New: Casey now creates patient charts over the phone. See how
Voice or chat, any bot handling patient calls is handling protected health information. Here is the short list of things that actually make it compliant, and the marketing phrases that mean nothing.
Whether a patient speaks to a voice agent or types to a chatbot, the moment their name, symptoms, or contact details are involved, you are handling protected health information. The friendly interface does not change the legal category. Every compliance question you would ask about a human handling that data applies to the bot, and to every downstream service the bot relies on.
Start by discounting the badge. HHS does not certify anyone as HIPAA compliant; there is no audit body and no registry. A vendor claiming certification is either being sloppy or hoping you will not check. Compliance is an ongoing obligation demonstrated through specific, verifiable practices, not a logo.
Any bot vendor that touches PHI is a business associate and must sign a Business Associate Agreement. Without it, using the tool with patient data puts you in breach no matter how good their engineering is. Then read the subcontractor clause, because AI bots lean on downstream providers for speech recognition, language models, and telephony, and each one touching PHI has to be covered by the chain of agreements.
This is the one people forget. Ask directly whether your patients’ data, audio, transcripts, or chat logs, is ever used to train shared or third-party models. For any model not dedicated to you, the answer must be no, and it must live in the contract, not in a reassuring sales email. Data used for training can resurface in ways you cannot control.
Compliant bots let you decide how long audio and transcripts are kept, ideally including discarding raw audio at the end of a call and retaining only the structured outcome written to the chart. Access should be least-privilege, limited to named roles, and logged. And ask separately where data is processed and stored, and whether anyone outside the United States can reach it; a vendor can pass one of those and fail the other.
TLS 1.3 in transit and AES-256 at rest is the baseline every serious vendor meets. If encryption is the centrepiece of a security pitch, they are describing the floor as if it were the ceiling. The more telling questions are about key management, access control, and exactly which subcontractors see what.
Some obligations stay yours no matter how compliant the bot is. Update your Notice of Privacy Practices to reflect automated call and chat handling, add the vendor to your risk analysis and incident response plan, and check your state’s recording-consent law, since roughly a dozen require all-party consent. Get the signed BAA, the written no on training, your chosen retention settings, a named security contact, and reviewed breach-notification terms, and you are ahead of most practices going live this year.
A traditional answering service takes a message. A modern AI answering service answers the question, books the appointment, and writes it back to your chart. The difference is the whole point.
ReadPatients call when their day ends, which is exactly when your office is closed. The evening and weekend window is not an edge case; it is a standing share of demand you are handing to whoever answers.
ReadMost practice chatbots are a search box that argues with you. A useful one does the same job as your front desk in text: answers the real question, then books. Here is the line between the two.
ReadOutsourced call centers solve the staffing problem and create three new ones: quality drift, per-minute incentives, and a booking that still lands as a message. Here is the honest comparison.
ReadA voice agent that tries to do everything is dangerous. A voice agent that knows its lane, books the routine calls and hands the rest to a human, is one of the highest-leverage tools a practice can add.
ReadReading your schedule is easy. Writing a correct appointment back into it, respecting every provider and visit-type rule, is the hard engineering that separates real automation from a glorified message pad.
ReadYou do not automate a front desk by buying ten tools. You do it by finding the two or three repetitive, high-volume tasks that leak the most money, and taking those off your staff first.
ReadChiropractic clinics live and die by the rebooking cadence, yet the same staff answering the phone are the ones checking patients in for adjustments. Here is where the calls go missing.
ReadWhen your next opening is weeks out, every cancellation is precious and every missed call is a cosmetic consult that booked with someone else. Here is how the front desk quietly leaks revenue.
ReadA missed call is a new patient who booked with the practice down the road. Here is how to actually put a number on what that costs you.
ReadEvery vendor in this category demos beautifully. These are the questions that separate a genuine front-desk replacement from a glorified phone tree with a nicer voice.
ReadA plain-language guide to the compliance questions worth your time, the vendor claims that mean nothing, and the specific documents you should have on file before going live.
ReadLive in 10 business days
See Casey answer, book, and document a real call in a 20-minute demo, using your scheduling rules, not a canned script.
