Not by default, and nothing can be officially "HIPAA certified": HHS says it does not endorse or recognize private certifications. What matters is a signed business associate agreement and how call records are handled. Before an AI answers your practice's phones, ask five things: will the provider sign a business associate agreement, who can hear the call recordings, where the data is kept and for how long, what the AI does when it doesn't know an answer, and how you get your data back if you leave. Good providers answer all five plainly.
Calls to a dental practice are full of patient information: names, dates of birth, symptoms, appointments. Before any AI answers your phones, it's reasonable to ask hard questions about where that information goes. Here are five worth asking any provider, us included, with what a good answer sounds like.
We build an AI receptionist for dental practices, so our own answers are at the end. Two nearby questions have their own post: whether an AI receptionist has to say it's an AI, and when a call may be recorded. See disclosure and call-recording rules.
HIPAA in brief
HIPAA protects patients' health information. Your practice is a covered entity, and a company that creates, receives, keeps or sends that information on your behalf is generally a business associate. You need a written business associate agreement with it (see HHS's business associates guidance and its sample agreement provisions). HIPAA's Security Rule also expects administrative, physical and technical safeguards for electronic health information. In our reading, that includes call recordings and transcripts that hold patient details.
1. Is it HIPAA compliant, and what paperwork do we sign?
Under HIPAA, a vendor that handles protected health information for your practice generally needs a business associate agreement with you. Ask what the provider signs, and whether the companies it builds on have signed an agreement too.
A good answer: "We sign a business associate agreement with you, our voice platform has signed one with us, and here is a page showing what we store and where." Be wary of "HIPAA compliant" as a badge with nothing to sign behind it, and of "HIPAA certified" anywhere: HHS recognizes no such certificate.
What the agreement has to cover
HHS's sample provisions page lists what the written contract must do. In plain words, and among other things, it must:
- say how the company may use and share patient information, and rule out anything else;
- require safeguards to protect it;
- require the company to report any use or disclosure the contract doesn't allow, including a breach;
- make any subcontractor that handles the information agree to the same restrictions;
- have the information returned or destroyed when the contract ends, if that is feasible.
The companies behind the provider
An AI receptionist is often built on other companies' services, such as a voice platform and storage. HHS says a subcontractor that creates, receives, keeps or sends patient information for a business associate is a business associate too (same business associates guidance). Its cloud computing guidance adds that a company storing the information is not a mere "conduit", even if it can't read it. So ask which companies keep your call records, and whether each has signed an agreement with the provider.
2. Are calls recorded, and who can hear them?
Recordings and transcripts are useful. They let your team check exactly what a patient said. Ask whether the caller is told about the recording, who can access it, and how the logins that protect it work.
A good answer: only the people at your practice you choose, each with their own login, plus named people at the provider, for stated reasons such as fixing a problem.
3. Where is the data kept, and for how long?
Ask how long recordings, transcripts and messages are stored, and how they're deleted when they're no longer needed. A recording is patient information for as long as it exists, so ask for a stated period, not "as long as needed".
A good answer: a clear retention period, secure storage with a known provider, and deletion on request or at the end of the contract.
4. What does the AI do when it doesn't know?
Guessing is the real risk. A safe receptionist takes a message instead of making up an answer about a patient's treatment, bill or appointment.
A good answer: "It only answers from the facts you give it. Anything else becomes a message for your team." Test it: call the demo and ask something the practice wouldn't have told it. Our post on how to choose an AI dental receptionist has more test calls like that one.
5. What happens if we stop?
Ask how you get your call history out, and what happens to the data after you leave.
A good answer: you can export what you need, and the rest is returned or destroyed, as a business associate agreement should say.
Questions to ask your own team, too
- Who needs access to the portal? Give each person their own login rather than sharing one.
- How do you check who's calling? Before discussing an existing patient's appointments or treatment, confirm two details, such as full name and date of birth. Our phone scripts include this habit.
- Who changes the receptionist's facts when your hours, fees or providers change?
Our answers
- We sign a business associate agreement (a BAA) with your practice before the receptionist answers any patient call. Our voice platform has signed one with us.
- Calls are recorded, and the caller is told. Your staff can hear them, each with their own login. So can our owner, only to set up, fix or check your receptionist.
- Call records are kept with our voice platform, a US company, and deleted automatically 90 days after each call unless you choose a different period.
- If the receptionist isn't sure, it takes a message instead of guessing.
- If you stop, you have 30 days to download your call records. Then we delete them and confirm it in writing.
You also get one page that shows exactly what we store and where. There is no official HIPAA certificate, for us or for any company, so we don't say "certified". Until we have both signed, the receptionist only takes test calls.
Two things we ask of you. Please check that the recording notice is enough for your state's call-recording law. And please never email us patient details.
Sam (short for Ibtisam), the owner, can send you our sample BAA and the one-page sheet of what we store before you decide. Book 15 minutes and bring your list. For the bigger picture, read our guide to what an AI dental receptionist is and how it works.
Common questions
Is an AI receptionist HIPAA compliant?
Not by default. There is no official HIPAA certificate, and HHS does not endorse or recognize private certifications. What matters is a signed business associate agreement and how the provider handles call recordings, transcripts and messages.
Does an AI receptionist need a business associate agreement?
Generally yes. If it handles protected health information for your practice, such as names, dates of birth and symptoms on calls, HIPAA expects a written business associate agreement.
Is Pure Reception HIPAA compliant?
Before the receptionist answers any patient call, we sign a business associate agreement (a BAA) with your practice. Our voice platform has signed one with us. You also get one page that shows exactly what we store and where. There is no official HIPAA certificate, for us or for any company, so we don't say 'certified'.
What is a BAA?
A business associate agreement is the written contract HIPAA expects between a practice and a company that handles patient information for it. We sign one with your practice before the receptionist answers any patient call.
Are AI receptionist calls recorded?
Ours are, and the caller is told. Every call has a recording and a written transcript in your private portal, so your team always knows what was said.
This post is general information, not legal advice. If you're unsure what your practice needs, check with your compliance adviser.
Last checked: 14 November 2026. The five HHS pages linked above were opened in a browser and read that day.
