What makes an AI receptionist HIPAA-compliant?

An AI receptionist is HIPAA-compliant when the vendor signs a Business Associate Agreement and applies the HIPAA Security Rule safeguards to every call it handles. The BAA is the legal instrument. Encryption, access controls, audit logging and a documented retention policy are the technical proof behind it. Everything else is marketing.

That distinction matters because the second an AI answers a patient line, it hears protected health information. A caller who gives a name, a reason for the visit and an insurance carrier has disclosed PHI three times before your agent finishes its greeting.

What HIPAA actually requires of an AI receptionist

Under HIPAA, any vendor that handles PHI on a covered entity’s behalf is a business associate. An AI receptionist answering patient calls meets that definition from the first sentence of the first call, which places it squarely inside the rule rather than adjacent to it.

Being a business associate triggers two obligations. The vendor must execute a BAA with the practice, and it must implement the administrative, physical and technical safeguards in the Security Rule for the ePHI it touches.

There is no such thing as HIPAA certification. A vendor is compliant or it is not, and it demonstrates that with a signed BAA, documented policies, a risk analysis and evidence that the safeguards run.

Why the BAA comes before everything else

The BAA is the only item on the list that transfers legal accountability. Without it, the practice carries the entire exposure for what the AI hears, regardless of how well engineered the platform is.

Ask for the template before the demo rather than after. A vendor that produces it in a day has been through healthcare procurement before, and one that stalls has told you something useful about how ready it really is.

Read the exclusions as carefully as the commitments. Breach notification timelines, subcontractor flow-down and whether your PHI can be used to train or fine-tune models are the three clauses that decide what the agreement is actually worth.

What happens to patient information during the call

Every call produces more artefacts than people expect. There is the live audio, the recording, the transcript, the AI-generated summary, and whatever gets written back into the practice management system, and each of those is PHI in its own right.

Encryption has to cover all of it, in transit and at rest, not just the phone leg. Access controls decide who inside the vendor can open a transcript, and audit logging is what lets you answer the question of who read what and when if a regulator ever asks.

Retention is the piece most buyers forget. Ask how long recordings and transcripts persist, whether deletion is contractually guaranteed, and what happens to the data if you leave.

Disclosure, recording and consent rules vary by state

HIPAA is the federal floor. On top of it sit state rules on whether callers must be told they are speaking to an AI, and separate state rules on who has to consent before a call is recorded.

Those two questions have different answers in different jurisdictions, and both are moving. Any serious platform lets you configure the agent’s opening disclosure and its consent prompt per location rather than shipping one script nationwide.

Confirm your own state’s position with counsel rather than a vendor sales page. The practice, not the vendor, is the covered entity that regulators contact first.

How a compliant AI receptionist differs from a chatbot

The difference is legal accountability, not capability. A general-purpose assistant can sound entirely competent on a patient call and still have no BAA, no audit trail and no obligation to tell anyone when something goes wrong.

Traditional answering services sit in an awkward middle. They take a message and pass it on, but many were never scoped as business associates handling ePHI at volume with searchable transcripts attached.

If you are evaluating the wider category rather than healthcare specifically, the general market of AI chatbot development companies is a useful comparison point, because almost none of those products are built to sit on a medical phone line.

What five AI receptionists publish about HIPAA

The table below records what each vendor states on its own website, not what it might be able to provide on request. A blank is not an accusation. It means the claim was not published where a buyer would look for it, which is exactly the gap worth raising in a procurement call.

Vendor	HIPAA claim on own site	SOC 2 stated	BAA stated	Best fit
Central AI	Yes, built with HIPAA compliance at its core	Not stated	Not stated	Small and single site practices
Assort Health	Yes, HIPAA compliant	Yes, SOC 2 Type II	Not stated	Multi site specialty groups
Hello Patient	Yes, HIPAA-compliant	Yes, SOC 2 Type 2	Yes, on every account	Practices wanting compliance detail upfront
Hyro	Compliance named as a design pillar	Not stated	Not stated	Health systems and payers
Arini	Not stated	Not stated	Not stated	Dental practices and DSOs

Central AI

Central AI states on its healthcare page that the platform is built with HIPAA compliance at its core, that all patient communications are encrypted, and that it maintains strict access controls and secure hosting to protect PHI. Every call is logged with secure summaries, and the company says it follows US Department of Health and Human Services guidelines.

Operationally it is the most accessible option here for a practice that is not an enterprise. Central AI answers calls 24/7, books and reschedules appointments, triages by urgency and routes urgent matters to on-call staff outside business hours, and it integrates with major EMR and EHR systems so records update without double entry, though no specific system is named. When a call needs clinical judgement, it transfers to your available staff with the full conversation context attached, so the patient does not repeat themselves.

Pricing starts at $89 per month for 90 calls with a 10 day free trial, and the agent supports over 30 languages. Ask for the BAA and any current security report in writing, because neither is published on the pages reviewed.

Assort Health

Assort Health is explicit on both counts a health system procurement team checks first. Its health systems page states that Assort is HIPAA compliant and designed to handle protected health information securely across patient access workflows, and that it is SOC 2 Type II certified, independently verified for the design and effectiveness of its security controls.

It also points buyers to a Trust Center for additional documentation, which is the right pattern. Publishing the claim and then providing somewhere to verify it is meaningfully different from publishing the claim alone.

Deployment is scoped in weeks after EHR access and test environment permissioning, with protocols auto-built and then tailored to the practice’s workflows.

Hello Patient

Hello Patient publishes the most complete compliance position of the five. It states that it is HIPAA-compliant, SOC 2 Type 2 certified, signs a BAA with every client, logs every interaction, and that its agent never gives medical advice.

The disclosure handling is unusually specific. The agent can be configured either to introduce itself as the practice’s AI or not to say so, set to match the rule where the practice operates, and the company states it never pretends to be a person or borrows a staff member’s name.

Consent prompts are set to the applicable state rule, and the agent connects to systems including ModMed, athenahealth and eClinicalWorks.

Hyro

Hyro is built for health systems rather than individual practices, with agents running across call centres, websites, SMS and mobile apps. The company states its agents resolve over 85 percent of repetitive tasks.

Its compliance framing is governance-led. Hyro publishes three pillars for patient-facing deployment: explainability, meaning visibility into the logic behind an output, control, meaning the data sources feeding responses are defined and limited, and compliance, meaning adherence to patient and data security regulations.

That is a stronger statement about hallucination risk than most vendors make, and a weaker one about paperwork. Neither a HIPAA claim nor a certification appears on the pages reviewed, so request both.

Arini

Arini is the narrowest option here and the only one built for a single specialty. It answers calls and manages appointments 24/7 for dental practices, and states it is trusted by hundreds of DSOs, dental groups and solo practices across the US and Canada.

Beyond inbound calls it runs outbound reactivation campaigns for inactive patients and automated appointment confirmations. Agents integrate with existing practice systems and the company says they can be deployed in days.

Dental practices are covered entities like any other, so the compliance questions do not soften. Nothing about HIPAA, a BAA or a security certification appears on the pages reviewed, which makes those the first three items for a procurement call.

What to ask before you sign

Four requests separate a serious vendor from a confident one. Ask for the BAA template, a current SOC 2 report or equivalent under NDA, a written statement that your PHI will not be used to train or fine-tune models, and the retention and deletion policy for recordings and transcripts.

Then ask an operational question that most compliance checklists miss. Find out what happens to an escalated call at two in the morning, because an agent that hands off to a human only when one is available behaves very differently at 2am than it does at 2pm.

If a vendor cannot answer those five things, the answer to your original question is no.

Frequently asked questions

Is an AI receptionist HIPAA-compliant?

Only if the vendor signs a BAA and applies the HIPAA Security Rule safeguards to the calls, recordings, transcripts and summaries it handles. A compliance badge on a website is a claim, not evidence. Ask for the signed agreement before any patient data reaches the system.

Does an AI receptionist need a BAA?

Yes. An AI receptionist that answers patient calls is a business associate under HIPAA, and a business associate must have a BAA in place before it handles PHI at all. Without one, the practice is out of compliance, not just the vendor.

Is ChatGPT HIPAA-compliant for answering patient calls?

No. General-purpose consumer AI tools are not scoped as business associates, do not come with a BAA by default, and give you no audit trail over what was said or stored. Sounding capable on a call and being legally permitted to handle PHI are separate questions.

Does SOC 2 mean a vendor is HIPAA-compliant?

No. SOC 2 is an independent auditor’s opinion on whether security controls are designed well and, for Type 2, operating effectively over a period. HIPAA is a legal obligation. The two overlap heavily, which is why buyers ask for both, but neither substitutes for the other.