Does an AI receptionist need a business associate agreement?

If it answers calls for a covered practice and handles patient information, usually yes. HHS lists a scheduling chatbot on a patient portal and medical transcription vendors as business associates.

Is a phone answering service a conduit?

Usually not. HHS limits the conduit exception to services that only transmit information, such as the Postal Service and its electronic equivalents. A service that answers, records or transcribes calls handles the information itself.

Is a caller's spoken information protected?

Yes, if your practice is covered. HHS says protected health information can be electronic, paper or oral.

HIPAA and AI Receptionists: When You Need a BAA

Q: Does HIPAA apply to a small practice?

Size does not matter: it applies to every health care provider that sends health information electronically for standard transactions such as insurance claims. Using email alone does not make a provider covered.

Does an AI receptionist need to be HIPAA compliant?

If patients call it, plan on a business associate agreement.

HHS lists scheduling chatbots and transcription vendors as business associates. An AI that answers, records or transcribes patient calls usually is one too.

Short answer

If your practice is covered by HIPAA and patients will call it, yes. An AI receptionist that answers, records or transcribes patient calls usually counts as a business associate, so it needs a signed business associate agreement first¹. HHS lists a scheduling chatbot and medical transcription vendors as examples¹. If a vendor won't sign one, keep patient calls off it.

Call operations guideUpdated 2026-11-04Sources

Read how to choose an AI receptionist

Does HIPAA apply to your practice's calls?

HIPAA covers health plans, health care clearinghouses and health care providers that send health information electronically for standard transactions². For a provider, that means things like insurance claims, eligibility checks and referral authorizations. Size makes no difference: HHS says every health care provider, regardless of size, that does these transactions electronically is covered². Sending email alone does not make a provider covered².

If your practice is covered, the calls matter. HIPAA protects health information that identifies a person, and HHS says that includes information in any form, electronic, paper or oral². A patient saying their name and describing a toothache or a prescription refill is giving you protected health information. So is the recording and the transcript of that call.

Is an AI receptionist a business associate?

Usually, yes. HHS defines a business associate as a person or company that performs work for a covered entity involving creating, receiving, maintaining or transmitting protected health information¹. An AI receptionist that answers your patients, takes their details, books them in and stores the call does all four.

HHS's own examples are close to this. Its list of business associates includes a third-party vendor chatbot on a provider's patient portal that handles symptom assessment, medical reminders and appointment scheduling. It also includes a self-employed medical transcriptionist or a transcription app, and a cloud service provider that processes or stores electronic health information¹. A business associate also answers directly to parts of HIPAA itself, on top of its contract¹.

Who needs a business associate agreement, according to HHS
Who	Agreement needed?	Why, in HHS's words or rules
Vendor chatbot on a patient portal that schedules appointments	Yes	Listed as a business associate example
Medical transcriptionist or transcription app	Yes	Listed as a business associate example
Cloud provider that stores electronic health information	Yes	Listed as a business associate example
Subcontractor of a business associate that handles the information	Yes, with the business associate	Subcontractors are business associates too
US Postal Service, couriers and their electronic equivalents	No	Conduits that only transmit
Janitorial service or electrician	No	Access to health information is only incidental
Specialist receiving a referral for treatment	No	Disclosure to a provider for treatment

Sources: source 1

Doesn't the phone company exception cover it?

Probably not. HIPAA has a narrow exception for conduits: services that only carry information from one place to another, such as the US Postal Service, certain couriers and their electronic equivalents¹. HHS limits it to transmission, including temporary storage, and says entities that access health information on a regular basis to do a job for you are not conduits¹.

Your phone carrier moving a call may fit that description. A service that listens to the caller, writes down what they said, keeps a recording or books an appointment does not. It works with the information. A conduit only carries it.

What must the business associate agreement say?

HHS sets out what the agreement must contain. It must describe what the vendor may and must do with the information, bar any other use or disclosure, and require the vendor to follow the HIPAA Security Rule and report security incidents and breaches to you¹. If you learn the vendor is breaking the agreement and it cannot be fixed, you must end it where feasible¹.

The agreement also has to reach the vendor's own suppliers. A business associate must sign an agreement with any subcontractor that handles the information before passing it on, and those subcontractors are business associates too¹. For an AI receptionist, that can include the companies that run its speech recognition, its AI model and its storage.

What should you ask a vendor before patients call?

Ask these before any patient calls the system. Will you sign our business associate agreement? Where are recordings and transcripts stored, and for how long? Which subcontractors touch the calls, and do they have agreements with you? How and how fast will you tell us about a breach? Get the answers in writing.

If a vendor will not sign a business associate agreement, do not route patient calls through it. A vendor that says it is not built for HIPAA is being straight with you: use it only for a business that is not covered, never for patient lines.

This page explains HHS guidance as of 4 November 2026. It is not legal advice, and some states have their own health privacy laws, so check the rules where you practice too.