AI receptionists for dental offices: what to ask about HIPAA before you start

This guide is practical background, not legal advice. Your practice's privacy officer or compliance advisor should review any new tool that might touch patient information.

Dental front desks are some of the busiest desks anywhere. The same few people check patients in, answer the phone, verify insurance and handle billing questions. When the phone rings during the morning rush or after closing, it often goes to voicemail, and new patients tend to call the next practice instead.

An AI receptionist can catch those calls. But in a medical setting, “can it answer the phone?” is the easy question. The real question is how it handles patient information.

What an AI receptionist can safely handle

The safest designs keep the AI on non-clinical tasks. That covers a lot of calls:

• Office hours, location, parking and directions.
• Which insurance plans you accept, and what new patients should bring.
• General new-patient information and how to request an appointment.
• Taking appointment requests that your front desk confirms.
• Routing anything urgent by your written instructions.

What it should never do is give clinical advice, discuss treatment, or collect a medical history over the phone or in chat. Those stay with your staff and your dentists.

Why the Business Associate Agreement matters

Under HIPAA, a vendor that creates, receives, stores or transmits protected health information on your practice's behalf is generally a business associate. Before that vendor touches PHI, your practice should have a Business Associate Agreement (BAA) with them.

Here's the catch with AI tools: one receptionist may involve several services. A phone provider, a speech-to-text engine, an AI model, and somewhere to store messages and summaries. If patient information can pass through any of them, each one needs to be covered.

So the first question for any AI receptionist is simple: which companies will handle our patients' information, and will each of them sign a BAA? If the answer is vague, that's your answer.

Be wary of “HIPAA compliant” labels

You'll see plenty of tools marketed as “HIPAA compliant”. There's no official government certification that makes a product compliant. Compliance depends on how a tool is configured and used in your practice, and on the agreements behind it.

That's why I don't describe anything I build as “HIPAA compliant”. What I can say is how it's set up: for anything involving patient information, I only use platforms that sign a BAA with your practice, inside your own accounts, and the agent never gives clinical advice.

Questions to ask any vendor

1. Which services will process call audio, transcripts and messages?
2. Will each of those services sign a BAA with our practice?
3. Where are recordings, transcripts and summaries stored, and for how long?
4. Whose account is it in: ours or the vendor's?
5. Is any of our data used to train AI models?
6. What is the agent told never to say or do, and how was that tested?
7. How does a caller reach a real person?
8. If we stop using it, what happens to the data?

Keep it to the minimum

A good rule: the agent should collect only what the front desk needs to call the patient back. Name, phone number, the type of appointment they want, and whether they're new or existing. Not symptoms, not history, not insurance ID numbers unless there's a clear reason and the right agreements are in place.

Fewer details collected means less risk and a simpler setup.

Recording and disclosure

Patients should know they're speaking with an AI assistant. If calls are recorded, the greeting has to say so. Illinois requires consent from everyone on a call before it's recorded. A short, friendly line at the start covers both, and a person should always be reachable.

What about Dentrix, Eaglesoft or Open Dental?

Whether an AI receptionist can book directly into your practice management system depends on the system and what it allows. Many practices start with the agent taking appointment requests that the front desk confirms. It works with any system, keeps a person in the loop, and avoids giving a new tool broad access to patient records on day one.

Start with after-hours and overflow

You don't have to hand the whole phone over. The easiest first step is after-hours calls, then overflow during busy times. Your team still answers when they can. The agent catches what they can't.

Run a short pilot, read every summary, and keep tuning the answers. If it isn't making life easier for your front desk, turn it off.

A short checklist

• List the non-clinical questions patients ask most, with your approved answers.
• Decide what counts as urgent and where those calls go.
• Confirm a BAA for every service that could see patient information.
• Write the NEVER list: no clinical advice, no treatment discussion, no medical history.
• Test it, then pilot on after-hours calls first.

More on how I set up front-desk agents is on the dental and medical page.