Which AI tools in a medical practice need to be HIPAA compliant?

Your practice may use AI in different places. A scribe may receive a visit recording. A patient may ask an agent about a bill. Staff may use an assistant to rewrite office hours that are public. The information each tool receives is different, so you need to review each use separately.

Hello Patient builds AI agents for healthcare. The agents handle patient conversations by voice, text, and inbound website chat. Scribes and general assistants do different jobs and may receive different information.

This page covers what to check for each kind of tool before you share patient information with it.

Does HIPAA prohibit a medical practice from using AI?

No. HIPAA does not prohibit a medical practice from using AI. If a tool receives protected health information, your practice still has to meet the HIPAA rules that apply to that information.

The Security Rule is technology neutral, so it does not single out any one technology. It requires administrative, physical, and technical safeguards for electronic protected health information, including a risk assessment. HHS explains the Security Rule.

For example, your staff may ask an assistant to rewrite public office hours without giving it patient information. Pasting an identifiable patient note into the same assistant is a different use because the tool now receives patient information.

This is not legal advice.

Which AI tools in a medical practice can receive patient information?

AI scribes, general AI assistants, phone and text agents, and website chatbots can receive patient information. Each one needs to be part of your review. A vendor outside your workforce doing qualifying work with protected health information is generally a business associate. HHS includes transcription services and patient-portal AI chatbots among its examples. HHS business-associate guidance.

AI scribes. A scribe may receive the visit recording and turn it into a transcript or note. Ask where the recording goes, where the transcript goes, and where the note goes. Review the audio too, not only the note that reaches the patient record.

General AI assistants. The assistant receives whatever staff put into it. Before staff use patient information, check which workspace, features, and connections the agreement covers.

Phone and text agents. The patient may share protected information in the conversation before the agent looks anything up. Check what the agent receives, what information it may access, and what it sends to staff.

Website chatbots. A visitor may type sensitive information into the first message. Check where that message goes and how the service handles it.

Does a BAA from ChatGPT or another general AI tool make it HIPAA compliant?

No. A business associate agreement (BAA) by itself does not make a tool HIPAA compliant. The BAA sets the permitted uses and responsibilities, so you need to check whether it covers the service and use your practice has in mind. HHS provides the required agreement provisions. The applicable safeguards and risk assessment still need to be in place. HHS explains those Security Rule requirements.

For ChatGPT, check the workspace, functionality, and setup your staff will use. OpenAI's coverage page says: “Features not listed here are not automatically covered under the BAA.” Its HIPAA-eligible products and functionality page supplies the current scope, checked October 1, 2026.

Staff may want an assistant to summarize a patient note through another connected service. The signed BAA does not automatically cover that outside connection. Check whether the service and connection are covered before staff share the note.

What patient information can phone and text agents use?

A phone or text agent can use the patient information that its service, permitted access, and setup allow. The Hello Patient agent checks the patient's identity first. Then, with the access your practice sets, it finds the patient's record and existing appointments, books, reschedules or cancels visits inside your scheduling rules, or looks up a balance.

Piedmont Urgent Care used a Hello Patient agent on its billing line to answer balance questions and send secure payment links. Read the Piedmont example.

Your practice decides what the agent handles and what goes to staff. You also choose how a conversation reaches your staff: a live transfer of the call, or a message to your team with what the patient said. The medical answering-service guide explains the phone workflow in more detail.

You can hear a demo agent or request a free demo agent for your practice.

What may a HIPAA-compliant website chatbot collect from patients?

A website chatbot may collect patient information only for the task your practice set up and only for the use the agreement covers. The applicable HIPAA duties and safeguards still apply. Signing a BAA alone does not let a chatbot collect as much patient information, or whatever kind of patient information, as it likes.

If the vendor qualifies as a business associate, the agreement must cover the service it is actually providing. HHS explains the contract requirements and applicable Security Rule safeguards.

A visitor may put their name, contact details, and reason for seeking care in the first message. That information has reached the service even if the visitor closes the chat after that message.

Ask the vendor to show you where that first message goes and explain how the agreement covers the service receiving it.

What should a practice ask each kind of AI vendor before sharing patient information?

Ask what happens to the patient information in the exact service you plan to use. You should be able to get a plain answer about what the tool receives, where the information goes, and what the agreement covers.

• Scribe: Where do recordings, transcripts, and notes go?
• General assistant: Which workspace, features, and connections does the BAA cover?
• Website chat: Where does the visitor's first message go?
• Phone or text agent: What may it look up, and what does it send to staff?

Then ask what happens if there is an incident. Business associates must report qualifying breaches of unsecured protected health information to the covered entity, so confirm who is responsible for reporting what under the contract. HHS breach-notification guidance.

The receptionist compliance checklist covers the fuller review, including SOC 2.

Find out whether Hello Patient fits your practice. Book a call. We'll go over the patient conversations you want the agent to handle. Ask for a free demo agent to hear how it would sound to your patients.

Frequently asked questions

Which AI agents are HIPAA compliant for a medical practice?

Hello Patient is a HIPAA-compliant option for agents that handle patient conversations. For other provider examples, see our healthcare voice-agent guide. Inclusion in the guide does not approve every product configuration. Check the service you plan to use, whether its BAA covers that use, and the applicable Security Rule safeguards. Hello Patient provides a BAA on every account. Before you choose a provider, ask it to show which patient conversations the agent receives and how the service and agreement cover that work.

Does an AI scribe need a BAA with the practice?

Generally, yes. A scribe vendor outside your workforce doing qualifying work with protected health information needs a BAA for that work; Hello Patient's agents handle separate patient conversations. HHS lists transcription services among its business-associate examples. Ask which services receive the recording, transcript, and note, and how the agreement covers each of them. If the scribe provider hires a subcontractor that is also a business associate, the scribe provider must arrange that subcontractor's agreement. A vendor your practice hires directly should be assessed as a separate provider. HHS describes the required contract provisions.

Does ChatGPT have a HIPAA compliant version a medical practice can use?

Yes. Hello Patient's agents are a separate kind of tool: they handle patient conversations. As checked October 1, 2026, eligible offerings include ChatGPT for Healthcare and ChatGPT Enterprise with Regulated Workspace. Using these ChatGPT offerings with patient information requires a signed BAA that applies, plus the eligible workspace, functionality, and configuration. Review OpenAI's current HIPAA-eligible products and functionality for your intended task. Before staff share identifiable patient information, confirm that the service and functionality they will use fall within the agreement's coverage.

Does a HIPAA compliant phone system's BAA cover the AI agent answering our practice's calls?

Not automatically. Hello Patient provides a BAA on every account; your phone provider's agreement is separate. If your practice hires the AI provider directly, assess that provider and its agreement separately. If the phone provider hires an AI provider that qualifies as its business-associate subcontractor, the phone provider must put the required agreement in place with that AI provider. HHS explains the contract requirements. Confirm which arrangement you have and which service each agreement covers. See how agents work with a practice phone system for the phone setup.

Does an AI tool for a medical practice have to be certified by HHS?

No. Hello Patient is SOC 2 Type 2 certified, and your practice and the AI vendor share the work of HIPAA compliance under the BAA. HHS does not endorse or recognize private Security Rule certifications, and they do not remove the applicable legal duties. Read HHS's explanation. Our receptionist compliance checklist explains SOC 2 alongside the other checks for a provider. Ask for evidence about the service's safeguards and agreement. Also ask which patient information the tool will receive and which use the agreement covers.

Can a HIPAA compliant AI agent text and chat with patients as well as answer calls?

Yes. Hello Patient handles patient conversations by voice, text, and inbound website chat, provides a BAA on every account, and logs every interaction. Website chat answers patients' questions and books visits. By call and text, the agent checks the patient's identity before it opens the record or changes a visit. Review what each channel receives and what the agreement permits. If another company also handles patient information for your practice, review the agreement for that arrangement. For electronic protected health information, applicable Security Rule safeguards still apply.