HIPAA and AI Receptionists: What Dental and Med Spa Owners Need to Check

A dental practice owner sent me a vendor's website last month with one line highlighted in yellow. "Fully HIPAA compliant." He wanted to know whether that settled it.

It does not. HIPAA compliance for an AI receptionist is not a badge a vendor awards itself. It is a signed contract and a decision about what happens to the recording of a patient explaining why they called.

An AI receptionist taking calls for a covered dental practice is a business associate under HIPAA, not a phone line. That means a signed business associate agreement before the first call, a written list of every subcontractor that touches the audio, and a documented retention policy for recordings and transcripts. A vendor badge replaces none of those.

Check whether HIPAA applies to you at all

HHS is specific about who counts. A health care provider is a covered entity only if it transmits health information electronically in connection with a transaction HHS has adopted a standard for, such as a claim or an eligibility check. HHS sets this out on its covered entities page, and CMS publishes a decision tool that settles it in a few minutes.

Nearly every general dental practice clears that bar. You bill insurance electronically, so you are a covered entity.

Med spas are where owners get it wrong in both directions. A cash-only aesthetics practice that never submits a claim and never touches a standard transaction may fall outside the definition entirely. That does not leave the data unprotected. The rules protecting it come from state privacy statutes, medical record laws, your state board, and often your malpractice carrier, and some of those are stricter than HIPAA.

So run the CMS tool before you run a vendor evaluation. If you are not a covered entity you still need a vendor who handles patient data properly. You just need to stop asking for the wrong paperwork and start asking your attorney which state rules bind you.

What most people get wrong: the conduit myth

I hear this from vendors, usually said with real confidence. We do not store PHI. We only pass the call through. We are a conduit, like the phone company.

HHS closed that argument years ago. The conduit exception is real but narrow to the point of being useless for software. It covers entities that only provide transmission services, including temporary storage: the postal service, certain couriers, their electronic equivalents. Then comes the sentence that ends the debate. Entities that access PHI on a regular or frequent basis to perform a service on behalf of a covered entity are not conduits. That sits on the HHS business associates guidance page, reviewed by OCR on 30 July 2026.

An AI receptionist accesses patient information on every call. It hears someone say they have a cracked molar, matches them to a record, and books them for Thursday. That is a service performed on your behalf, hundreds of times a week.

The same HHS page lists, as an example of a business associate, a third-party vendor AI chatbot on a provider's patient portal handling symptom assessment, reminders, and appointment scheduling. OCR put AI vendors on the list by name, and a voice agent is that function with a microphone instead of a keyboard.

A vendor claiming conduit status has either not read the guidance or is hoping you have not.

Five things to verify before the first patient call

I walk through this with every clinic we onboard. It takes one meeting.

1. Get the BAA signed before go-live, not "available on request" and not bundled into a tier you have not bought. The required elements sit at 45 CFR 164.504(e), and HHS publishes sample provisions you can hold the vendor's draft against.
2. Ask for the subcontractor list. A voice agent is never one company. There is a telephony carrier, a speech-to-text model, a language model, a voice model, a cloud host, usually a scheduling integration. HHS requires a BAA with each subcontractor before PHI reaches it, so ask who has signed. A vendor who cannot name their own stack in an email has not papered it.
3. Pin down what happens to recordings and transcripts. Call audio where a patient describes a symptom is PHI, and so is the transcript. Get three answers in writing: retention period, encryption at rest, and whether any of it trains models.
4. Fix access controls on your side. Who at the vendor can listen to your calls, and who at your practice can? If five people share one dashboard login, your audit trail is worthless the moment you need it.
5. Test the breach notification mechanics. Push past the reporting clause to the operational question: what number do I call, what is the timeline, who contacts me. A clause you cannot act on at 6pm on a Friday protects nobody.

About the Security Rule changes in your inbox

A compliance vendor has probably told you the HIPAA Security Rule is about to change and you need to buy something this week.

Here is where it stands. OCR published a notice of proposed rulemaking on 6 January 2025, the comment period closed that March, and it drew close to 5,000 comments. The proposal is on the HHS site. It would make many currently addressable controls mandatory, including encryption and multi-factor authentication. It remains a proposal, and its target dates have already slipped once.

So the existing Security Rule is still the one you comply with. It is a fair preview of where enforcement is heading, though, so pick the vendor whose encryption and access controls would already survive the stricter version. You will keep this system for three years. Buy for 2028.

What I tell owners who are nervous about this

The compliance risk of an AI receptionist is real and it is fixable with paperwork. The risk nobody writes a memo about sits on the other side of the ledger.

Every clinic we work with shows the same call pattern. New-patient calls cluster at lunch, after 6pm, and on Monday mornings when three lines ring at once and two roll to voicemail. A patient in pain who reaches your voicemail is usually dialing the practice down the road before your greeting finishes. We put the arithmetic on that in our ROI breakdown.

That is revenue leaving quietly, and it never shows up in a compliance audit. Do the paperwork properly, then get the phone answered. Those two goals do not compete.

FAQ

Is an AI receptionist a business associate under HIPAA? For a covered provider, yes. It creates, receives, maintains, or transmits PHI while handling scheduling and intake on your behalf, which is the definition at 45 CFR 160.103. HHS now lists third-party AI vendors as business associate examples.

Do I need a BAA with an AI answering service? If you are a covered entity and the service handles patient information, yes, signed before any PHI flows. Your vendor must also hold BAAs with its own subcontractors, and your notification duty to patients does not transfer to them.

Is a med spa covered by HIPAA? Only if it meets both tests: it provides health care, and it transmits at least one HHS standard electronic transaction such as billing a plan or checking eligibility. A strictly cash-pay med spa doing neither is often not a covered entity, though state privacy law still applies.

Are AI call recordings considered PHI? Yes, when they identify a patient and relate to their health, treatment, or payment. That covers the audio, the transcript, and any summary written into your PMS.

Can my vendor use our call data to train their models? Only if your BAA permits it, so read that clause and ask for a written answer. Training on patient audio without a clear permitted-use basis is a problem you do not want to find during an audit.

Does HIPAA require us to turn call recording off? No. It requires recordings containing PHI to be safeguarded, access-controlled, and covered by your BAA. Several states separately require consent from all parties, so check your state recording law too.

The next step

Pull your CMS covered entity determination. Then send your shortlisted vendors one email with three requests: the BAA, the subcontractor list, and the recording retention and training policy in writing.

A vendor who answers all three within a day is worth a meeting. One who sends a compliance badge instead has told you something useful.

To see how AI Placers handles patient calls, start a 15-day free trial or book a demo and bring the compliance questions with you. Our dental clinic guide covers call handling, and pricing is here.

Sources: HHS covered entities; HHS business associates guidance; HHS sample BAA provisions; HHS Security Rule NPRM; CMS covered entity tool; 45 CFR 160.103.

This article is general information, not legal advice. Confirm your own obligations with a healthcare attorney licensed in your state.