An AI receptionist is not HIPAA compliant on its own. HIPAA compliance depends on a signed Business Associate Agreement with the vendor, the safeguards the vendor runs, and how your practice configures and uses the tool. InsertChat Enterprise plans can sign a Business Associate Agreement (BAA); on other plans, keep protected health information out of the assistant.
This guide explains when HIPAA applies to an AI receptionist, what the Department of Health and Human Services (HHS) requires, what to check before you sign, and how to configure calls so the receptionist collects only what it needs. It is general information, not legal advice. Review your setup and any BAA with your compliance advisor.
Does HIPAA apply to your AI receptionist?
HIPAA applies when your business is a covered entity, or a business associate of one, and the AI receptionist will handle protected health information. Most medical, dental, chiropractic, therapy, and similar practices are covered entities. Their patient calls almost always contain protected health information.
HHS defines three kinds of covered entities: health plans, health care clearinghouses, and health care providers that transmit health information electronically in connection with transactions HHS has adopted standards for, such as electronic insurance billing. A provider who never conducts those transactions may fall outside HIPAA, though state privacy laws can still apply.
What counts as protected health information on a call?
Protected health information is individually identifiable health information held or transmitted by a covered entity or its business associate. On a phone call, that covers more than a diagnosis. Under the Privacy Rule, the following are typical examples when they relate to a patient of a covered practice:
- A caller’s name and phone number together with an appointment at your practice.
- The reason for a visit, symptoms, or the treatment someone wants.
- Insurance details tied to a named caller.
- A call summary or transcript that identifies a patient and their care.
If the AI receptionist answers patient calls, books visits, or records transcripts, assume it handles protected health information.
Why is an AI receptionist vendor a business associate?
A vendor that creates, receives, maintains, or transmits protected health information on your behalf is a business associate under HIPAA. An AI receptionist that answers patient calls, stores transcripts, and books appointments does all four, so the vendor needs a written agreement with you before patient calls go to it.
HHS guidance on business associates explains that a covered entity may disclose protected health information to a business associate only after obtaining satisfactory assurances, in writing, that the business associate will safeguard it. Since the HITECH Act, business associates are also directly liable for complying with parts of the HIPAA Rules.
Two clarifications from HHS close common loopholes:
- Encryption doesn’t remove the requirement. HHS’s cloud computing guidance says a cloud provider that stores electronic protected health information is a business associate even if it holds only encrypted data and lacks the decryption key.
- The conduit exception is narrow. It covers transmission-only services, like the postal service, with only temporary storage. A service that keeps transcripts or call records has persistent access, so it isn’t a conduit.
What must a Business Associate Agreement include?
HHS lists the required terms in its guidance on business associate contracts. The agreement must describe the permitted uses of protected health information, prohibit other uses, require safeguards, and require the vendor to report incidents and bind its subcontractors.
| Required term | What it means for an AI receptionist |
|---|---|
| Permitted and required uses | The vendor uses call data only to provide the receptionist service and as the contract allows |
| No other use or disclosure | Call data isn’t used or shared beyond the contract or what the law requires |
| Appropriate safeguards | The vendor applies Security Rule safeguards to electronic protected health information |
| Reporting | The vendor reports security incidents and breaches to you |
| Subcontractors | Any subcontractor handling the data, such as hosting or AI model providers, agrees to the same restrictions |
| Individual rights | The vendor helps you provide access to and amendment of patient information where required |
| Termination | Data is returned or destroyed when the contract ends, where feasible |
Ask for the BAA template early, before you configure anything, and have your compliance advisor review it against your practice’s policies.
What else does HIPAA require beyond the BAA?
The BAA is necessary but not sufficient. Your practice still has to run its own HIPAA program: risk analysis, safeguards, minimum necessary use, workforce training, and breach procedures. The AI receptionist becomes one more system those policies cover.
- Security Rule safeguards: the Security Rule requires administrative, physical, and technical safeguards for electronic protected health information, including a risk analysis that should now include the AI receptionist.
- Minimum necessary: the Privacy Rule’s minimum necessary requirement asks covered entities to take reasonable steps to limit uses, disclosures, and requests of protected health information to what the purpose needs. For a receptionist, that means short intake questions.
- Workforce access: decide which teammates can read call transcripts and summaries, and give everyone else a role that doesn’t need them.
- Breach notification: your breach notification procedures should cover incidents the vendor reports to you.
Is “HIPAA certified” a real certification?
No. HHS states in a Security Rule FAQ that it does not endorse or otherwise recognize private organizations’ “certifications” regarding the Security Rule, and that such certifications don’t absolve covered entities of their legal obligations. A badge on a vendor’s website is marketing, not approval.
What matters is the contract and the controls behind it. When a vendor says it is “HIPAA compliant,” ask three follow-up questions: will you sign our BAA, which plan includes it, and which subcontractors handle our data?
What should you ask an AI receptionist vendor?
Ask the same questions of every vendor and get the answers in writing. The checklist below covers the contract, the data, and the controls you will rely on.
| Question | Why it matters |
|---|---|
| Will you sign a BAA, and on which plan? | Without one, patient calls can’t go to the service |
| Which subcontractors process call audio, transcripts, or text? | Each must be bound by the same restrictions |
| Is call data used to train AI models? | Use beyond the contract must be prohibited |
| What is stored, for how long, and can we delete it? | Retention and deletion support your own policies |
| Who on our team can see transcripts? | Role-based access supports minimum necessary |
| How do you report security incidents? | Reporting is a required BAA term |
| What happens to our data if we cancel? | Return or destruction at termination |
| Do appointment reminders or texts include visit details? | Messages sent outside the call are disclosures too |
How does InsertChat handle HIPAA?
InsertChat Enterprise plans can sign a Business Associate Agreement. Enterprise starts at $998 per month and includes 50,000 monthly credits, 100 AI assistants, 25 team seats, and a dedicated support agent. InsertChat does not claim a HIPAA certification, because no official one exists.
On the product side, InsertChat gives you the controls a practice needs to keep calls narrow:
- Knowledge you approve: the AI receptionist answers from the website pages, documents, and questions and answers you add in Knowledge. Keep patient records out of it.
- Short intake: contact collection asks only for details an action or follow-up needs, and answers questions first. Booking collects the service, the caller’s name, and one contact method.
- Handoff rules: the five default rules hand uncertain answers, upset callers, and sensitive actions to your team, and you can add topics such as test results and treatment questions.
- Approvals and roles: actions can run automatically or wait for review, and team roles decide who can approve them.
- Email caution: automatic email replies are off by default, and replies that are uncertain or touch sensitive topics wait for a person.
InsertChat’s privacy policy describes its data practices and security measures. If you need a BAA, contact us about Enterprise, and review the agreement with your compliance advisor before routing patient calls.
How should a practice configure an AI receptionist?
Configure it to run your front desk’s routine work and nothing clinical. Answer practice questions, book within your rules, collect the minimum details, and hand every clinical or sensitive question to your staff.
- Write knowledge about the practice, never about patients. Services, hours, location, parking, new-patient steps, preparation instructions, and insurance plans you accept.
- Limit intake. A booking needs a name, a contact method, the visit type, and a preferred time. It doesn’t need symptoms or history.
- Use neutral appointment names. Calendar events and reminders can show the service name, so use general labels such as “New patient visit” rather than a procedure that reveals a condition.
- Route clinical questions to people. Add handoff topics for symptoms, test results, medication, and treatment advice.
- Write emergency instructions. Safety steps should tell callers with an emergency to call 911 or go to the nearest emergency department.
- Restrict access. Give transcript access to the staff who need it and review roles when people join or leave.
- Test before patients call. Run test calls with made-up details, read the transcripts, and delete the test data.
The healthcare page and the pages for dental, chiropractic, therapy, and med spa practices show illustrative call flows with these boundaries.
What if you’re not on Enterprise?
On Pro, Growth, or Scale, don’t send protected health information to the assistant. For a covered practice, that generally means the AI receptionist shouldn’t answer patient calls, book patient appointments, or keep transcripts about patients.
There are still uses that involve no protected health information. A wellness business that isn’t a covered entity, or a practice using the assistant only on a public website to answer general questions about hours, location, and services, may fit. Draw that line with your compliance advisor, not by guesswork, and move to Enterprise before patient details enter the picture.
What mistakes do practices make most often?
The most common mistakes are trusting a badge instead of a contract, collecting more than the visit needs, and forgetting the messages that leave the call.
- Relying on “HIPAA compliant” claims without a signed BAA in hand.
- Starting before the BAA because the trial was easy to set up.
- Over-collecting: asking callers to describe symptoms when a visit type would do.
- Detailed reminders: sending texts that name a procedure or condition.
- Open access: letting every teammate read every transcript.
- No review: never reading what the AI receptionist actually said to patients.
Talk to us about Enterprise
If your practice is a covered entity and wants an AI receptionist on patient calls, start with the contract. Contact us about an Enterprise plan and a Business Associate Agreement, compare plans on the pricing page, or explore the demo, which uses a fictional business and sample data, to see the workflow first.