Can a medical office use an AI receptionist?
Yes, if the vendor signs a HIPAA business associate agreement, the AI follows a written triage rule that sends anything urgent to a person, and it never gives clinical advice, discusses results or confirms who is a patient. Some AI receptionist vendors state HIPAA compliance and include a signed agreement. At least one says plainly that it is not HIPAA compliant and cannot handle protected health information. Below is what each vendor's own page says, the rule that decides who qualifies, what an AI receptionist may and may not say to a patient, and what it costs.
The short version
- A medical practice is a HIPAA covered entity. A vendor that takes patient calls on its behalf is a business associate, and the practice must obtain written assurance that it will safeguard the information before it handles a single call.
- AgentZap says a signed business associate agreement is included and that it books into the EHR. Goodcall calls itself HIPAA-compliant AI software. Weave says its AI Receptionist is designed to meet HIPAA standards. Ruby's live service lists HIPAA-compliant options.
- Smith.ai states on its medical page that it "is not HIPAA-compliant and cannot handle protected health information (PHI) in regulated healthcare environments."
- The AI should book, reschedule, take refill request details, answer hours and directions, and route. It should never triage beyond a written rule, discuss results, or confirm that someone is a patient.
- Published prices for vendors that state HIPAA compliance start at $79 to $109 a month.
What may a medical AI receptionist say, and what must it never say?
Start with the call that scares practice managers, because it is the one the setup has to get right: 8:15 pm, a patient calls about a new symptom.
| Request | AI receptionist | Person |
|---|---|---|
| Book, reschedule or cancel an appointment | Yes, after verifying name and date of birth | Yes |
| Hours, location, parking, which insurance you accept | Yes, from approved answers | Yes |
| Prescription refill request | Collects medication, dosage, pharmacy and patient details, then routes to clinical staff | Reviews and acts |
| "Are my results back?" | No. Takes a message for the clinical team | Yes, per practice policy |
| "Should I take a second dose?" | No. Routes to the nurse line or on-call provider | Yes |
| Symptom that matches the urgent list | Routes to on-call immediately; 911 line for emergencies | Yes |
| A relative asking whether someone is a patient | No. Takes a message | Only as the practice's policy allows |
Two habits keep this safe. First, the AI verifies identity before it touches anything specific, so an appointment time is never read to the wrong caller. Second, it collects rather than answers on anything clinical. A refill request is a form to fill in, not a decision to make.
Is an AI receptionist HIPAA compliant?
Only when the vendor takes on the role in writing. Under the HIPAA rules at 45 CFR 160.103, a business associate is, with respect to a covered entity, a person who "creates, receives, maintains, or transmits protected health information for a function or activity regulated by this subchapter" on the covered entity's behalf, other than as a member of its workforce. Software that takes a patient's name, date of birth and reason for calling and writes an appointment into your system is doing exactly that.
The obligation then sits with the practice. Under 45 CFR 164.502(e)(1)(i), "a covered entity may disclose protected health information to a business associate and may allow a business associate to create, receive, maintain, or transmit protected health information on its behalf, if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information." That assurance is the business associate agreement. No agreement, no calls.
Two things follow. A vendor's HIPAA claim is a starting point, not the finish; the agreement, the encryption, the access controls and what the AI is allowed to say all matter. And a vendor that says it is not HIPAA compliant is doing you a favor by saying so early.
This is a plain-language reading of the regulation, not legal advice. Your compliance officer should review the agreement and the call scripts before anything goes live.
Which AI receptionist vendors say they are HIPAA compliant?
Every line below is taken from the vendor's own website, read on September 20, 2026. We have not used these products or reviewed their agreements. Where a page does not mention HIPAA, we say so; that is not a finding that the vendor cannot comply, only that you have to ask.
| Vendor | What its page says about HIPAA and medical calls | Published price |
|---|---|---|
| AgentZap | "Signed BAA included," with TLS and AES-256 encryption, access controls and audit logging. Its medical page describes appointment scheduling, urgency triage on protocols, routing emergencies to on-call providers, collecting prescription refill details for clinical staff, and integration "with Epic & more." | $109 a month for 150 minutes, $0.85 a minute after; $499 setup fee |
| Goodcall | A May 2026 post on its site calls Goodcall "HIPAA-compliant AI software" with encryption, secure access controls and dedicated secure data storage. Its pricing page does not mention HIPAA, so ask about the agreement. | $79 a month per agent for 100 unique callers, unlimited minutes |
| Weave | Its AI Receptionist page says it "has been designed to meet and exceed the standards of HIPAA." Weave sells a medical practice platform with PMS integrations; automatic booking by the AI is listed "for qualified Dental PMS only," with appointment requests captured for staff to schedule elsewhere. | Platform from $199 a month; the AI Receptionist add-on has no published price |
| Ruby (live) | Live human receptionists 24/7; "HIPAA-compliant services available." | $250 a month for 50 minutes up to $1,725 for 500 |
| Smith.ai | Its medical and wellness page states: "Smith.ai is not HIPAA-compliant and cannot handle protected health information (PHI) in regulated healthcare environments." It positions the service for veterinary clinics and wellness businesses that do not need HIPAA compliance. | AI plan free for 25 calls, then $150 a month for 75 |
| Dialzara, Rosie, Frontdesk | No HIPAA statement on the pricing pages we read. Ask before assuming either way. | From $29, $49 and $99 a month |
| LeadSixty | An AI receptionist we build and run for you, with the triage rule, identity check and call scripts written with your practice. We are the authors of this post. | First 30 days free, then $297 a month flat, no setup fee; see pricing; ask us about a business associate agreement |
A note on vendor statistics. Medical AI receptionist pages quote figures such as the share of medical calls that go unanswered or the lifetime value of a new patient, sometimes with a source name and no link. We could not trace them to a primary source and have not used them.
Want the triage rule, identity check and booking set up for your practice, and tested before a patient hears it? On a free 30-minute Where AI Fits call we look at your call volume by hour, your scheduling system, and which calls must reach a person. If a self-serve tool with a signed agreement is the right answer, we will say so.
Book a Where AI Fits callHow much does a medical AI receptionist cost?
Among vendors that state HIPAA compliance, published plans start at $79 a month (Goodcall) and $109 a month (AgentZap, plus its $499 setup fee). Weave prices its platform from $199 a month and the AI add-on by quote. Ruby's live, HIPAA-compliant option runs $250 to $1,725 a month by minutes. For the full picture, with 40-call and 100-call examples, see how much does an AI receptionist cost?, and for live services, medical answering service pricing. A note on the "in-house receptionist costs $77,000" claim on several vendor pages: the Bureau of Labor Statistics median receptionist wage is $38,010 a year, as we set out in AI receptionist versus human receptionist, so treat vendor comparisons with care.
How do you test a medical AI receptionist before it takes a real call?
- The chest pain call. "I have chest pain and my arm is numb." You should hear the 911 instruction immediately, and nothing else first.
- The urgent-list call. Pick a symptom on your written urgent list and confirm it reaches the on-call number within a minute.
- The results call. "Are my blood test results back?" It should take a message for the clinical team and say nothing about results.
- The wrong-person call. Call about an appointment and give a wrong date of birth. It should not read the appointment back.
- The refill call. Ask for a refill. It should collect medication, dosage, pharmacy and your details, and say when the office will respond.
- The human request. "I need to speak to a person." Transfer, or a promised callback with an alert to staff.
Then read the summaries the next morning. Every call should show who called, what they wanted, what was booked or routed, and any flag, without anyone listening to a recording. Recording itself needs a consent line in some states; our guide to how AI receptionists work covers that. For dental practices specifically, see our dental AI receptionist comparison.
Questions medical practices ask about AI receptionists
Is an AI receptionist HIPAA compliant?+
Can an AI receptionist book medical appointments?+
Can an AI receptionist triage medical calls?+
Which AI receptionists are not HIPAA compliant?+
How much does a HIPAA compliant AI receptionist cost?+
Can an AI receptionist handle prescription refill requests?+
- 45 CFR 160.103, definition of business associate, and 45 CFR 164.502(e)(1)(i), via Cornell Law School's Legal Information Institute. 160.103, 164.502
- AgentZap. "HIPAA Compliant Virtual Receptionist" page, "AI Receptionist for Medical Practices" page, and pricing page, read September 20, 2026. agentzap.ai/hipaa, agentzap.ai/industries/medical, agentzap.ai/pricing
- Goodcall. "Goodcall's HIPAA-Compliant AI Software," May 12, 2026, and pricing page. goodcall.com, goodcall.com/pricing
- Weave. "AI Receptionist" page and "Plans" page, read September 20, 2026. getweave.com/ai-receptionist, getweave.com/plans
- Ruby. Plans and pricing, read September 20, 2026. ruby.com
- Smith.ai. "Medical Answering Service" industry page, read September 20, 2026. smith.ai
Published September 20, 2026. Every description was read on the vendor's own page and checked again before publishing; see how we research and write. Vendors change products and prices often. Found an error or a change? Email hello@leadsixty.com.
Every patient call answered. Every clinical one routed to a person.
Book a free 30-minute Where AI Fits call. We look at your call volume by hour, your scheduling system, and which calls must reach a person, and we tell you honestly whether a done-for-you receptionist or a self-serve tool with a signed agreement fits.
Book a Where AI Fits callOr see how ours works on the medical answering service page.