AI Receptionist HIPAA Considerations for Small Offices

Picture a dental office at 12:40 on a Tuesday. The front desk is at lunch, the phone rings, and a caller says: "This is Maria Lopez, I'm having pain after my root canal on Friday, can someone call me back?" That sentence contains a name, a treatment, a provider relationship, and a symptom. If an AI receptionist answers that call, it has just handled protected health information (PHI).

That's the core of the AI receptionist HIPAA question. It isn't "is AI allowed?" It's "where did that sentence go, and who is contractually responsible for it?"

First: are you a covered entity?

HIPAA applies to covered entities (healthcare providers who bill electronically, health plans, clearinghouses) and their business associates. Most of AlphaAssist's audience is not in that group. An HVAC company, a plumber, an electrician, or a tattoo studio generally isn't a covered entity, and a caller describing a broken furnace isn't PHI.

Some businesses sit in a gray zone. A salon is usually fine. A med spa that bills insurance, a physical therapy clinic, a chiropractor, a therapist, or a dentist is not. If you're unsure, ask your attorney or compliance contact. Don't ask a software vendor, because they have an incentive to say whatever closes the sale.

Where I'd start if you are covered

This is what I tell people who ask me about this, as standing advice rather than a sales pitch.

1. Get the BAA before you get the demo

If a vendor creates, receives, stores, or transmits PHI for you, HIPAA requires a signed business associate agreement (BAA). No BAA means you shouldn't let PHI touch that system. A vendor saying "we take privacy seriously" is not a BAA. Ask for the document in writing, early.

2. Ask about the whole chain, not just the vendor

An AI phone receptionist is rarely one system. A typical stack, ours included, has a telephony layer, a speech and language model layer, a text-to-speech layer, and a messaging layer. AlphaAssist runs on Twilio for calls and texts, Deepgram for speech recognition, Claude (from Anthropic) for the conversation, and Cartesia for the voice. Each of those is a separate company handling some part of the call or the text.

For a covered entity, the question is whether every link that touches PHI is covered by an agreement, and whether the specific product tier you'd be using is eligible. Vendors often offer BAAs only on certain plans or with certain settings (zero data retention, for example). Terms change, so verify each one directly rather than trusting a blog post, including this one.

3. Be clear about what we are and aren't

I'm not going to tell you AlphaAssist is a HIPAA-compliant product. We're built for owner-operators in the trades and personal services, who need calls answered and messages captured while their hands are busy. We haven't built or marketed it as a healthcare product. If you're a covered entity, don't assume it fits. Ask us directly what we can and can't sign, and get the answer in writing.

The parts people forget

The voice call gets all the attention. The side effects cause more trouble.

• Transcripts and summaries. Caller-message capture means the words get stored somewhere: a transcript, a category label (booking, service-inquiry, support), a callback number. For a medical office, all of that can be PHI. Ask where it's stored, who can read it, and how long it's kept.
• Follow-up texts. AlphaAssist can send a Google-review SMS to bookers 48 hours after their booked appointment. For a plumber, that's a friendly nudge. For a therapy practice, a text that confirms someone was a client is itself a disclosure problem. If you're a covered entity, that feature should be off.
• Notification emails and SMS to staff. A message forwarded to a personal phone or an unencrypted inbox moves PHI out of the system you vetted.
• Call recording consent. Separate from HIPAA, some states require all-party consent to record. An AI disclosure at the start of the call handles part of this, but check your state's rules.
• Model training. Ask whether call content can be used to train any vendor's models. For PHI, the answer needs to be no, in writing.

If you can't get a BAA

You have a few honest options, and none of them is "use it anyway and hope."

1. Don't route patient calls through it. Keep a human or a HIPAA-covered answering service on patient lines.
2. Limit it to non-PHI jobs. An AI that only gives office hours, directions, and "if this is an emergency, call 911" doesn't have to collect anything. That works only if it's configured to take no names, symptoms, or callback details. Even a name and number from someone calling a clinic can count as PHI, so a strict no-capture setup matters, and you should have counsel confirm it.
3. Use a different tool. Some vendors build specifically for healthcare, sign BAAs as a standard part of onboarding, and have compliance documentation ready. If you're a covered entity, one of those is likely a better fit than us. That's a plain statement of fit, not a knock on anyone.

What a good vendor answer sounds like

Whoever you're talking to, you want specific answers to specific questions:

• Will you sign a BAA, and on which plan?
• Which subprocessors touch call audio, transcripts, and texts, and are they covered?
• What's your retention period, and can I set it?
• Is data used for model training?
• How do I turn off outbound texts and recording?

Vague answers or a pivot to "we're very secure" mean the answer is probably no.

This post is general information, not legal advice. Your compliance obligations depend on your state, your billing practices, and your contracts.

If you run a trades or personal-services business and want calls answered while you're on a job, AlphaAssist is built for that. If you're not sure whether you fall under HIPAA, or you want to know exactly what we do and don't handle, call +14133317776 and ask. I'd rather tell you it's not a fit than have you find out later.