What makes an AI receptionist HIPAA-compliant at a dental practice

Your front desk checks a patient out, quotes what the crown will cost after insurance, and answers the phone in the same breath. Between patients, your front desk works the recare list by text. The phone rings again. A mother wants to move her son's cleaning. After close, a patient gets voicemail and leaves her name and which tooth hurts. Every one of those moments carries a patient's name, a birth date, what the dentist found, or what a plan paid. That is protected health information, and HIPAA covers the texts as much as the calls.

Hello Patient builds AI agents for patient conversations. On a dental line, the agents act as an AI receptionist for dental practices. They answer those calls and texts, find the patient's record, book or move the hygiene visit, and hand anything clinical to your team. The agent follows HIPAA's rules, and it works under a signed BAA. Hello Patient is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client.

Which dental calls and texts carry protected health information

Almost all of them. A cleaning reminder names the patient and the visit. "Did you decide on the crown" says what the dentist found. A balance after insurance paid is billing information about a patient, which counts too. A parent's call about a child is the child's information.

In dental terms, protected health information includes a patient's name, date of birth, what the dentist found or recommended, and the insurance and payment details tied to the visit. If a call, a text, or a voicemail holds one of those and a patient can be identified from it, HIPAA covers it.

Under HIPAA, a vendor whose agent takes those calls and texts is a business associate, and it has to sign a BAA before it touches any of it.

The trap is assuming that a capable-sounding AI is automatically a compliant one. A general-purpose AI or a consumer chatbot with no BAA is not compliant, no matter how polished it sounds on a call.

A BAA is a signed agreement where the vendor takes on legal responsibility for protecting PHI under HIPAA. It is not marketing. It is a binding contract with real obligations attached. A compliance badge on a website or a "HIPAA-ready" line in a sales deck is not the same thing. Those are claims. A BAA is proof.

The full walkthrough of the BAA and SOC 2 Type 2 is in our guide to what makes an AI receptionist HIPAA-compliant. This page is the dental version.

What the agent does with a patient's information on a dental call

It uses the information to handle the call, under the same rules your practice follows. The agent looks the patient up, tells the caller whether their plan is accepted, and books or moves the hygiene visit. It also writes down why the patient called, for example a broken tooth or a lost crown.

The agent stays in its lane. It answers questions about scheduling, hours, and insurance. It routes the rest to your staff. It never gives medical advice. When a call turns clinical, urgent, or sensitive, it hands off to a real person with the full context, so the patient never has to start over.

A few things it does not do, on purpose. When it creates a new record, it does not collect insurance card details or clinical history. It tells a caller whether their plan is accepted, but it does not answer benefits, coverage, copay, or cost questions. Those go to your billing team. It never reads card numbers over the phone. If your practice turns on bill pay, a payment goes through a secure payment link texted to the patient.

Every interaction is logged. That means each call leaves a record your team can check.

A patient calls and asks whether the crown the dentist recommended is really needed. The agent does not answer that. It books the consult, or it passes the question to your treatment coordinator with the patient's words written down, so the coordinator calls back knowing exactly what was asked.

How the agent handles a shared family phone number and a parent calling for a child

It checks who it is talking to before it opens or discusses anything, usually by phone number and date of birth. In a household where four people share one number, the patient's date of birth separates the accounts. So a practice with family accounts sets the check to phone number plus date of birth. If the details do not match a record, the agent does not guess. It passes the caller to your staff.

For minors, your practice sets how the agent handles a child's record and the guardian on the line, and the agent follows that setting.

A mother calls to move her son's cleaning, and while she has the agent on the line she asks about her daughter's appointment. The agent moves the son's cleaning on his record. Before it opens the daughter's record it runs the same check, then finds her appointment and confirms the time.

Texting patients about recare and unscheduled treatment under HIPAA

The agent can text a patient that they are due. It can also follow up on a treatment plan the patient accepted but never booked. It does both inside HIPAA's rules.

Outbound texts and calls go only to the patients your practice has consent to contact. STOP is honored immediately. Your practice sets what the texts say and how often they go out. When the patient replies, the agent answers in the same thread and books the visit there. If a reply turns clinical, "does the tooth still need the filling if it stopped hurting," the exchange goes to your team with the messages written down.

Keep the first text to the fact that the patient is due and a question about timing. The details of the treatment plan belong in the conversation the patient starts.

Say the patient replies "not mornings." The agent offers an afternoon time and books it, in the same thread, and your team sees a booked visit instead of a reply waiting for an answer.

For how the outreach itself fills the schedule, see how dental groups get patients back on the schedule.

Hear how it sounds here or request a free demo agent for your practice today by booking a call.

How does your practice set up AI disclosure and recording consent?

Hello Patient's agent can run two ways. In one, it introduces itself as your practice's AI. In the other, it doesn't say so out loud. Your practice chooses. Either way, the agent never pretends to be a person, and it never borrows a staff member's name to seem human.

Your practice sets the agent's recording consent prompts.

Each office keeps its own hours, rules, and consent prompt.

Patients tend to trust a line that is upfront about it, which is a good reason to have the agent introduce itself.

Does the agent need to be inside your dental practice management system to be compliant?

No. Compliance comes from the BAA and from how the agent handles the information. The agent is handling protected health information the moment a patient says their name and which tooth hurts, whether or not anything gets written into your system.

Hello Patient integrates with the EHR, practice management, and CRM systems healthcare already runs on, plus its own API. For a dental group, first ask Hello Patient to show how a booking reaches the live schedule. It can go through that API or through a booking link the patient taps.

Either way, what the agent needs from you is your schedule rules, the plans you accept, hours by office, and the rules for what it handles and what it escalates.

A new patient calls with a broken tooth. The agent takes the basics and writes down what happened. Where your schedule is connected through the API, it offers a time. Otherwise it texts the booking link the patient taps. It does not tell the patient the visit is set until the scheduling system confirms it.

The rest of the workflow is on our AI receptionist for dental practices page.

What to check before you put an AI receptionist on a dental line

Before anything else, get the signed BAA, and the SOC 2 Type 2 report with it. Then test the agent on the calls and texts your own front desk gets. When a family shares one number, how does the agent verify who's calling, and what does it do for minors? What does a recare text say, and what happens when a patient texts STOP? Find out how each office's disclosure and recording consent prompts get set. A booking has to reach your schedule while you watch, not on a slide. And ask what the log of a call looks like.

Pulse-MD, a multi-location urgent care group in New York, put the agent on its patient lines and cut missed calls from 26% to zero in its first 30 days. The setting is urgent care, not dental, and the Pulse-MD case study has the detail.

Find out whether Hello Patient fits your practice. Book a call and we'll show you, on the schedule you run today, which of those calls and texts the agent would take and where it would hand off to your team. Make sure to ask for a free demo agent to see how it will sound to your patients.

Frequently asked questions

Is an AI receptionist HIPAA-compliant for a dental practice?

It is when it follows HIPAA's rules for handling patient information and works under a signed BAA with your practice. Miss either one and it isn't. Hello Patient is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client. On a dental line, that covers the calls and texts that carry a patient's name, birth date, what the dentist found, and what a plan paid. The agent looks the patient up, books or moves the visit, and hands anything clinical to your team. Every interaction is logged, so your team can check what was said.

Can a HIPAA-compliant AI receptionist text dental patients about a cleaning that is due?

Yes. A recare text names the patient and the visit, so it counts as protected health information. It has to go out under a BAA, and only to patients your practice has consent to contact. Hello Patient's agent sends those texts using the wording and schedule your practice chooses, honors STOP the moment a patient sends it, and answers the reply in the same thread. When the patient says a Tuesday afternoon works, the agent books it there. If the reply turns clinical, the exchange goes to your team with the messages written down. Your practice sets what the first text says. Keep it to the fact that the patient is due and a question about timing.

Can an AI receptionist talk to a parent about a child's dental appointment?

Yes, once it has checked who it is talking to. The agent verifies the caller before it opens or discusses a record, usually by phone number and date of birth. On a shared family number, with the check set to phone number plus date of birth, the date of birth separates one child from another. Your practice sets how the agent handles a child's record and the guardian on the line, including any age gates. Within that rule, a parent can move a son's cleaning and ask about a daughter's visit on the same call. The agent runs the check for each child before it opens that child's record. If the details don't match, the agent passes the call to your staff instead of guessing.

Does a dental practice need a separate BAA for the AI receptionist if it has one with its practice management vendor?

Yes. HIPAA treats each vendor that handles patient information on your behalf as its own business associate, so each one signs its own BAA. The agreement with your practice management vendor covers what that vendor does with your data. It does not cover a different company answering your phones and texting your patients. Hello Patient signs a BAA with every client. Ask for it before the agent takes a single call.

Does the AI receptionist need write access to our dental practice management system?

No. Compliance does not depend on it. Hello Patient's agent handles a patient's information under the BAA from the moment the patient says their name, whether or not anything is written into your system. Bookings reach your schedule through Hello Patient's API or through a booking link the patient taps. The agent does not tell a patient the visit is set until the system confirms it. What the agent needs from your practice is the schedule rules, the plans you accept, hours by office, and the line between what it handles and what it escalates. Ask to see a booking land in a live demo.

Does an AI receptionist give dental patients advice about whether a tooth needs treatment?

No. The agent never gives medical advice, and that includes whether a tooth needs a filling, whether a crown is really necessary, or whether a sore spot can wait. When a patient asks, Hello Patient's agent writes down the question in the patient's own words and sends it to your team. Or it books the consult so the dentist can answer in the chair. It handles the parts around the question, like finding the record, offering a time, confirming the visit, and telling the caller whether their plan is accepted. Your practice draws the line between what the agent answers and what a clinician answers, and the agent follows that line on every call.

Can a multi-office dental group set different disclosure and consent prompts on one AI receptionist?

Yes. Each office keeps its own disclosure and consent setup on the same agent. Each office sets its recording consent prompts and decides whether the agent introduces itself as the practice's AI. Hello Patient signs a BAA with every client, and every interaction is logged. If your group runs its offices under more than one legal entity, raise that when you ask for the BAA. Your team sets the rule per office once, and the agent runs the right one on every call.