AI receptionists for medical offices: HIPAA checks

An AI receptionist can answer the phone when your team cannot: after hours, over lunch, or when three lines ring at once on a Monday morning. Done well, it means fewer callers who give up and book somewhere else. Done badly, it frustrates patients and creates privacy risk. This guide lists what to check before you pick one, whichever vendor you choose.

HIPAA and AI receptionists: the short answer

No AI receptionist is HIPAA compliant by itself. If the service creates, receives, maintains or transmits protected health information for your practice, such as a caller’s name with their reason for the visit, it is generally a business associate under the HIPAA definition in 45 CFR 160.103. Your practice then needs a written business associate agreement before patient information flows through it, and compliance depends on that agreement, the setup and how your team uses it.

Business associate agreement first. 45 CFR 164.502(e) lets a covered entity share protected health information with a business associate only with satisfactory assurance, documented in a written contract, that it will appropriately safeguard the information, and 45 CFR 164.504(e) lists what that contract must say.
Subcontractors count. Under 164.502(e)(1)(ii), a business associate may let a subcontractor handle protected health information only with the same kind of assurances, so ask which speech, AI model and hosting providers touch your calls.
Security safeguards. The HIPAA Security Rule requires covered entities and business associates to protect electronic protected health information with administrative, physical and technical safeguards (45 CFR 164.308, 164.310 and 164.312). Ask how the vendor handles access control, audit logs and encryption for recordings and transcripts.
Minimum necessary. Under 164.502(b), uses and disclosures of protected health information should be limited to the minimum necessary for the purpose. Set the receptionist to collect only what scheduling needs, and keep clinical detail for your team.
Your own setup. Who on your staff can see transcripts, how long recordings are kept and where messages are sent are your decisions, not the vendor’s.

This is general information, not legal advice. Sources cited were checked on October 29, 2026: 45 CFR 160.103 (definition of business associate), 45 CFR 164.502(b) and (e), 45 CFR 164.504(e) and 45 CFR 164.308, 164.310, 164.312 and 164.314 (HIPAA Security Rule). Have a health care attorney review any business associate agreement before you sign it.

Running a dental office? After this checklist, read AI receptionist for a dental office for after-hours pain calls, insurance questions, booking rules and recall.

1. Decide what it should handle, and what it should not

Start with your own call log, or simply ask your front desk what they answer all day. Most practices find a short list of repeat questions: hours, location and parking, which services you offer, whether you take a certain insurance, and how to become a new patient.

Good fits: practice information, new patient requests, appointment requests or booking within clear rules, rescheduling, directions.
Hand to a person: anything clinical, test results, billing disputes, upset callers, and anything the AI is unsure about.
Never: diagnosis, treatment advice, or deciding whether something is an emergency. Callers describing an emergency should be told to hang up and call 911.

If the same voice will also place outbound calls that promote services, different rules apply, covered in our guide to AI voices and avatars in practice ads.

2. Check the hand-off

Ask exactly how a call reaches a human. Can it transfer live during office hours? After hours, does it take a message, send a text or email to an on-call person, or both? Who sees the message, and how fast? Call it yourself and try to reach a person. If that is hard for you, it will be hard for a patient.

3. Check how it books

Some systems only collect a request and your staff confirm it. Others book straight into your practice management system. Either can work. What matters is that it follows your rules: which appointment types it may book, which providers, how far ahead, and what it says when nothing fits.

4. Ask the privacy questions in writing

Once a caller gives their name, date of birth or reason for visit, the call content is very likely protected health information under HIPAA. A vendor that creates, receives, stores or transmits that information for your practice is generally a business associate, and HIPAA requires a Business Associate Agreement (BAA) with them.

Will you sign a BAA with our practice? Ask to see it before you sign anything else.
Which parts of the service does the BAA cover: calls, recordings, transcripts, texts, the AI model provider, analytics?
Where are recordings and transcripts stored, for how long, and who at the vendor can access them?
Can recording be turned off, and can transcripts be deleted on request?
Which subcontractors process the data, and do they have BAAs in place too?

Be careful with the words “HIPAA compliant”. No product is compliant on its own. Compliance depends on the agreement, the configuration and how your practice uses it. Ask what is covered, and get it in writing.

5. Listen to it

Ask for a test number set up with your practice information, and call it the way your patients would: with background noise, an accent, a question it was not trained on, a request to speak to someone. Ask colleagues to try too. You will learn more in ten calls than in any demo.

6. Know what you will measure

Agree up front what success means: fewer missed calls, more new patient requests answered after hours, less time your staff spends on the phone. Make sure you can see every call, the outcome and the transcript, so you can check the quality yourself.

Before an AI receptionist records or summarizes calls, read our call recording consent guide.

How we approach it

Our AI front desk runs on JaneJack.ai, which we build and operate ourselves. We set it up around your practice rules and hand-off preferences, and before any patient information flows through it, we confirm in writing what a BAA covers. If something is not covered, we do not route patient information through it.

Which state laws require telling patients they are talking with AI, and wording for chat, voice and letters, are in our guide to state AI disclosure laws for patient messages.

Sources

More in Phones, front desk and patient messages

HIPAA and AI receptionists for medical offices: what to check before you sign