The HIPAA rule: a signed business associate agreement first
If your practice is covered by HIPAA, an AI receptionist that creates, receives, keeps or sends patient information for you (call recordings, transcripts, booking details) is your business associate (HHS). Sign a business associate agreement (BAA) before it answers a single patient call. No BAA, no patient calls.
Is your office covered? HHS lists dentists as covered providers:
"...but only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard." (HHS)
Electronic dental claims are one such transaction (CMS). Not sure? HHS has a decision tool on the same page.
What the agreement does, in HHS's words: the covered entity "must have a written business associate contract or other arrangement with the business associate that establishes specifically what the business associate has been engaged to do" (HHS).
"We encrypt everything" doesn't remove the need. On cloud vendors, HHS says business associate status holds "even if the CSP processes or stores only encrypted ePHI and lacks an encryption key for the data" (HHS).
What an AI front desk for a dental office can handle
| Task | AI can do it? | Keep in mind |
|---|---|---|
| Book, confirm, reschedule, cancel | Yes, if it connects to your scheduling software | Check what it writes into the chart and calendar |
| Hours, location, parking, insurance plans accepted | Yes, from answers you approve | Update it when plans change |
| New-patient intake (name, contact, reason for visit) | Yes | Collect only what booking needs |
| Appointment reminders and voicemails | Yes | Keep messages brief (below) |
| After-hours emergencies (swelling, bleeding, trauma) | Route only | Transfer to the on-call dentist |
| Clinical advice, diagnosis, medication questions | No | Staff or the dentist |
| Treatment quotes | Only prices you approve | Exact costs need an exam |
What it may say in a voicemail
HIPAA allows leaving messages, with limits:
"However, to reasonably safeguard the individual's privacy, covered entities should take care to limit the amount of information disclosed on the answering machine." (HHS FAQ)
HHS suggests "leaving only its name and number and other information necessary to confirm an appointment, or ask the individual to call back" (HHS FAQ). Set the AI's voicemail and text scripts to that: practice name, appointment time, callback number. No procedure names.
Best AI receptionist for a dental office: questions to ask
The best one for you is the one that passes these checks.
- Will you sign our BAA, or give us yours? If not, stop.
- Which other companies touch our calls? The AI model, speech-to-text and hosting providers count. HHS: "A business associate also is any subcontractor that creates, receives, maintains, or transmits PHI on behalf of another business associate" (HHS). Ask whether each has a BAA with the vendor.
- Do you use our calls to train your models? The BAA should say what the vendor may do with patient information. Get the answer in writing.
- Where are recordings stored, for how long, and how do we delete them?
- Does it read and write our practice management software, or just send us messages?
- How does it hand off emergencies after hours, and to whom?
- Does it announce call recording? See recording consent by state.
AI receptionists and chatbots at a clinic
The same rule covers a chatbot on your website. A chat tool that collects symptoms or booking details for you handles patient information on your behalf, so it needs a BAA too. Tracking pixels on those pages raise separate HIPAA issues: Meta pixel and Google tags on a clinic website.
Canada
HIPAA doesn't apply. Your province's health privacy law, its private-sector privacy law (Alberta, British Columbia, Quebec), or PIPEDA does. Ontario, New Brunswick, Newfoundland and Labrador, and Nova Scotia have health privacy laws declared substantially similar to PIPEDA (OPC). The vendor rule is similar in spirit to a BAA:
"The organization shall use contractual or other means to provide a comparable level of protection while the information is being processed by a third party." (PIPEDA, Schedule 1, 4.1.3)
The privacy commissioner's guidance: tell callers the call is recorded and why (OPC). Check your provincial regulator's rules for where patient data may be stored.
Example
Two-dentist office in Texas
The vendor demo is great, but its terms say it won't sign a BAA. The office bills insurance electronically, so it's covered by HIPAA. It picks a vendor that signs one.
Saturday night call
A patient calls about facial swelling. The AI recognizes the words from its emergency list, gives no advice, and transfers to the on-call dentist's cell. Monday's routine calls it books itself.
Toronto clinic
The clinic signs a contract that limits the vendor to booking and messages and requires deletion on request. Every call opens with: "This call is answered by an AI assistant and recorded to book your visit."
Different for you?
- You're not in healthcare, or want costs and recording rules by state: AI receptionist for a small business.
- You run ads or tracking on a clinic site: Meta pixel and Google tags on a clinic website.
- You want to text patients who called and got no answer: Missed-call text back.
- You run a med spa: Med spa ads rules.
- You want to know what missed calls cost: Missed calls: what they cost.