Your phone is the most expensive leak in the practice.

An AI receptionist that picks up every call sounds like the whole fix. In my experience it is not.

That also answers two of the questions above, in my terms. An answering service takes a message and hands it to you. An AI receptionist is built to act on the call. That is where I draw the difference; vendors draw it in different places. Can AI book appointments for a dental office? It can take the call and capture the request. In my view, the booking is only as good as what follows it: the text that confirms it and the person who owns it. For the rules below, the label does not matter. If the vendor touches patient information, the same obligations apply. Whether callers prefer a person or a machine, and what you tell them, is a separate question for a separate article.

Start with HIPAA, because the vendor is not a bystander. HHS puts it plainly: “When a covered entity engages the services of a CSP to create, receive, maintain, or transmit ePHI (such as to process and/or store ePHI), on its behalf, the CSP is a business associate under HIPAA” 1. CSP means cloud service provider. In plain words, an AI answering vendor that hears, stores or passes along patient information on your behalf falls in that category. It is your business associate.

That status comes with paperwork, and skipping it is not a gray area. “If a covered entity (or business associate) uses a CSP to maintain (e.g., to process or store) electronic protected health information (ePHI) without entering into a BAA with the CSP, the covered entity (or business associate) is in violation of the HIPAA Rules” 2.

So, is an AI receptionist HIPAA compliant? That is the wrong question, because nobody in government grants that label. “OCR does not endorse, certify, or recommend specific technology or products” 1. The useful question is simpler: does the vendor sign a business associate agreement? If the answer is no, stop there.

And handing the phones to someone else does not move the responsibility off your desk. The ADA warns: “If you hire a company to make calls for you, both you and the company are responsible for compliance, and are potentially liable for any violations” 4. It adds: “A company that calls patients on your behalf is likely to be your ‘business associate’ if your dental practice is covered by HIPAA” 4.

Answering is half the job. Calling and texting back is the other half, and a different law applies. The FCC “Confirms that the TCPA’s restrictions on the use of ‘artificial or prerecorded voice’ encompass current AI technologies that generate human voices. As a result, calls that use such technologies require the prior express consent of the called party” 3. Do AI phone calls to patients need consent? Under that ruling, calls that use AI-generated voices require the called party’s prior express consent 3. Get it before the AI dials.

Reminder texts live under two sets of rules. Under HIPAA, “Yes, appointment reminders are considered part of treatment of an individual and, therefore, can be made without an authorization” 5. Under the TCPA, HIPAA-covered practices get a carve-out, with conditions. The ADA lists them, including: “The message is limited to a healthcare treatment purpose: appointment and exam reminders and confirmations…” 4. Also: “The message does not contain marketing, solicitation, advertising, accounting, billing, debt-collection, or other financial content” 4. And: “Each message includes an easy way to opt out of future such messages” 4. The ADA notes the rules are complex and that state law can be stricter 4.

Are text appointment reminders HIPAA compliant? Under HIPAA, a reminder can be sent without an authorization 5. Under the TCPA, it has to stay a reminder to fit the carve-out 4. Add a promotion and you are outside it.

Why this matters in dollars: “The TCPA lets individuals sue for up to $1,500 for every phone call or text that violates the law” 4. Per message. Not per campaign.

One more thing if your texts carry a link to book online. HHS has said that “Tracking technologies on a regulated entity’s unauthenticated webpage that permits individuals to schedule appointments or use a symptom-checker tool without entering credentials may have access to PHI in certain circumstances” 6. Part of that bulletin was vacated by a federal court in AHA v. Becerra, and the page says so, so read it with that in mind 6.

Answer every call, or call every missed one back, with a system. Not with hope and a voicemail box. Pair AI with messaging and with people, because in our experience that is the version that moves the phone.

Get the business associate agreement signed before the first call is handled 2. Get prior express consent before any AI voice dials out 3. Keep marketing out of reminder texts, and keep an opt-out in every one 4.

Ask vendors for proof. The FTC’s question to AI sellers is the one you should put to them: “Are you exaggerating what your AI product can do?” 9 If the answer is a demo and a promise, keep asking. And if all this sounds unglamorous, it is. That is the point.