What makes an AI receptionist HIPAA-compliant at a primary care practice

The MA line at a primary care office rolls to voicemail when the MAs are in rooms with patients, and the messages pile up. A patient asks for her metformin refill and names the pharmacy she uses. A man asks whether his labs came back. A daughter reads out her father's date of birth so she can move his wellness visit. At one busy location, the refill requests alone run to 150 or 200 a day, and one receptionist takes them. Texts go out too, to the patients who are due for a visit, and the replies come back to the same team.

Every one of those calls and texts carries a patient's name and date of birth, and on a primary care line they often say what the patient is being treated for. That is protected health information, and HIPAA covers it in a text the same way it covers it on a call.

Hello Patient builds AI agents for patient conversations. On a primary care line, the agents act as an AI receptionist for primary care. They answer the calls and texts, find the patient's record, and book and move visits. They take refill requests and route them, and they text and call the patients who are due back. The agent follows HIPAA's rules and works under a signed Business Associate Agreement, a BAA. Hello Patient is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client.

Why a refill call at a primary care practice is protected health information

Because the medication says the diagnosis. "I need my metformin refilled" tells anyone listening that the patient is being treated for diabetes. In primary care terms, protected health information, or PHI, is the patient's name and date of birth. It is also the medication he takes, the test he had, the reason for the visit, and the insurance plan he is on.

Under HIPAA, a vendor whose agent takes those calls and texts is a business associate. It has to sign a BAA before it touches any of that information.

The trap is assuming that a capable-sounding AI is automatically a compliant one. A general-purpose AI or a consumer chatbot with no BAA is not compliant, no matter how polished it sounds on a call.

A BAA is a signed agreement where the vendor takes on legal responsibility for protecting PHI under HIPAA. It is not marketing. It is a binding contract with real obligations attached. A compliance badge on a website or a "HIPAA-ready" line in a sales deck is not the same thing. Those are claims. A BAA is proof.

Our guide to what makes an AI receptionist HIPAA-compliant walks through the BAA and SOC 2 Type 2 in full. This page is the primary care version.

What the agent does with a refill request, and with a call about a lab result

On a refill call it takes the request and routes it. On a result call it hands the patient to your staff.

The agent confirms who the patient is, usually by phone number and date of birth. It takes the medication and the pharmacy, and writes down anything the patient adds, like "can you make it 90 days." Then it routes the finished request to wherever your practice approves refills, whether that is a nurse queue, a ticket, or the pharmacy line. It never approves a refill, never tells the patient a refill is approved, and never discusses a dose. Controlled substances go straight to a human when your practice sets it up that way.

When a patient calls about a lab result, the agent does not read it out and does not answer "is that number OK." It hands the call to your staff with what the patient said, as a transfer during hours or a message after hours.

The agent stays in its lane. It answers questions about scheduling, hours, and insurance. It takes refill requests and routes the rest to your staff. It never gives medical advice. When a call turns clinical, urgent, or sensitive, it hands off to a real person with the full context, so the patient never has to start over.

It tells a caller whether her plan is accepted, Medicare and Medicare Advantage included. It does not answer benefits, coverage, copay, or cost questions. It watches the call for emergencies and escalates right away.

Every interaction is logged. That means each call leaves a record your team can check.

A patient on blood pressure medication calls for a refill and mentions "the dizziness" in the same breath. The agent takes the refill request and hands the dizziness to a human on your team, with her words written down. Your nurse gets a refill request ready to act on instead of a voicemail to decode.

When an adult child or caregiver calls about a patient on Medicare

The agent checks the details your practice chose before it opens or discusses anything on the patient's record. If the caller cannot give those details, it hands the call to your staff.

Your practice picks what the agent asks for, such as the phone number only, or the phone number and the date of birth, or more than that. The agent does not verify who is speaking beyond those details, and it does not check releases or paperwork. Your practice sets the rule for callers who act on a patient's behalf, and the agent follows it. The agent does not guess.

A daughter calls to move her father's wellness visit. She has his phone number and date of birth, she passes the check your practice set, and the agent moves the visit. Then she asks what his last A1c was. The agent does not answer that. It hands her to your staff with the question written down, and the person who picks up decides what she can be told.

Texting patients about a wellness visit or a chronic-care follow-up under the consent rules

Yes, the agent can text and call the patients who are due, and it does that inside the rules.

Texts and calls go out only to the patients your practice has consent to contact. STOP is honored the moment it is sent. Your practice decides what the texts say and how often they go out. Say a reply turns clinical, like "my sugar has been high, should I still come in." That one goes to your team with the messages written down.

Keep the text to the fact that the patient is due and a question about timing. Never put the condition, the test, or a lab value in the first text. Those details belong in the conversation the patient starts.

The patient replies "not Tuesdays." The agent offers Thursday and books it. Your team sees a booked wellness visit instead of a reply waiting for an answer. The agent does not carry a conversation from a call into a later text. How the recall list gets built and worked is on its own page, how primary care groups keep recall moving.

Hear how it sounds here or request a free demo agent for your practice today by booking a call.

Who signs the BAA when your group is on an enablement platform or runs more than one EHR

Hello Patient signs a BAA with every client, and the BAA has to be with the entity that holds the patient information.

Say your group is part of a physician enablement platform that handles vendor contracts for its member practices. Raise that when you ask for the BAA. If your offices run under more than one legal entity, say so too.

Compliance does not depend on which EHR an office runs. The agent handles protected health information the moment a patient says her name and her medication, whether or not anything is written into a chart. The EHR connection lets the agent find the patient's record or create one, book into the schedule under your rules, and leave a note on the appointment with what the patient said. Hello Patient integrates with the EHR, practice management, and CRM systems healthcare already runs on.

A group that grew by acquisition sometimes runs one system at one office and another at the next. Each office keeps its own rules on the same agent, like its hours, accepted plans, and refill routing. The rest of the workflow, from the first call to the recall list, is on our AI receptionist for primary care page.

How your practice sets AI disclosure and call recording consent

Hello Patient's agent can run two ways. In one, it introduces itself as your practice's AI. In the other, it doesn't say so out loud. Your practice chooses. Either way, the agent never pretends to be a person, and it never borrows a staff member's name to seem human.

Your practice sets the agent's consent prompts for call recording.

What to check before you put an AI receptionist on a primary care line

Check these, in this order.

• The signed BAA, before anything else, with the right entity on it.
• The SOC 2 Type 2 report.
• What the agent does with a refill request, and with a call about a result.
• How it checks a caller who is not the patient.
• What a wellness-visit text says, and what happens when a patient texts STOP.
• How each office's disclosure and recording consent prompts are set.
• A booking that reaches your schedule while you watch.
• What the log of a call looks like.

Then bring your own calls to the demo. The refill with the dizziness. The daughter asking about the A1c.

Pulse-MD, a multi-location urgent care group in New York, put the agent on its patient lines, and the agent handled 4,886 patient interactions in its first month. The setting is urgent care, not primary care, and the Pulse-MD case study has the detail.

Find out whether Hello Patient fits your practice. Book a call and we'll show you what the agent does with a refill call at your practice, from the first hello to the log, and where it fits with the EHR you run today. Make sure to ask for a free demo agent to see how it will sound to your patients.

Frequently asked questions

Does a primary care practice need a new privacy notice or patient consent to put an AI receptionist on its phones?

Usually no, and your compliance lead confirms it for your practice. HIPAA lets a practice share patient information with a business associate that has signed a BAA. That is how your patient portal vendor, your billing company, and an answering service work today, and a standard notice of privacy practices describes that use. The agent adds one more business associate and one more BAA. Hello Patient is HIPAA-compliant, SOC 2 Type 2 certified, and signs a BAA with every client. Before the agent takes its first call, ask which entity is named on the BAA and file it with the rest of your vendor agreements.

Can an AI receptionist read a lab result to a primary care patient?

No. A patient who calls to ask whether her bloodwork came back, or whether a number is normal, gets handed to your staff. Hello Patient's agent never gives medical advice, and it does not read or deliver a result. It takes the call, confirms who the patient is, and writes down the question in her words. Then it passes that to your team, as a live transfer during hours or a message after hours. The clinician then decides what the patient is told and how. The patient does not have to start over, and nobody at your practice has to guess what she called about.

Can an AI receptionist talk to a patient's adult child or caregiver about a Medicare patient's appointment?

Only after the caller passes the check your practice set. Your practice decides what Hello Patient's agent asks for, such as the phone number only, or the phone number and date of birth. The agent runs that check before it opens or discusses anything on the patient's record. It does not verify who is speaking beyond those details, and it does not check releases or paperwork. A caller whose details do not match a record goes to your staff, because the agent does not guess. A daughter who passes the check can move her father's wellness visit. A question about his results goes to a human.

What can a HIPAA-compliant AI receptionist put in a text to a primary care patient who is due for a wellness visit?

The fact that the patient is due, and a question about timing. That is the whole first text. Hello Patient's agent never puts the condition, the test, or a lab value in an outbound message; those details belong in the conversation the patient chooses to start. Texts go out only to the patients your practice has consent to contact, and STOP is honored the moment it is sent. When the patient replies, the agent answers in the same thread, offers open times, and books the visit right there. A reply that turns clinical goes to your team with the messages written down. Your practice sets the wording of the texts and how often they go out.

Who signs the BAA when a primary care practice is part of a physician enablement platform?

The entity that holds the patient information, and that is the detail to settle before the agent takes a call. Hello Patient signs a BAA with every client. When a practice sits inside a physician enablement platform, the platform sometimes contracts vendors for its member practices, and sometimes the practice contracts on its own. Raise that when you ask for the BAA, so it gets signed at the right level. If your offices run under more than one legal entity, say that too. On the first call, ask which entity will be named on the BAA.

Does an AI receptionist need access to a primary care practice's EHR to be HIPAA-compliant?

No. Compliance comes from the signed BAA and how the patient's information is handled. The agent handles protected health information the moment a patient says her name and her medication, whether or not anything is written into a chart. The EHR connection lets the agent do the work inside your system. Hello Patient's agent finds the patient's record or creates one, books the visit into your schedule under your rules, and leaves a note on the appointment with what the patient said. It integrates with the EHR, practice management, and CRM systems healthcare already runs on. A group that grew by acquisition and runs two EHRs keeps each office's own rules on the same agent.