and ask for the answers in writing:

1. 01Will you sign a business associate agreement?
2. 02Which AI and phone providers receive call data, and are they covered by the right agreements too?
3. 03Where are recordings and transcripts stored, and for how long?
4. 04Who can access them, on your side and ours?
5. 05Is the data encrypted, both while it's moving and while it's stored?
6. 06How do you handle a request to delete a patient's data?
7. 07What happens if there's a security incident, and how fast will you tell us?

Also ask how call summaries reach your team. A summary sent to a shared email inbox or a personal phone is a different risk than one that lands in a system your practice controls. Vague answers are a warning sign. A vendor that handles patient data regularly should answer these without scrambling. For the broader questions about demos, support, cost and contracts, see 10 questions to ask before hiring an AI automation agency.

The agreement covers the vendor. The call rules cover what the assistant actually says and does. Decide these with your team and your compliance adviser:

• Verify identity before discussing an existing appointment. Ask for a couple of details that match the patient's record before confirming anything about their visit.
• Collect only what's needed. To book a cleaning, the assistant doesn't need a full medical history.
• Never give medical advice. The assistant can book, reschedule and answer office questions. It shouldn't tell anyone whether a symptom is serious.
• Send clinical questions to staff. If a patient asks about pain after a procedure or a reaction to medication, the call goes to a person.
• Send emergencies to the right place. If a caller describes an emergency, the assistant should tell them to call 911 or go to the nearest emergency room, using wording your practice has approved.
• Keep text reminders free of sensitive details. "You have an appointment Tuesday at 10" is fine. Naming the procedure isn't necessary.

Think about voicemail and callback messages, too. If the assistant leaves a message for a patient, keep it simple: the practice name, a callback number and nothing about why. The person who checks that voicemail might not be the patient.

And plan for the calls that don't fit. A caller asking about a family member's appointment. Someone who says they're calling for their elderly parent. A patient who won't answer the identity questions. Decide in advance what the assistant does in each case, which is usually to take a message and pass it to staff rather than share anything.

Test these rules before launch, the same way you'd train a new front desk hire. Our dental page shows how we set up calls for dental offices.

We only handle protected health information under a business associate agreement, and every client signs a Data Protection Agreement before we touch any data. If you'd like to talk through how that would work for your practice, book a free audit and bring your compliance questions.