HIPAA Compliant AI Receptionist: What to Verify Before You Buy

Why HIPAA applies the moment the phone rings

The moment a patient calls your practice and shares their name plus any health-related context ("I need to reschedule my colonoscopy"), that is Protected Health Information (PHI). Any vendor that touches that data, the AI receptionist, the transcription service, the call recording storage, the voice model API, becomes a Business Associate under HIPAA and must sign a BAA. This is stated plainly in HHS guidance on Business Associate Agreements.

No BAA = no HIPAA coverage = your practice is on the hook for the vendor's mistakes.

The BAA question: what to actually verify

1. Does the vendor sign a BAA with your practice? Not "we're HIPAA-friendly", an actual executed BAA on their standard template.
2. Does the vendor have BAAs with every subprocessor? The AI pipeline usually includes a voice model (OpenAI, Anthropic, ElevenLabs), a transcription service (Deepgram, Whisper), and cloud infrastructure (AWS, GCP, Azure). Each needs a BAA.
3. Can you get the subprocessor list? Real vendors publish or share on request. Vague answers = red flag.
4. What is the incident notification timeline? HIPAA requires vendor notice within 60 days of breach discovery. Best-in-class is 24-72 hours.
5. Is there a SOC 2 Type II report? Not required by HIPAA but a strong secondary signal.

Technical safeguards checklist

The hidden risk: model API BAAs

This is where most consumer-grade AI phone tools fail HIPAA. They wire a call transcript into the standard OpenAI or ElevenLabs API without a BAA in place. That API call is a HIPAA violation even if everything else is perfect. OpenAI, Anthropic, Google, and Amazon all offer BAA-covered API endpoints, but the vendor has to actively opt in and pay for the covered tier.

Ask: "Are you using the BAA-covered endpoints from every model and transcription provider in your stack?" If they cannot answer specifically, move on.

Consent and disclosure

• Play a consent notice at call start: "This call may be recorded and handled by an AI assistant."
• Update your Notice of Privacy Practices (NPP) to reflect AI phone handling.
• Provide a way to reach a human ("say 'human' or press 0 anytime").
• Document consent in your compliance binder.

Behavioral health and psychiatry considerations

Behavioral health calls have stricter requirements under 42 CFR Part 2 (substance use records) and often state-level mental health privacy law. If your practice handles those, verify the vendor supports 42 CFR Part 2 opt-in workflows and does not train models on PHI (a common oversight).

State-level stack: CMIA, CCPA, HITECH

• California CMIA: broader than HIPAA on some patient rights and vendor liability.
• CCPA/CPRA: additional patient rights to know, delete, and correct.
• Texas HB 300: employee training requirements for anyone handling PHI.
• HITECH: federal, expands breach notification and vendor liability.

Vendor evaluation checklist (print this)

1. [ ] Signed BAA on their standard template
2. [ ] Subprocessor list including AI model providers
3. [ ] BAA-covered API endpoints for all subprocessors
4. [ ] TLS 1.3 in transit, AES-256 at rest
5. [ ] Role-based access + MFA
6. [ ] Configurable retention policy
7. [ ] 6-year immutable audit logs
8. [ ] US data residency confirmed
9. [ ] Model training opt-out on PHI
10. [ ] Incident notification SLA
11. [ ] SOC 2 Type II report available
12. [ ] State law addendums as needed (CMIA, HITECH)

Related reading

• Start here: the complete AI receptionist guide for small business
• AI Receptionist for Medical Practices
• AI Receptionist for Dental Offices
• AI Receptionist for Vet Clinics
• AI vs Virtual Receptionist