HIPAA-ready AI phone answering for clinics: the vendor questions that matter

Any vendor that answers your patient calls is handling protected health information from the first sentence. A caller gives a name, a reason for the visit, and an insurance carrier, and your receptionist has already touched PHI three times. That makes the vendor a business associate under HIPAA, and it makes the contract more important than the demo.

Plenty of AI phone vendors say they are HIPAA compliant. That phrase is a marketing claim until it is backed by paperwork and architecture. The questions below are what separate a vendor your compliance team can approve from one that leaves your practice carrying the liability.

Will you sign a BAA before the first call?

This is the first question and the only dealbreaker. If the vendor cannot produce a signed Business Associate Agreement before any patient call is routed to them, stop the evaluation. No BAA means your practice is out of compliance, not the vendor. Your practice is the covered entity, so you face the OCR investigation and the fines if something goes wrong. Ask for the BAA template before the demo so your counsel can review it, not after you have already signed a subscription.

Where does patient data live, and who can see it?

Call recordings, transcripts, and summaries are PHI once they touch a patient call. Ask where they are stored and how they are protected. You want encryption in transit (TLS 1.2 or better) and at rest (AES-256 or equivalent), stored in infrastructure that is eligible for healthcare workloads, ideally within the United States.

Then ask about access. Role-based access controls should limit who at the vendor and who at your practice can open recordings and transcripts. Every access should be logged with a timestamp: who looked at what, when, and what they did. Audit logs are what you hand to an investigator, so confirm they exist before you need them.

How do you apply the minimum necessary rule?

HIPAA’s minimum necessary standard says the vendor should collect and access only the information a call requires. An agent booking a follow-up does not need the patient’s medication list. An agent confirming an appointment does not need the diagnosis history.

Ask the vendor to show you how this works in practice. Can the system limit which fields it pulls from your EHR or practice management system per call type? Does it record the full transcript by default, or can it record only the summary for routine calls? A vendor that shrugs at this question is storing more PHI than it needs.

Is patient data excluded from model training and human review?

This one is specific to AI vendors, and it is the question most buyers never ask. Get a contractual commitment that your patient calls are not used to train the vendor’s models, and not reviewed by human staff for “quality improvement” unless you have agreed to it in writing.

Many vendors train on customer data by default. For a dental office’s marketing calls that is a contract issue; for a clinic it is a PHI issue. The exclusion belongs in the BAA or the order form, not in a support article.

What happens to our recordings when we cancel?

Ask about data retention and deletion in writing. How long are recordings and transcripts kept by default? Can you set the retention window, for example 30, 60, or 90 days? What happens when the contract ends: is the data returned, destroyed, and certified as destroyed?

Vendors that keep patient data indefinitely after cancellation create a liability you cannot see. The retention terms should match your practice’s own record policies.

How does the system verify identity before disclosing PHI?

Before the AI tells a caller anything about their care, it needs to confirm who is calling. The standard approach is full name plus date of birth, and some practices add a third factor like the phone number on file. Ask the vendor what identity check runs before the system reads back appointment details, test results, or billing information, and what the system does when the check fails. The safe answer is that it stops and routes to staff, not that it keeps talking.

How are urgent clinical calls handled?

An AI receptionist should never give medical advice, and the vendor should be clear about that boundary. Ask what happens when a caller describes symptoms: does the system screen for red flags and route to the nurse line or on-call provider? How fast is the escalation, and what does the patient hear while waiting?

Also ask how the system handles the caller who says “this is an emergency.” The right behavior is to tell them to hang up and call 911 or go to urgent care, then page your team. A vendor that lets the AI keep chatting through an emergency is one to walk away from.

What does your breach notification process look like?

Under HIPAA the vendor must notify you of a breach of unsecured PHI. Ask for the process in writing: who notifies whom, within how many days, and what information the notice includes. Then ask when they last tested it. A vendor that has never run its own notification process is telling you something.

Does the system send texts, and are they covered?

Many AI receptionists fall back to texting a patient a confirmation link or a form. Standard carrier SMS is not encrypted, and a texting channel becomes usable for PHI only when the texting vendor signs a BAA and provides encryption, access controls, and audit logging. Confirm the text channel is covered by the same BAA and is not an unvetted third party bolted onto the voice product.

The bottom line for your evaluation

SOC 2 is not HIPAA compliance. A vendor can hold a SOC 2 Type II report and still leave you non-compliant without a BAA, so treat the attestation as useful background, not as the answer. The answer is the signed BAA, the encryption posture, the access controls and audit logs, minimum necessary handling, written retention terms, and the training exclusion. Get proof of each rather than accepting the compliance badge on the pricing page.

For the rest of the setup once you have picked a compliant vendor, see our BAA and data-handling checklist for clinic owners and the AI receptionist onboarding checklist. And plan how you will review calls weekly once the system is live, since compliance is something you maintain, not something you buy once.