“Is it HIPAA compliant?” is the first question most practice owners ask about an AI phone agent, and it is the right one. The honest answer is more useful than a yes or no. This guide explains what HIPAA actually requires when an AI answers your phone, what a Business Associate Agreement covers, and what to ask any vendor. It is general information, not legal advice. Talk to your own compliance advisor for decisions about your practice.
Can an AI phone agent be “HIPAA certified”?
No. The US Department of Health and Human Services does not certify products or vendors as HIPAA compliant. When a vendor says “HIPAA certified”, they usually mean they had a third party review their controls, which can be useful, but it is not a government certification. We never use that phrase.
HIPAA compliance is about how information is handled across the whole arrangement: your practice (the covered entity), the vendor (a business associate), and anyone the vendor uses (subcontractors).
When does an AI phone agent handle protected health information?
Almost always. When a patient calls to book, the call usually includes their name, phone number, date of birth and the reason for the visit. Put together, that is protected health information (PHI). Call recordings, transcripts and summaries all contain it too.
So the AI phone agent, and the company running it, is acting as your business associate. That triggers the need for a BAA.
What does a Business Associate Agreement cover?
A BAA is a contract between your practice and a vendor that creates, receives, stores or sends PHI on your behalf. A typical BAA covers:
- Permitted uses. The vendor may only use PHI to provide the service, not for its own purposes such as unrelated marketing or training general-purpose models.
- Safeguards. The vendor must use appropriate administrative, physical and technical safeguards to protect PHI.
- Breach reporting. The vendor must tell you about breaches and security incidents within agreed timeframes.
- Subcontractors. Any subcontractor that handles PHI must agree to the same restrictions, usually through its own BAA.
- Patient rights. The vendor must help you respond to patient requests to access or amend their information.
- Return or destruction. When the contract ends, PHI is returned or destroyed.
Why do subcontractors matter so much for AI?
An AI phone agent is rarely one company. A typical setup includes a phone carrier, a speech-to-text service, a language model, a text-to-speech voice, a database and a messaging service. Each of those may see patient information.
If any one of them is not under a BAA, there is a gap. That is why our commitment is specific: we sign a Business Associate Agreement, every vendor touching patient data is under a BAA, and patient data stays in US-hosted systems.
Ask any vendor for the list of subprocessors that touch PHI, and whether each one is under a BAA.
What else besides the BAA should you check?
A BAA is necessary but not enough. Ask about:
| Question | What a good answer looks like |
|---|---|
| Where is data stored? | Named hosting region; for US practices, US-hosted systems |
| Is data encrypted? | In transit and at rest |
| Who can access recordings and transcripts? | Named roles, logged access |
| How long is data kept? | A retention period you choose, then deleted |
| Is PHI used to train AI models? | No, unless you explicitly agree |
| What happens in a breach? | Defined notification timeline in the BAA |
| Can patients reach a person? | Always |
What about TCPA for calls and texts?
HIPAA governs how patient information is protected. The Telephone Consumer Protection Act (TCPA) governs automated calls and texts, including consent. Appointment reminders and reactivation messages need to respect TCPA rules and each patient’s preferences. A vendor that only talks about HIPAA and not TCPA is missing half the picture. We cover both on our HIPAA and privacy page.
Does the AI give clinical advice?
It should not, and ours does not. Our assistants handle operational tasks: booking, rescheduling, intake questions you approve and practice FAQs. Anything clinical is routed to a person. We also stay out of clinical charting and AI scribes entirely. That limits the kind of PHI involved and keeps clinical decisions with clinicians.
What should your own practice do?
Your practice remains responsible for its own HIPAA program. When adding an AI phone agent:
- Sign a BAA before any patient call reaches it.
- Add it to your risk assessment and list of business associates.
- Decide on call recording and retention, and tell patients where required.
- Approve the scripts, especially escalation rules.
- Train your team on how summaries arrive and who can see them.
- Review access and call samples periodically.
What about Canadian clinics?
HIPAA is a US law. Canadian clinics follow PIPEDA and provincial privacy laws, such as BC and Alberta PIPA and Ontario PHIPA, and CASL for commercial electronic messages. See our Canada page for how we handle that.
If you want to see exactly how this works in practice, read how our AI receptionist is set up, or ask us for our BAA and subprocessor list during a free audit. Specialty groups with sensitive call types can also read about specialty practice workflows.