What makes an AI receptionist HIPAA-compliant at an ENT practice

A referral comes over from a primary care office, and the patient calls that afternoon, before anyone has entered it. The referring office calls back later for the note. A mother calls about her son's ear tubes. A hearing-aid patient calls about her order, and an allergy patient asks when her next shot is due.

Every one carries a name, a date of birth, and the reason the patient is being seen. A good part of that information reached your office from another practice before the patient ever called you. You protect it the same way, whoever collected it first.

Hello Patient builds AI agents for patient conversations. On an ENT line, the agents act as an AI receptionist for ENT practices. They answer the calls and texts your front desk cannot get to, book and move visits under your rules, take refill requests, and run reminders and recall outreach.

Two things make that compliant. The agent follows HIPAA's rules, and the vendor behind it works under a signed BAA. Hello Patient is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client.

The rest of this page is what that looks like on the calls an ENT office gets.

A referral reaches your ENT office before the patient calls

It is protected health information from the moment it lands, even though your office did not collect it from the patient.

The referral carries the patient's name, her date of birth, and the reason the doctor is sending her, whether that is hearing loss, chronic sinusitis, or something the doctor wants looked at. HIPAA lets one practice send that to another for treatment, and once it is with you, it is yours to protect. All of that is PHI, protected health information, and so are the medication, the plan the patient is on, and the referral itself.

Under HIPAA, a vendor whose agent answers those calls and texts is a business associate, and it has to sign a BAA before it handles any of that information.

The trap is assuming that a capable-sounding AI is automatically a compliant one. A general-purpose AI or a consumer chatbot with no BAA is not compliant, no matter how polished it sounds on a call.

A BAA is a signed agreement where the vendor takes on legal responsibility for protecting PHI under HIPAA. It is not marketing. It is a binding contract with real obligations attached. A compliance badge on a website or a "HIPAA-ready" line in a sales deck is not the same thing. Those are claims. A BAA is proof.

The full walkthrough of the BAA and SOC 2 Type 2 is on what makes an AI receptionist HIPAA-compliant. This page is the ENT version.

Say the patient calls before the referral is in the system. The agent looks for her record, does not find one, creates one from what she gives it, and books the visit under your rules. She is a patient with information to protect either way, whether the referral got there first or she did.

What the agent does with a patient's information on an ENT call

The agent handles that information under the BAA, logs the call, and stays inside the questions it is meant to answer.

The agent stays in its lane. It answers questions about scheduling, hours, and insurance. It takes refill requests and routes the rest to your staff. It never gives medical advice. When a call turns clinical, urgent, or sensitive, it hands off to a real person with the full context, so the patient never has to start over.

Every interaction is logged. That means each call leaves a record your team can check.

The agent tells a caller whether her plan is accepted. It works from the list your practice gives it, and that list can differ by office. It does not answer benefits, coverage, copay, or cost questions. When it creates a record, it does not collect insurance card details, payment information, or clinical history. It watches for emergencies and escalates right away. It does not diagnose, and it does not triage beyond the red-flag conditions your practice sets.

Take sudden hearing loss. A caller says she woke up and one ear has gone quiet. Your practice puts that on the red-flag list, so the agent stops booking, gets her to a person, and sends her words with her.

Compliance does not depend on which system your office runs. The agent handles protected health information the moment a caller says her name and why she is calling, whether or not anything is written into a chart. Through the connection to your system, the agent finds her record or creates a new one. It books the visit into your schedule under your rules. It leaves a note on the appointment with what she said. Hello Patient integrates with the EHR, practice management, and CRM systems healthcare already runs on.

Records requests and prior authorizations: what leaves your office

The agent takes the request and hands it to your staff. It does not send records, and it does not read a chart to a caller.

A records request is a release, and a release has its own paperwork and its own person at your practice.

Prior authorization is the other one that comes up on an ENT line, because a call about an authorization for a sinus procedure or for immunotherapy names the diagnosis out loud. The agent takes what the caller says, writes it down, and routes it to your staff. It does not work the authorization, and it does not answer benefits or coverage questions. The information is handled under the BAA the whole way, and the call is logged.

The same goes for the note the referring office wants back. Someone there calls to ask whether the patient was seen and to have the note sent over. The agent takes the name and the request and routes it to the person who handles records. It does not confirm anything about the visit on that call.

When a parent calls about a child's ear tubes or tonsils

The agent runs the check your practice set before it opens or discusses anything on the child's record, and your practice sets the rule for who can act for a minor.

You pick the details it asks for, such as the phone number only, or the phone number and the date of birth, or more. How a minor and a guardian are handled, and any age gate, are settings your practice defines.

It does not verify who is speaking beyond those details, and it does not check custody paperwork or releases. A caller whose details do not match a record goes to your staff, because the agent does not guess.

A mother calls to move her son's consult for ear tubes. She passes the check, and the agent moves the visit. Then she asks whether the ear infections he keeps getting mean he needs the tubes. The agent does not answer that. It hands her to your staff with the question written down, and the person who picks up decides what she can be told.

Hearing aids and allergy shots leave a record trail of their own

They do, and those records are patient information like everything else on the line. A hearing-aid order says the patient has hearing loss. An allergy-shot schedule says what she is treated for. Neither one is less protected because it feels routine.

Those calls come to the same number as the rest, and the texts go out under the same rules. Texts and calls go only to patients your practice has consent to contact. STOP is honored the moment it is sent. You decide what the messages say and how often. When a patient replies, the agent answers in the same thread and books the visit there. A reply that turns clinical goes to your team with the messages written down.

Keep the message to the fact that the patient is due and a question about timing. The device, the condition, and the test belong in the conversation the patient starts, not in a text that lands on a shared phone.

The agent texts a patient that her audiology follow-up is due. She replies "not Fridays." The agent offers Tuesday and books it. Your team sees a booked visit instead of a reply waiting on someone. The agent does not carry a conversation from a call into a later text. Each channel is complete on its own.

The rest of what the agent does on an ENT line is on our AI receptionist for ENT page.

Hear how it sounds here or request a free demo agent for your practice today by booking a call.

Telling ENT patients it is an AI, and recording the call

Your practice sets the AI disclosure and recording consent prompts for each office.

Hello Patient's agent can run two ways. In one, it introduces itself as your practice's AI. In the other, it doesn't say so out loud. Your practice chooses. Either way, the agent never pretends to be a person, and it never borrows a staff member's name to seem human.

An ENT and audiology practice has a lot of older patients on the line, and some are on it because they cannot hear well. A disclosure and a consent prompt only work if the caller catches them. You write the line the agent says at the top of the call. Write it slower and plainer than you normally would, then read it out loud before it goes live.

What to check before you put an AI receptionist on an ENT line

Start with the signed BAA, with the right entity on it. Then the SOC 2 Type 2 report.

The rest is operational. What the agent does with a referral that arrives before the patient calls. What it does with a records request, and with the note the referring office wants back. How it checks a parent calling about a child. What an audiology or allergy text says, and what happens when a patient texts STOP. How each office's AI disclosure and recording consent prompts get set. Whether a booking reaches your schedule while you watch. What the log of a call looks like.

Then bring your own calls to the demo, like the referral nobody has entered, the mother asking whether her son needs the tubes, and the caller who says one ear has gone quiet.

Ortho1 Medical Group, a three-location orthopedic group in the San Diego area, put the agent on its referral outreach. It texted referred patients and booked 190 visits in two months, with no staff added. The setting is orthopedics, not ENT, and the Ortho1 case study has the detail.

Find out whether Hello Patient fits your practice. Book a call and we'll show you what the agent does with a referral call at your practice, from the first hello to the log, on the system you run today. Make sure to ask for a free demo agent to see how it will sound to your patients.

Frequently asked questions

Is a referral an ENT practice receives from another doctor's office protected health information?

Yes, from the moment it arrives, even though the practice did not collect it from the patient. The referral carries the patient's name, the date of birth, and the reason the primary care doctor is sending her. HIPAA lets one practice send that to another for treatment, and it is protected on both ends. So a vendor whose agent answers the call when that patient rings is a business associate under HIPAA, and it has to sign a BAA before it handles any of that information. Hello Patient is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client.

Can an AI receptionist take a medical records request at an ENT practice?

Hello Patient's agent takes the request and routes it. It does not send records, and it does not read a chart to a caller. A release of records is the practice's own process, with its own paperwork and its own person, and that does not change when an agent answers the phone. The agent writes down who called and what was asked for, then gets it to the person at your practice who handles releases. The same goes for the note a referring office wants back after a visit. Every one of those calls is logged, so your team can check what was said.

Can an AI receptionist talk to a parent about a child's ear tube surgery?

Only after the caller passes the check your practice set. With Hello Patient, the verification factors are settings you define, and so is how a minor and a guardian are handled, including any age gate. The agent does not go past those details. It does not check custody paperwork or releases, and a caller whose details do not match a record goes to your staff instead. A parent who passes the check can move or cancel the child's visit. A clinical question, like whether repeat ear infections mean the child needs tubes, goes to a person on your team with the question written down.

Does an AI receptionist need access to your practice management system to be HIPAA-compliant at an ENT practice?

No. Compliance comes from the signed BAA and from how the patient's information is handled, not from which system the agent connects to. Through the connection, Hello Patient's agent finds the patient's record or creates a new one. It books the visit into your schedule under the rules your practice set. It leaves a note on the appointment with what the patient said. Hello Patient integrates with the EHR, practice management, and CRM systems healthcare already runs on.

What can a HIPAA-compliant AI receptionist put in a text to an ENT patient who is due for an allergy shot?

The fact that she is due, and a question about timing. Not the condition, the medication, or the device. A text can land on a phone somebody else is holding, so that detail belongs in the conversation the patient starts. Texts go only to the patients your practice has consent to contact, and STOP is honored the moment it is sent. When she replies, the agent answers in the same thread and books the visit there. If the reply turns clinical, it goes to your team with the messages written down.

Who signs the BAA when an ENT group runs audiology under a separate legal entity?

The entity that holds the patient information. Hello Patient signs a BAA with every client, and the agreement has to name the right party, which is easy to miss when a group runs its audiology or hearing-aid side under its own legal entity. If yours does, say so when you ask for the BAA, so it gets signed at that level too. Ask which entity will be named before the agent takes a single call. It is a short question at the start and a slow one to sort out later.