HIPAA Compliance and AI Receptionists: What Dental Practices Need to Know

You're evaluating an AI receptionist for your dental practice. It sounds great — no more missed calls, 24/7 scheduling, patients love it. Then your office manager asks the question that stops every dental tech purchase in its tracks: "Is this HIPAA compliant?"

It's the right question. An AI receptionist handles patient names, appointment details, insurance information, and sometimes clinical notes. That's protected health information (PHI) under HIPAA, and mishandling it carries fines from $100 to $50,000 per violation — with an annual maximum of $1.5 million per violation category. This isn't theoretical. The HHS Office for Civil Rights settled 145 cases in 2024 alone.

What HIPAA Actually Requires for Phone Handling

HIPAA doesn't ban AI from handling patient calls. It doesn't even specifically mention AI. What it does is set rules about how any entity — human or software — handles PHI. For phone interactions, the key requirements are:

• Access controls: Only authorized individuals and systems can access PHI
• Encryption in transit and at rest: Phone calls carrying PHI must be encrypted, and any stored data (call recordings, transcripts, appointment details) must be encrypted at rest
• Minimum necessary standard: The system should only access the minimum amount of PHI needed to do its job
• Audit trails: Every access to PHI must be logged
• Business Associate Agreement (BAA): Any third-party vendor handling PHI on your behalf must sign a BAA

That last one — the BAA — is where most practices either get it right or get into trouble.

The BAA: Non-Negotiable, No Exceptions

A Business Associate Agreement is a legal contract between your practice (the covered entity) and any vendor that handles PHI on your behalf (the business associate). If your AI receptionist vendor won't sign a BAA, stop the conversation immediately. Full stop. No BAA means they either don't understand HIPAA or they're not confident their systems meet the requirements.

A proper BAA should cover:

• What PHI the vendor will access and how
• How the vendor protects PHI (encryption standards, access controls)
• What happens in case of a data breach (notification timelines, remediation)
• Data retention and destruction policies
• Sub-contractor obligations (if they use third-party services like cloud hosting or speech-to-text APIs, those need to be covered too)

"A BAA isn't a formality. It's the legal document that determines who's liable when something goes wrong. If you don't have one with your AI receptionist vendor, your practice bears 100% of the risk."

Call Recording and Transcription: The Tricky Part

Most AI receptionists record calls and generate transcripts — that's how they improve and how you review interactions. But recordings and transcripts containing PHI are subject to the same HIPAA protections as any other medical record. Here's what to verify:

• Where are recordings stored? They should be in a HIPAA-compliant cloud environment (AWS with a BAA, Google Cloud with a BAA, Azure with a BAA — not some random server)
• Who can access them? Only authorized staff at your practice and necessary personnel at the vendor
• How long are they retained? You need a clear retention policy. Most practices keep call records for 6–7 years to match state dental record retention laws
• Can you delete them? You should be able to request deletion of specific recordings
• Is the speech-to-text engine HIPAA compliant? If the AI uses a third-party service to transcribe calls, that service needs its own BAA with the vendor

Common HIPAA Mistakes with AI Phone Systems

After working with dozens of dental practices on AI receptionist deployments, these are the compliance mistakes I see most often:

1. Using consumer AI tools for patient calls

Routing patient calls through standard ChatGPT or consumer voice assistants is a HIPAA violation. These tools aren't designed for PHI, don't sign BAAs in their consumer tiers, and may use your data for training. Purpose-built healthcare AI platforms are a different category entirely.

2. No staff training on the new system

Your team needs to understand what the AI can and can't do, and when human intervention is needed. If a staff member starts reading PHI aloud to "help" the AI during a transferred call, that could create a compliance issue depending on who's within earshot.

3. Forgetting about the PMS connection

When an AI receptionist integrates with your practice management system — whether that's Dentrix Ascend, OpenDental, or Denticon — it's accessing your patient database. That API connection needs to be encrypted (TLS 1.2 minimum), authenticated with proper credentials, and scoped to minimum necessary access. The AI shouldn't have access to clinical notes if all it needs is the appointment schedule.

How Orbit Online Handles HIPAA Compliance

Orbit Online was built from day one to handle PHI correctly. Here's the specific approach:

• BAA provided to every client — no enterprise tier required, no extra fee
• End-to-end encryption on all call audio, transcripts, and PMS API connections
• Minimum necessary access — the AI only queries what it needs (availability, patient name for appointment matching) and never accesses clinical records
• SOC 2-compliant infrastructure with audit logging on every PHI access
• Configurable call recording retention with practice-controlled deletion
• HIPAA-compliant sub-processors — every third-party service in the chain (telephony, speech-to-text, cloud hosting) operates under its own BAA

Questions to Ask Any AI Receptionist Vendor

Before you sign with any vendor, ask these questions. If they can't answer clearly, move on:

• Will you sign a BAA? (If no, you're done.)
• Where is call data stored, and is it encrypted at rest and in transit?
• What third-party sub-processors do you use, and do they each have BAAs?
• What's your breach notification process and timeline?
• Can I audit access logs for my practice's data?
• What's your data retention policy, and can I request deletion?
• Is the PMS integration scoped to minimum necessary access?