Short answer: what makes an AI receptionist HIPAA compliant
No AI receptionist is HIPAA compliant just because the vendor says so. The US Department of Health and Human Services does not certify or endorse software. Compliance comes from three things: a signed Business Associate Agreement (BAA), security controls that protect patient data, and the way your clinic sets the system up and uses it.
If a vendor will not sign a BAA, stop there. If it will, you still need to check where call recordings go, who can access them, and what the AI is allowed to say to a caller.
On price, published standalone plans for medical practices run from about $149 to $1,495 a month, according to a 2026 comparison from Pabau. That compares with roughly $3,170 a month in base pay for one front desk employee. Your price depends on call volume and whether the system connects to your scheduling software.
Why an AI receptionist touches protected health information
A caller who says "I need to rebook my knee follow-up" has just given your clinic protected health information (PHI). Their name, phone number, appointment type and reason for visit are all covered once they are linked to a patient. Your AI receptionist hears, transcribes and often stores all of it.
That makes the vendor a business associate under HIPAA. A business associate is any outside company that creates, receives, stores or sends PHI for you. The law requires a written agreement with each one before any PHI is shared.
This applies even if the AI only books appointments. It also applies if you only use a "small" feature such as voicemail transcription. If the call audio or transcript includes patient details, the vendor needs a BAA.
The 8 questions to ask before you sign
Put these to every vendor in writing. Vague answers are an answer in themselves.
- Will you sign a BAA before we send any patient data? Ask to read it now, not after payment.
- Does the BAA cover every part of the service? Voice, transcription, the AI model, texting and email. Vendors often use several subcontractors.
- Which subcontractors handle our data? Speech-to-text providers and AI model providers also need to be covered by agreements.
- Where are recordings and transcripts stored, and for how long? You want a retention period you control and the ability to delete.
- Is data encrypted in transit and at rest? Vendors commonly cite TLS 1.2 or higher in transit and AES-256 at rest. Ask them to confirm it for your account.
- Is our call data used to train AI models? For a clinic, the answer should be no.
- Who at your company can access our calls, and is access logged? You need audit logs if a patient ever complains.
- What is your breach notification process and timeline? The BAA should say how fast they tell you and what they provide.
Some vendors also hold a SOC 2 Type II report. That is an independent audit of security practices. It is useful evidence, but it is not the same as HIPAA compliance and does not replace the BAA.
Red flags that should end the conversation
Some warning signs are easy to spot.
- "We're HIPAA certified." There is no official HIPAA certification for software. Ask what they actually mean.
- BAA only on an enterprise plan. If the cheap plan has no BAA, it cannot legally handle patient calls at your clinic.
- Consumer tools repurposed for clinics. A general-purpose AI phone tool or a free chatbot account is not a safe place for patient calls unless a BAA covers that exact product.
- No answer on AI model providers. If they cannot say which company's model hears your calls, they probably do not have the agreements in place.
- Recordings kept forever by default. Long retention increases your exposure if the vendor is ever breached.
Also watch for pricing pages that mention HIPAA on the marketing page but put "BAA" under a custom quote. Smith.ai, for example, is described in one 2026 comparison by Greetmate as requiring bespoke contract arrangements for HIPAA BAAs and medical-specific scripting. That is not a mark against it, but you need to budget time and cost for it.
What the AI should and should not do on a call
Compliance is not only about the vendor's servers. It is also about what the AI says. Your setup decisions matter as much as the contract.
Sensible tasks for an AI receptionist:
- Answer after-hours and overflow calls
- Book, reschedule and cancel appointments
- Share opening hours, location, parking and accepted insurance
- Take messages and route urgent calls to a person
- Send intake forms by text or email
Tasks that need a human or tight limits:
- Anything involving symptoms, medication advice or triage
- Releasing test results or clinical details
- Discussing a patient's record with someone who is not verified
- Emergencies
Set the AI to verify identity before it reveals anything about an appointment, such as full name plus date of birth. Give it a clear rule for emergencies, such as telling the caller to dial 911 and alerting your on-call staff. Make sure a caller can always ask for a person.
This is where AI voice agents and AI receptionists are most useful for clinics. They handle the repetitive scheduling calls, and your staff handle the calls that need judgement.
What a HIPAA compliant AI receptionist costs
Prices vary widely, so compare the same thing across vendors. Here are figures published in 2026 comparisons.
- Pabau reports standalone plans from $149 to $1,495 a month. It lists MedReception.ai at $299 a month self-serve, or $495 to $1,495 for managed plans with 500 to 2,000 included minutes. Overage on those managed plans is $0.95 to $1.25 a minute.
- OhMD estimates AI-only platforms at $200 to $1,500 a month, with hybrid AI-plus-human services at $300 to $1,200.
- DeepCura lists $129 a month per provider, with a signed BAA included.
- Enterprise systems for large health systems start at around $10,000 a month, according to DeepCura's comparison, with implementation taking weeks to months.
Note that several of these figures come from vendors or vendor-run blogs, so treat them as ranges, not quotes. A solo practice with a few hundred calls a month should expect the lower half. A multi-location group with heavy call volume will land higher.
Ask about these extra costs:
- Setup or onboarding fees
- Overage charges per minute or per call
- Charges for connecting to your EHR or booking system
- Extra fees to receive the BAA or to enable HIPAA mode
How to decide if it is worth it
Start with your missed calls. Check your phone system for calls that went to voicemail or were abandoned in the last month, and multiply by your average appointment value. If you are missing 40 calls a month and a quarter would have booked a $150 visit, that is about $1,500 a month in lost revenue.
Then compare against the alternatives. A human answering service may suit you better if most of your calls are sensitive, such as mental health, oncology or reproductive care. A part-time receptionist may be cheaper if your call volume is low and steady.
An AI receptionist is a poor fit when:
- Most calls are clinical questions rather than scheduling
- Your patients are mostly elderly and struggle with automated systems
- Your scheduling software cannot connect to it, so staff would re-enter every booking
- You have no one to review call logs and fix mistakes
If you choose to proceed, run a 30-day pilot on after-hours calls first. Review a sample of transcripts every week, check that identity verification works, and confirm that urgent calls reach a person. Then extend to daytime overflow.
Steps to take this week
- List every system that touches patient calls today: phones, voicemail, answering service, booking software.
- Shortlist two or three vendors that offer a BAA at the plan you would actually buy.
- Send them the eight questions above and keep the answers on file.
- Have your compliance lead or healthcare attorney read the BAA. A contract review is cheap compared with a breach investigation.
- Update your risk assessment and staff training to include the new tool.
Zapplon can help clinics assess call volume and set up an AI receptionist, but the same checklist applies to any vendor, including us.
FAQ
Does an AI receptionist need a BAA?
Yes, if it handles calls that include patient information. Under HIPAA, any vendor that creates, receives, stores or transmits PHI for you is a business associate. You need a signed BAA with them, and they should have agreements with their own subcontractors.
Is there an official HIPAA certified AI receptionist?
No. HHS does not certify products. A vendor can offer a BAA, security controls and independent audits such as SOC 2, but your clinic remains responsible for how the tool is configured and used.
Can an AI receptionist record patient calls?
It can, but recording adds risk. Decide whether you need recordings at all, set a short retention period, restrict who can listen, and tell callers at the start of the call. Some states require consent from everyone on the call, which includes California, so check with your attorney.
This article is general information, not legal advice. Have your compliance lead or healthcare attorney confirm the requirements for your clinic.