AI Receptionists in Medical and Dental Offices

A medical or dental office can use an AI receptionist for administrative calls, but only after confirming one thing first: if the AI will handle protected health information (PHI), such as a patient's name together with their appointment or reason for visit, HIPAA generally requires a business associate agreement (BAA) with the vendor. Beyond that, keep the AI to administrative tasks, collect the minimum information needed, send emergencies to 911, and never let it give clinical advice.

General information, not legal or compliance advice. Talk to your compliance lead or attorney before deploying.

Step one: the business associate question

Under HIPAA, a business associate is a person or company that creates, receives, maintains or transmits PHI on behalf of a covered entity. HHS guidance makes clear that covered entities need a business associate agreement with such vendors. HHS's guidance on audio-only telehealth also notes that remote communication vendors that handle PHI are generally business associates, unlike a basic phone carrier that only transmits calls.

An AI receptionist stores transcripts, summaries and messages with patient names and reasons for calling. That's PHI. So before go-live:

• Ask the vendor in writing whether it will sign a BAA.
• Ask which subcontractors (AI and speech providers) process the data and whether they have BAAs in turn.
• Review the vendor's security safeguards: encryption, access controls, retention and deletion.
• Document your risk analysis.

If the vendor won't sign a BAA, don't route patient calls to its AI. You can still use AI on a line that doesn't handle patient information, such as a general business or vendor line, but patient calls belong elsewhere.

Keep the AI administrative

Task	AI suitable?
Hours, location, parking, accepted insurance list	Yes
New-patient process and forms (text a link)	Yes
Appointment requests (collect preferences for staff to confirm)	Yes, with a BAA
Reschedule and cancellation requests	Yes, with a BAA
Prescription refill requests	Take a message only; no clinical discussion
Test results	No; route to staff
Symptoms or "should I come in?"	No; route to clinical staff or 911
Billing disputes	Take a message for billing
Emergencies	Tell them to call 911; notify staff

Minimum necessary

HIPAA's minimum necessary standard asks covered entities to limit PHI uses and disclosures to what's needed for the purpose. For an AI receptionist, that means:

Collect only: patient name, callback number, whether they're a
new or existing patient, and a brief reason (e.g., "cleaning,"
"follow-up," "refill request"). Do not ask for date of birth,
insurance ID, Social Security number or detailed symptoms.
If a caller starts describing symptoms in detail, say: "Thank
you. I'll make sure the clinical team gets your message. If this
is an emergency, please hang up and call 911."

See keeping sensitive data off AI calls.

Emergencies

The AI must never assess symptoms. Write a clear rule:

If the caller describes chest pain, trouble breathing, severe
bleeding, stroke symptoms, a severe allergic reaction, thoughts
of self-harm, or says it's an emergency: say "Please hang up and
call 911 now, or go to the nearest emergency room." Then take an
urgent message for the clinical team.

For dental offices, add your after-hours policy for dental emergencies (knocked-out tooth, severe swelling): who's on call and how to reach them. See what an AI receptionist should do in an emergency.

Disclosures

• AI disclosure: Utah's AI law, for example, treats health-related interactions as high-risk and requires proactive disclosure there. Say "AI assistant" in the greeting. See AI disclosure laws.
• Recording notice: add it to the greeting. See recording AI phone calls.
• Voicemails left by AI: keep them generic: "This is a reminder from Lakeview Dental. Please call us back." No procedure names or provider specialties.

Outbound reminder calls

AI appointment reminders need the patient's prior express consent, usually given when they provide their number. Keep reminders free of promotions and sensitive details. See AI appointment reminder calls.

Example greeting and flow

"Thank you for calling Lakeview Dental. This call may be recorded. This is Ava, the office's AI assistant. If this is a medical emergency, please hang up and call 911. How can I help?"

Typical flow for an appointment request:

1. Name and callback number.
2. New or existing patient.
3. Reason in a few words.
4. Preferred days and times.
5. "The front desk will call you to confirm a time."

Questions to put to any AI receptionist vendor

Healthcare practices should ask more than the standard vendor questions:

Question	Why it matters
Will you sign a BAA?	Required before PHI flows to the vendor
Which AI and speech providers process call audio, and do you have BAAs with them?	Subcontractors handling PHI need agreements too
Is call data used to train AI models?	PHI use beyond your purposes is a problem
Where is data stored and for how long?	Retention and breach exposure
Can we delete a specific patient's call data?	Patient requests and data minimization
Who at the vendor can access our transcripts?	Access controls
What's your breach notification process?	HIPAA breach notification obligations

Get answers in writing. See questions to ask an AI receptionist vendor for the general list.

Where AI helps most in a practice

Even with tight limits, an AI receptionist can take a real load off the front desk:

• After-hours calls: "Are you open Saturday?", "Where do I park?", and new-patient questions that would otherwise wait for the morning.
• Lunch-hour and peak overflow: callers get an answer or a structured callback request instead of a long hold.
• Recall and reschedule requests: collected cleanly for staff to confirm.

The front desk then starts the day with a list of structured requests rather than a stack of voicemails to listen to.

Setup checklist for practices

• BAA status confirmed with the vendor, in writing.
• AI limited to administrative tasks in instructions.
• Minimum necessary data collection.
• Emergency rule tested.
• AI and recording disclosures in the greeting.
• Clinical questions route to staff.
• Generic voicemail wording.
• Access to transcripts limited to staff who need it.
• Retention period set for transcripts and recordings.

Using Callata in a practice

Callata's published terms and privacy policy don't include a HIPAA business associate agreement. If you're a covered entity, contact [email protected] before routing patient calls to Callata AI agents or storing patient call recordings, and don't use AI agents on patient lines unless you have the agreements and safeguards your compliance review requires. For non-patient lines, Callata's AI agents can answer questions from your facts, take messages, text links and transfer to staff. Callata stores recordings privately, encrypts data in transit, isolates each business's data, and doesn't use your communications to train AI models.

Callata Office is $99 per month with five users included and $20 per month for each additional user. Learn more and sign up.