How a business associate agreement works
HIPAA defines a business associate in 45 CFR 160.103, and 45 CFR 164.504(e) sets what the contract must contain, such as permitted uses of the information, safeguards, breach reporting, and returning or destroying data at the end of the relationship.
For a medical, dental, or therapy practice, any tool that hears or stores patient details, including an AI receptionist taking appointment requests with symptoms, is likely a business associate. Without a signed BAA, the practice should keep protected health information out of that tool entirely. A BAA is a contract, not a certification; there is no official “HIPAA certified” label.
Example: a family medicine practice
A family medicine practice wants an AI receptionist to book visits and collect the reason for the appointment. Because callers will describe symptoms, the assistant will handle protected health information, so the practice signs a BAA with the vendor before going live and limits what the assistant collects to what scheduling needs. This scenario is illustrative.
BAAs and InsertChat
InsertChat can sign a business associate agreement on its Enterprise plan, which starts at $998 per month, for healthcare organizations that handle protected health information. On other plans, do not add patient health information to the assistant’s knowledge or workflows.
InsertChat does not claim HIPAA certification. Healthcare setups are covered for medical practices, dental offices, and therapists; compare plans on pricing.
