There is no HIPAA certification you can buy for an AI receptionist, and any vendor that claims to be “HIPAA certified” is describing something that does not exist. Compliance is a state a dental practice and its vendor reach together, and it rests on a short list of concrete controls: a signed Business Associate Agreement, encryption in transit and at rest, access controls with audit logs, minimum-necessary data collection, clear retention and deletion, and a documented breach process. This is the checklist to run before you put any AI front desk on your website, for practice owners in the US and other regulated markets.
A note up front. This is a checklist to work through with the vendor and your own compliance advisor. It is not legal advice, and requirements differ by region.
Is there a HIPAA-compliant AI receptionist?
Yes, in the sense that an AI receptionist can be operated in a HIPAA-compliant way. No, in the sense that HIPAA compliance is never a fixed product badge. HIPAA is a set of obligations that fall on your practice as a covered entity, and on any vendor that handles protected health information on your behalf as a business associate. An AI receptionist that books appointments and answers patients handles that information, so it sits inside your compliance perimeter.
So the real question is not “is this tool HIPAA compliant,” but “can this vendor meet each requirement below, and put it in writing.” The rest of this article is how to reach a defensible yes.
HIPAA in one minute for a dental practice
A few definitions make the checklist easier to apply.
- Covered entity. Your dental practice, if you transmit health information electronically in connection with billing and claims. Most practices are covered entities.
- Business associate. A vendor that creates, receives, maintains, or transmits protected health information on your behalf. An AI front desk that stores patient conversations is a business associate.
- Protected health information (PHI). Individually identifiable health information, including a patient’s name tied to an appointment reason, contact details, and any images they share.
- The rules that matter here. The HIPAA Privacy Rule governs how PHI may be used and disclosed. The Security Rule sets safeguards for electronic PHI. The Breach Notification Rule sets what happens if data is exposed. The HHS Office for Civil Rights enforces all three.
Source: U.S. Department of Health and Human Services, HIPAA for Professionals, 2013.
The checklist: what a HIPAA-compliant AI receptionist must have
Work through every row with the vendor. Get the answers in writing, scoped to your market.
| Requirement | What to confirm | HIPAA anchor |
|---|---|---|
| Business Associate Agreement | The vendor will sign a BAA before any patient data flows | 45 CFR 164.504(e) |
| Encryption in transit | Patient data is encrypted while moving between the patient, the widget, and the vendor | 45 CFR 164.312(e) |
| Encryption at rest | Stored conversations and images are encrypted | 45 CFR 164.312(a)(2)(iv) |
| Access controls | Unique user IDs, role-based access, and authentication for anyone who can see PHI | 45 CFR 164.312(a)(1) |
| Audit logs | The system records who accessed what and when | 45 CFR 164.312(b) |
| Minimum necessary | The tool collects and exposes only the data needed to book and triage | 45 CFR 164.502(b) |
| Retention and deletion | Documented retention periods and a deletion process on request | Privacy Rule, market-specific |
| Breach notification | A defined process to notify you if data is exposed | 45 CFR 164.400 to 414 |
1. A signed Business Associate Agreement
This is the non-negotiable first step. Under HIPAA, a covered entity may share PHI with a business associate only under a written contract that binds the vendor to safeguard it. No BAA, no lawful data sharing, whatever the software does. Ask directly whether the vendor will sign one and show you the template. A vendor that hesitates here is answering the question for you.
Source: U.S. Department of Health and Human Services, HIPAA Privacy Rule, 45 CFR 164.504(e), 2013.
2. Encryption in transit and at rest
Confirm patient data is encrypted both while moving and while stored. One nuance most articles get wrong: under the Security Rule, encryption is an “addressable” implementation specification, not a flat requirement. Addressable does not mean optional. It means the vendor must either implement it or document a reasonable, equivalent alternative and why. In practice, for a cloud AI receptionist handling dental PHI, there is no good reason not to encrypt, so treat missing encryption as a red flag rather than a permitted choice.
Source: U.S. Department of Health and Human Services, HIPAA Security Rule, 45 CFR 164.312, 2013.
3. Access controls and audit logs
Two controls, one purpose: knowing only the right people see PHI, and being able to prove it. Confirm unique user IDs, role-based permissions, and authentication for every account that can read conversations or images, plus audit logs of access. If a patient ever asks who saw their information, or if OCR does, logs are how you answer.
4. Minimum necessary and minimal collection
HIPAA’s minimum-necessary standard says you should use only the PHI needed for the task. For an AI front desk, that means collecting what it needs to book and triage, and no more. Ask what fields are captured by default, whether that can be trimmed, and whether free-text conversations are stored in full or summarized. This is the row where the intake data a front desk tool collects deserves a line-by-line read, because default field sets are usually generous.
Source: U.S. Department of Health and Human Services, HIPAA Privacy Rule, 45 CFR 164.502(b), 2013.
5. Retention, deletion, and where data lives
Get specifics in writing: how long conversations and images are kept, how deletion works, and where the data is stored. Location matters, and not in the way most articles put it. HIPAA is a United States law. A practice in the UK, the UAE, or South Africa is not covered by it at all, and is governed instead by its own regime: UK GDPR and the Data Protection Act 2018, the UAE’s health data rules, or South Africa’s POPIA. A vendor’s US paperwork does not answer for any of them. One set of controls rarely satisfies every market, so confirm the terms for yours.
6. A breach process you can rely on
If PHI is exposed, the Breach Notification Rule sets what must happen and when. Your vendor’s job is to identify a breach and tell you fast enough that you can meet your own obligations. Ask about their notification timeline and how they define an incident.
Source: U.S. Department of Health and Human Services, Breach Notification Rule, 45 CFR 164.400 to 414, 2013.
The questions AI adds that a phone system never did
A traditional answering service raised one set of questions. An AI receptionist built on large language models raises a few more, and this is where due diligence often stops too early.
- Training on your patients’ data. Ask plainly whether patient conversations or images are used to train or improve any AI model, and require the answer in your agreement. “We do not train on your data” is a sentence that belongs in writing, not a sales call.
- The model provider behind the tool. Many AI products call a third-party model that may itself be a subprocessor touching PHI. Ask who the subprocessors are and whether the BAA chain covers them.
- Prompt and conversation logs. LLM systems often log inputs for debugging. Confirm whether those logs contain PHI, how long they persist, and who can read them.
- Human review. If humans review conversations to improve quality, that is access to PHI. It needs the same controls and disclosure as any other access.
These are not reasons to avoid an AI front desk. They separate a vendor who has thought about dental PHI from one who has not. They are also worth settling early, while you are still scoping how much of a dental front desk can be automated in the first place.
How cOpilot approaches patient data
cOpilot is scanO’s dental front desk. It answers patients, books appointments, and collects intake on your website and messaging channels. Because it handles patient conversations, and on the Pro plan patient-submitted photos, data handling is designed in rather than bolted on, with encryption and access controls as the baseline.
What we will not do is wave a compliance badge. Compliance is market-specific and shared between your practice and your vendors. So the honest step for a practice evaluating cOpilot is to ask the scanO team for the current data-handling terms and any agreements available for your region, including a BAA where it applies, and review them with your own advisor before going live. The checklist above is the same one we would expect a practice to run us through.
If you want the wider context first, our overview of dental HIPAA compliance covers the ground beyond the front desk.
Screening, patient photos, and the line that never moves
Pro-plan conversations can include a patient photo. cOpilot flags what may warrant review and suggests an urgency level so the team knows who to see first. Those images are PHI. They carry the same encryption, access-control, and retention obligations as the rest of the conversation, so confirm the specifics for your market.
One thing does not move, in the product or in the copy. cOpilot screens and guides. It does not diagnose. The screening output is triage support to help a practice prioritize care. Every clinical decision belongs to the dentist. The tool exists to give the clinical team cleaner, faster information, never to stand in for their judgment.
Frequently asked questions
Is there a HIPAA-certified AI receptionist?
No. HIPAA has no certification program for products. An AI receptionist can be operated compliantly when the vendor signs a BAA and meets the Security Rule safeguards, but “HIPAA certified” as a product claim is not a real status.
Does a dental practice need a BAA with its AI receptionist vendor?
Yes, if the tool handles PHI. Under HIPAA a covered entity may share PHI with a business associate only under a written agreement. Confirm the vendor will sign one before any patient data flows.
Is encryption required under HIPAA?
Encryption is an addressable specification under the Security Rule, which means it must be implemented or a documented equivalent used instead. For a cloud AI receptionist handling dental PHI, treat encryption in transit and at rest as expected, and treat its absence as a red flag.
Is cOpilot HIPAA compliant?
Compliance is market-specific and a shared responsibility, so the accurate step is to confirm the current terms and any required agreements with the scanO team for your market, then review them with your own advisor before going live. cOpilot is built to handle patient data with encryption and access controls.
Does cOpilot use patient conversations to train AI?
Ask the scanO team for the written terms that apply to your market, since this is exactly the kind of commitment that belongs in your agreement rather than a summary. Requiring a clear answer in writing is good practice with any AI vendor.
Run the eight rows of that table against every vendor on your shortlist, including us, and keep the answers in one document your advisor can read in a sitting. When the paperwork is settled and you want to judge the front desk on what it actually does, see what an AI receptionist does on a dental website.