If you run a dental or orthodontic practice, choosing a HIPAA-compliant AI receptionist raises an obvious question:
What happens to patient information when the AI answers the call? That question matters.
A patient might provide their name, phone number, date of birth, insurance details, treatment information, or other health information during a conversation. Once a technology vendor creates, receives, maintains, or transmits protected health information (PHI) on behalf of a healthcare provider, Health Insurance Portability and Accountability Act (HIPAA) requirements may apply.
So before choosing an AI receptionist for a dental practice, practices should look beyond a vendor's homepage and ask how the system actually protects patient data.
"Yes, we're HIPAA compliant" is not much of an explanation.
A trustworthy vendor should be able to explain the contracts, controls, encryption, access policies, and audit processes behind that statement.
The first question is whether the AI vendor is acting as a business associate.
Under HIPAA, a business associate is generally a company that performs services for a covered healthcare entity that involve creating, receiving, maintaining, or transmitting PHI. When that relationship exists, the practice generally needs a Business Associate Agreement (BAA) with the vendor.
A BAA is more than paperwork.
It defines what the vendor may do with PHI and requires appropriate safeguards. It also addresses responsibilities around security incidents and certain breaches. If a vendor uses subcontractors that handle PHI, those relationships need appropriate contractual protections as well.
That means a practice evaluating an AI receptionist should ask directly:
Will you sign a BAA with our practice?
If the answer is unclear, pause before connecting the system to patient information.
Encryption gets a lot of attention, and for good reason. But HIPAA security is broader than simply encrypting a database.
The HIPAA Security Rule requires appropriate administrative, physical, and technical safeguards for electronic protected health information. Those safeguards include controls around access, authentication, audit activity, transmission security, and the integrity of electronic information.
A covered practice also has its own risk-analysis responsibilities; signing a BAA does not replace assessing the risks in its proposed AI workflow.
In practical terms, a practice should want to know:
Those questions tell you much more than a compliance badge on a website.
For an AI receptionist, patient information can move through several stages. A caller speaks to the system. Information is transmitted to the technology processing the conversation. Relevant information may then be stored or passed to another system, such as scheduling or practice-management software.
Every point where data is transmitted or stored deserves attention.
That distinction matters. Encryption in transit helps protect information while it moves between systems. Encryption at rest protects stored information.
Practices should ask vendors to explain both rather than simply saying, "Your data is encrypted." It is also worth remembering that HIPAA does not simply say every organization must use one specific encryption technology in every situation.
Under the current Security Rule, encryption is an addressable implementation specification. That does not make it optional: organizations must assess whether it is reasonable and appropriate and implement it when it is. If it is not, they must document why and implement an equivalent alternative measure when reasonable and appropriate.
For a vendor handling sensitive patient information, however, asking exactly what encryption is used is still a basic part of evaluating security.
Imagine an AI receptionist stores information from thousands of patient conversations. Who inside the vendor's organization can see it? The answer should not be "anyone who needs it."
HIPAA requires technical access controls designed to allow only authorized individuals to access systems containing electronic PHI. It also requires authentication and audit controls. That means practices should ask vendors:
A good answer should be specific. Access should be limited according to role and business need, rather than broadly available across an organization.
Security is not just about preventing unauthorized access. You also need visibility into what happened.
HIPAA's technical safeguards include audit controls that record and examine activity in systems that contain or use electronic PHI. For a dental practice, that raises an important vendor question:
What activity is logged, and how can we review it if there is a security concern? A vendor should be able to explain what system activity is recorded, how those records are protected, and how incidents are investigated.
This is especially important when an AI system interacts with patient information automatically. The practice should not have to rely entirely on guesswork if something goes wrong.
One question often gets overlooked: What happens to patient data when we stop using the service?
A practice should understand how the vendor retains, returns, deletes, or otherwise handles information at the end of the relationship. The BAA must require the return or destruction of PHI at termination if feasible. If that is infeasible, its protections must continue for retained PHI, with further uses and disclosures limited to the purposes that make return or destruction infeasible.
Ask the vendor:
These answers help you understand the actual risk.
If your practice is evaluating AI phone answering, use the sales conversation to begin a security review.
Ask:
The goal isn't to turn every practice manager into a cybersecurity specialist. It is to make sure the vendor can answer basic questions about how patient information moves through its system.
Newo uses 256-bit encryption for conversation data, including recordings, transcripts, and structured data. Newo also signs a BAA before processing PHI and makes detailed security documentation available under a nondisclosure agreement. Practices should request those documents and confirm the protections that apply to their proposed workflow.
But encryption is only one part of the picture. A practice considering an AI receptionist should also review the vendor's BAA, access controls, audit processes, data retention policies, subcontractors, incident response procedures, and overall security documentation.
That is the right way to evaluate any vendor handling PHI, and Newo can provide all of it!
Healthcare practices have every reason to be cautious about AI. An AI receptionist is not just answering generic business calls. Depending on the workflow, it may interact with information that patients expect their healthcare provider to protect.
That makes the vendor relationship worth examining carefully. The strongest vendors should be comfortable explaining what happens to patient data from the moment a caller speaks to the AI through storage, access, transmission, auditing, and eventual deletion.
Before choosing a HIPAA-compliant AI receptionist, ask for the BAA and security documentation, and review them against the patient information your practice will share.