Is an AI receptionist HIPAA compliant? What practice owners need to verify

Why can’t a vendor just promise HIPAA compliance?

HIPAA applies to your practice (the covered entity) and to the vendors that handle patient information on your behalf (business associates). It does not apply to a piece of software in the abstract. A platform can have good security and still be used in a way that breaks the rules, for example by recording calls into an account nobody signed an agreement for.

HHS is direct about certifications: it "does not endorse or otherwise recognize private organizations’ ‘certifications’" for the Security Rule.^[2] A "HIPAA certified" badge on a vendor website tells you about their marketing. It does not transfer any responsibility away from you.

Does an AI receptionist handle PHI?

Almost always, yes. A caller who gives their name, date of birth, and the reason they need an appointment has just shared protected health information. The AI platform turns that audio into text, may store a recording and a transcript, and may pass details to your scheduling system. Each of those steps involves a vendor creating, receiving, maintaining, or transmitting PHI.

Which vendors need a business associate agreement?

HHS allows a covered entity to share PHI with a business associate only with "satisfactory assurances" in a written contract, known as a business associate agreement (BAA).^[1] For an AI receptionist, map every system the call touches and ask each vendor for a BAA.

What is the conduit exception?

Some vendors only carry data from one place to another, like the phone company or the postal service. HHS calls these conduits and says their access to PHI is "only transient in nature." The exception ends the moment a vendor stores the data. HHS says a cloud service that "maintains ePHI for the purpose of storing it will qualify as a business associate."^[3] An AI platform that keeps transcripts is not a conduit.

What should the receptionist be allowed to collect?

HIPAA’s minimum necessary standard asks you to take "reasonable steps to limit the use or disclosure of, and requests for, protected health information to the minimum necessary."^[4] For a receptionist, that turns into simple rules:

• Collect what the front desk needs for the task: name, callback number, date of birth to find the chart, and a short reason for the visit.
• Do not ask for detailed symptoms or history unless your clinical team wants that before a callback.
• Do not read clinical information back to a caller whose identity has not been confirmed.
• Keep voicemail and callback messages short. HHS guidance allows messages at home but advises limiting the information left.^[5]

What California rules apply on top of HIPAA?

Practices in Orange County, Los Angeles, the Inland Empire, and San Diego answer to state law as well as HIPAA. Three rules matter most for an AI receptionist.

Call recording consent

California makes it a crime to record a confidential phone conversation without the consent of all parties (Penal Code 632), and requires all-party consent for calls involving cell phones (Penal Code 632.7).^[6][7] If the receptionist records calls, the greeting should say so before the conversation starts.

AB 3030 and generative AI

Since January 1, 2025, California Health and Safety Code 1339.75 requires a health facility, clinic, physician’s office, or group practice that uses generative AI for patient communications "pertaining to patient clinical information" to include a disclaimer and instructions for reaching a human. For audio, the disclaimer comes at the start and the end of the interaction. The rule does not cover administrative matters such as appointment scheduling and billing, and it does not apply when a licensed provider reads and reviews the message first.^[8]

The statute names physician offices and clinics. It does not name dental offices, so a dental practice should ask its attorney whether it applies. A receptionist that sticks to scheduling and logistics stays outside the rule either way.

The Confidentiality of Medical Information Act

California’s CMIA bars providers and their contractors from disclosing medical information without authorization, except in listed situations.^[9] It runs alongside HIPAA, so vendor contracts should cover it too.

A checklist to verify before you go live

1. 1

   Map the call path

   List every system a call touches: phone carrier, AI platform, storage, scheduling integration, reminder service.

2. 2

   Collect the BAAs

   Get a signed business associate agreement from every vendor on the list that stores or processes PHI.^[1]

3. 3

   Write the collection rules

   Decide what the receptionist asks for, what it never asks for, and what it never repeats back.

4. 4

   Set storage and access

   Choose where recordings and transcripts live, how long they are kept, and who can open them. Turn on access logs.

5. 5

   Handle California disclosures

   Add the recording notice to the greeting. If any clinical content is AI-generated, add the AB 3030 disclaimer and a path to a human.^[8]

6. 6

   Test before launch

   Call through every route, including after-hours and transfers, and read the transcripts to check what was captured.

7. 7

   Review after every change

   A new vendor, a new workflow, or a staff change means another pass through this list.

What does a HIPAA mistake actually cost?

The HHS Office for Civil Rights enforces HIPAA against small practices too, including over something as ordinary as a reply to an online review. In 2022 it settled with New Vision Dental in California for $23,000 after the practice disclosed patient information while responding to reviews.^[10] The same logic applies to an AI system that says too much to the wrong caller. A short list of rules, written before launch, prevents most of it.

This guide explains how the rules apply to phone automation. It is not legal advice. Your privacy officer or attorney should sign off on your final setup.