Is an AI Receptionist HIPAA Compliant? What to Check First

An AI receptionist is not HIPAA compliant just because you bought it. What matters is whether the vendor will sign a business associate agreement, and whether your setup keeps patient data within its terms. Vendors publish very different positions, so a sales page can't answer this for you.

This article is general information. It is not legal or medical advice, so have qualified counsel review your own setup. It is part of our AI Front Desk guide, and vendor terms were checked against their own pages on 9 November 2026.

Why an AI receptionist is treated differently from a phone line

Under 45 CFR 160.103, a business associate is a person who creates, receives, maintains or transmits protected health information on a covered entity's behalf. The definition also reaches data transmission providers that need routine access to that information.

An ordinary phone carrier may argue it is a mere conduit. The 2013 HIPAA Omnibus Rule limits that argument. It says: "The conduit exception is a narrow one and is intended to exclude only those entities providing mere courier services, such as the U.S. Postal Service or United Parcel Service and their electronic equivalents, such as internet service providers (ISPs) providing mere data transmission services."

The same rule also says: "In contrast, an entity that maintains protected health information on behalf of a covered entity is a business associate and not a conduit, even if the entity does not actually view the protected health information." That text predates today's voice agents, so ask counsel to apply it to your setup. A tool that keeps recordings, transcripts or summaries of patient calls stores that information, so treat it as more than a phone line.

What the rules require

45 CFR 164.502(e) lets a covered entity allow a business associate to handle protected health information on one condition. The covered entity must obtain satisfactory assurance that the business associate will appropriately safeguard the information.

Those assurances must be documented through a written contract or other written agreement that meets the rule's requirements. This is the business associate agreement, or BAA.

So the first question for any vendor is simple. Will it sign a BAA that covers the exact product and plan you intend to use?

What vendors published on 9 November 2026

These are vendors' own statements, not findings about any product. We did not test them, and these terms can change.

Smith.ai's statement appears on its legal-industry page, in an FAQ. That page also says Smith.ai works with medical, dental and wellness practices for non-PHI call handling.

Some packaged products' pricing pages say nothing about HIPAA at all. Silence is not a yes or a no, so ask each vendor in writing.

Conditions and limits that come with a BAA

A BAA doesn't remove the product's limits. The fine print can change how you are allowed to use it.

Retell. Its docs say: "A signed BAA is required before transmitting PHI through Retell." Retention can be set per agent, from 1 day up to 2 years.

Vapi. Its HIPAA docs describe an organization-wide mode with no per-assistant exception. They say: "You may only pass PHI through the /call endpoint." They also say HIPAA mode and Zero Data Retention are mutually exclusive, and that the mode limits features such as reviewing call logs or transcriptions.

Bland. Its FAQ and table don't read the same way. Ask sales which plan includes a BAA before relying on either one.

Questions to ask any vendor in writing

1. Will you sign a BAA for this product and plan?
2. Does the BAA cover the speech, language model and voice providers you use?
3. Do you use call data to train models, and does the answer change by contract?
4. How long are recordings, transcripts and logs kept, and can I shorten that?
5. Where can patient data appear, and where is it not permitted?
6. Which features stop working when the HIPAA settings are on?

Keep the answers with your compliance records. A verbal yes from a sales rep gives you very little to rely on later.

Set limits on the agent itself

A BAA covers the vendor. It doesn't decide what your agent asks callers.

• Collect the minimum. A scheduling agent may need a name and a time, not symptoms.
• Route emergencies to people. An AI should not triage. Tell callers to hang up and dial 911 in an emergency.
• Keep it out of clinical advice. Send clinical questions to licensed staff.
• Watch your other tools. Texts, calendars, CRMs and analytics can each hold patient data.
• Check your own team. Anyone outside your workforce who can see transcripts, including an agency, may need its own BAA.

Our HIPAA marketing vendor checklist and our guide to forms and scheduling under HIPAA cover those connected tools.

State rules can add more

HIPAA is not the only rule. California's AB 3030 requires a disclaimer when certain health providers use generative AI for patient communications about clinical information. For audio, the statute says: "the disclaimer shall be provided verbally at the start and the end of the interaction."

That law has limits. It excludes administrative matters such as appointment scheduling and billing, and it exempts a communication that a licensed provider reads and reviews.

Other states have their own rules, so ask counsel which ones apply where you operate. If you want help planning the website and intake side of a clinic, talk to us.

Frequently asked questions