Is an AI receptionist HIPAA compliant?

Start with what HIPAA is. It's a federal law with a compliance regime, and your practice, as the covered entity, stays responsible for patient information.

When you pass that information to a vendor, a business associate agreement is what makes the handover lawful. HIPAA has no certificate for a vendor to hold, so the agreement is the thing to read.

The agreement has to run all the way down the chain. Your vendor's subcontractors hear the same audio your caller speaks.

Will you sign a BAA with us, and can we read it before we buy? A vendor who signs them will tell you in writing, without a sales call.

Name every subprocessor that touches call audio or transcripts. Carrier, speech recognition, language model, voice synthesis, storage, analytics. Ask for the list in writing.

Do you hold a BAA with each of those, and will you show us? This question tells a real posture from a badge. When one layer has no agreement, the exposure lands on your practice.

What is stored, where, for how long, and who can read it? Then ask whether recording can be switched off and whether transcripts can be deleted on request.

Say you manage a dermatology practice and you want the phone answered without turning transcripts into clinical records. The work is in the brief. You tell the assistant to collect four things: name, callback number, new or existing patient, and a preferred time. For the reason, it offers categories such as skin check, follow-up, cosmetic consult or billing question.

A caller starts describing a mole that has changed shape. The assistant doesn't ask follow-up questions about it. It says the clinician will go through the details at the visit, offers the next skin-check slot, and books it. If she says it's bleeding, your rule sends her to the nurse line.

Her description is still in the transcript, because she said it. Scoping reduces what the phone system gathers, but it can't stop a caller from volunteering more, which is why the storage questions still need answers.

Not every health-adjacent business is a covered entity. HIPAA applies to health plans, clearinghouses, and providers who send health information electronically in connection with standard transactions such as billing an insurer. A cash-only massage studio, a personal trainer or a wellness coach may sit outside it. State privacy law can still apply, so take the question to whoever advises you rather than settling it from a web page.

If you are covered, your own risk assessment is the document that matters. Add the phone system to it like any other vendor: what information reaches it, where that's stored, who can read it and how it gets deleted. Write down the answers you receive and the date you received them.

Two settings deserve a decision rather than a default. Should call audio be kept, or only transcripts? And how long should either live before deletion? Shorter retention means less to worry about in a breach, at the cost of less history to look back on.

Bring whoever advises you on compliance into the first conversation with us, and ask what the system stores for your configuration. Write that answer into the risk assessment too.

GreetKeeper does not make a HIPAA claim. Recording is a setting you control, so you can keep call audio out of your records and still get the transcript.

Healthcare setups on GreetKeeper cover enquiries and scheduling: who called, what they wanted, and when they're coming in. Treatment detail stays in your practice-management system, and your brief can offer booking categories instead of asking about symptoms.

Ask us exactly what GreetKeeper stores for your configuration, and take the answer to whoever advises your practice on compliance. You can run the whole setup through the 14-day free trial before a real patient call reaches it.