Any service that answers your phone will hear patient names, phone numbers and why they're calling. Under HIPAA that makes the vendor a business associate, and you need a signed Business Associate Agreement (BAA) before they handle a single call. This guide explains in plain language what a BAA is, what it commits the vendor to, and the questions worth asking an AI receptionist company. It's general information, not legal advice; your compliance officer or attorney has the final word.
Who this applies to
Dental practices are covered entities under HIPAA. Med spas usually are too, because they provide medical treatments, keep health records and often bill insurance or operate under a medical director. If you're a covered entity, every vendor that creates, receives, stores or transmits protected health information (PHI) on your behalf is a business associate: your answering service, your AI receptionist, your practice-management software, your cloud phone system.
What counts as PHI on a phone call
Any information that identifies a person and relates to their health or care. On a receptionist call that includes:
- Name plus the reason for calling ("chipped tooth," "Botox consult").
- Phone number plus an appointment.
- Insurance details.
- The call recording and the transcript, because they contain all of the above.
So an AI receptionist that records calls, writes transcripts and emails you summaries is handling PHI at every step. That's fine, as long as it's done under a BAA and with reasonable safeguards.
What a BAA actually commits the vendor to
A BAA is a contract required by the HIPAA Privacy and Security Rules. In substance it says the vendor will:
- Use PHI only to do the job you hired them for, not to train generic models, sell data or market to your patients.
- Put safeguards in place: encryption in transit and at rest, access controls, staff training, audit logs.
- Report breaches to you within a defined time so you can meet your own notification duties.
- Flow the same terms down to their subcontractors (the cloud host, the speech provider, the AI model provider) through their own BAAs.
- Give you access to PHI when a patient requests it, and support amendments and accounting of disclosures.
- Return or destroy PHI when the contract ends.
A BAA doesn't make a vendor "HIPAA certified" (there is no such certification). It makes them legally responsible for the safeguards they promise.
Questions to ask an AI receptionist vendor
- Will you sign a BAA before we go live, at no extra cost? Anything other than "yes" ends the conversation.
- Which subprocessors handle our calls, and do you have BAAs with them? Expect a list: telephony, speech-to-text, the language model, hosting, email. If the vendor can't name them, they haven't thought about it.
- Is our call data used to train models? The answer should be no, or opt-in only, in writing.
- Where are recordings and transcripts stored, for how long, and can we set the retention?
- Who at your company can access our call data, and is it logged?
- How do you send us summaries? Email is common and acceptable with safeguards; ask whether it's encrypted in transit and whether you can choose a secure portal or practice chat instead.
- What happens on a breach? Notification timeline, in writing.
- What does the AI say about clinical questions? It should decline and route to your team. That protects patients and you.
- Do you record the caller's consent to the call being recorded? State laws vary; a vendor working across the US should handle this by default.
Red flags
- "We're HIPAA compliant" with no BAA offered.
- A BAA only on the top-tier plan.
- Vagueness about the AI provider underneath.
- Marketing that promises the AI will "triage" or "diagnose."
- No way to delete a patient's data on request.
Your side of the deal
A BAA covers the vendor. You still need to list them in your business-associate inventory, include the service in your risk analysis, train staff on how summaries and transcripts are handled, and make sure your own email and phone setup aren't the weak link. Practically: don't forward AI call summaries to personal email accounts, and give the practice-management login to as few people as possible.
How ClinicEcho handles this: we sign a BAA with every clinic before any patient data is handled, at no extra cost. Call data is used only to run your receptionist, never to train general models. The receptionist says it's an AI, doesn't give medical advice, and routes clinical questions to your team. Marketing tracking on your website never receives patient information.
Hear what your patients would hear
ClinicEcho's AI receptionist is answering a demo dental practice right now. Call it, ask about an appointment, try to book. Then request a free audit and we'll call your own clinic after hours and show you what happens.
Frequently asked questions
Is a phone call with a patient's name PHI?
If it links an identifiable person to health care (an appointment, a treatment, a symptom), yes. A call recording or transcript that says "Maria Lopez wants a consult for Botox on Thursday" is PHI.
Do I need a BAA for a vendor that only takes messages?
If the message can include a name and a reason for calling, the vendor is handling PHI on your behalf, so yes.
What if the AI vendor uses a big cloud or AI provider underneath?
Then they need their own BAA with that provider, and you should ask to confirm it. The chain of BAAs is how responsibility flows.
Can an AI receptionist give medical advice?
It shouldn't, and your agreement should say so. The AI handles practical questions and routes clinical ones to your team. That's a product-design and liability question as much as a HIPAA one.
Sources
- HHS: Business Associates (HIPAA Privacy Rule guidance)
- HHS: Sample Business Associate Agreement provisions