HIPAA and AI Phone Assistants: 8 Questions to Ask Vendors
What US practices should ask before using an AI receptionist or phone assistant that handles protected health information, including BAAs, storage and access.
Introduction
When a patient tells an AI phone assistant their name, date of birth and reason for visiting, that recording becomes protected health information (PHI) under HIPAA. Your practice is responsible for choosing vendors that protect it.
Use these eight questions to evaluate any AI receptionist, including ours.
This article is general information for clinic owners, not legal advice. For decisions about your own practice, speak to a qualified adviser.
Key takeaways
- Call recordings and summaries that identify a patient are PHI.
- HIPAA requires a Business Associate Agreement (BAA) with vendors that create, receive or store PHI for you.
- Ask how data is encrypted, where it is stored, who can access it and how long it is kept.
- Only share the minimum information the assistant needs to do its job.
1. Will you sign a Business Associate Agreement?
A BAA is the contract HIPAA requires between a covered entity and a business associate that handles PHI on its behalf. If a vendor will not sign one, do not send PHI through it.
2–4. How is data protected?
- <strong>Encryption:</strong> is data encrypted in transit and at rest?
- <strong>Location:</strong> where are recordings and transcripts stored, and by which sub-processors?
- <strong>Access:</strong> who at the vendor can listen to calls, and is access logged?
5–6. How long is data kept, and can we delete it?
Ask for the default retention period for recordings and transcripts, and whether your practice can set its own or delete data on request. Also ask whether your call data is used to train AI models.
7. What happens if there is a breach?
HIPAA's Breach Notification Rule requires notification after a breach of unsecured PHI. Ask how quickly the vendor would tell you, and what support they provide.
8. What does the assistant say and not say?
The AI should stick to scheduling and general questions, avoid clinical advice, and direct emergencies to 911. Check that you control the greeting, FAQ and booking rules.
Talk to us about your requirements
Before going live with Clinic24, contact our team to discuss your compliance needs, and read our security overview.
Recommended next step
Clinic24 for clinics in the United States
Answer every patient call 24/7 and book appointments automatically. Free 14-day trial, no credit card.