HIPAA and AI receptionists: what dental, veterinary, and healthcare-adjacent practices need to know

What HIPAA actually requires of an AI receptionist

HIPAA's Privacy and Security Rules apply when your business is a covered entity (a healthcare provider, health plan, or healthcare clearinghouse) and you engage a vendor that creates, receives, maintains, or transmits PHI on your behalf. That vendor becomes a Business Associate, and the relationship must be formalized with a signed Business Associate Agreement.

When a patient calls your dental office and your AI receptionist answers, that call may contain PHI: the patient's name, date of birth, appointment details, medical history references, insurance information, or the nature of their condition. The AI must transcribe and process that audio. Every system that touches that data — the telephony provider, the speech-to-text engine, the language model, the database — is in scope.

Specific technical requirements

• Business Associate Agreement: A signed written contract specifying how the vendor may use PHI, what safeguards are in place, breach notification timelines, and data destruction obligations.
• Encryption in transit and at rest: Call audio and transcripts must be encrypted during transmission (TLS 1.2 or higher) and while stored (AES-256 or equivalent). Unencrypted voicemail storage is a recurring violation finding in HHS OCR audits.
• Audit logs: The Security Rule requires audit controls that record system activity involving PHI — who accessed it, when, and what they did. Logs must be retained and reviewable.
• Access controls: Minimum necessary access. Staff and systems should only see PHI relevant to their function. Role-based access with authentication required.
• Workforce training and HIPAA policies: The vendor agreement does not relieve your practice of training obligations. Your workforce must be trained; your policies must exist.
• Breach notification: If PHI is exposed, the Business Associate must notify the covered entity within 60 days of discovery. The covered entity then notifies patients and HHS OCR as required.

HIPAA does not define a specific software certification or compliance label. There is no "HIPAA certified" badge issued by HHS. Compliance is about whether your actual configuration meets the above requirements — not whether a vendor uses the word "compliant" in its marketing.

VantaWeb's HIPAA posture today (honest version)

We will be direct: VantaWeb is not HIPAA-compatible today. We do not currently sign Business Associate Agreements with our customers, and we do not currently have signed BAAs in place with our own sub-processors — the AI inference layer, speech processing services, telephony carrier, real-time media infrastructure, edge networking, and related third-party services that touch call data. Without that full chain, no Apex-plan configuration would actually meet HIPAA's Security Rule requirements — claiming otherwise would be misleading.

What we DO have today (Apex plan)

Under the Apex plan ($599/mo), VantaWeb provides:

• Encryption in transit (TLS 1.2 minimum, enforced at the Cloudflare edge as of May 2026)
• Self-hosted Postgres for call data — no third-party analytics or ad-tech routing
• 90-day default transcript retention (configurable on Apex)
• Per-tenant data isolation via Row-Level Security in the database
• Per-tenant API key scoping
• Audit logging of API access (limited; not yet HIPAA Security Rule-grade)

These are reasonable safeguards for a non-HIPAA-regulated business. They are not a full HIPAA Security Rule program and they do not substitute for a signed BAA chain.

What we DO NOT have today

• Signed BAA with VantaWeb's customers (any plan)
• Signed BAAs with our sub-processors
• Encryption at rest on the database disk (planned, not yet in place)
• Formal HIPAA Security Rule policies and procedures (~25 written documents required)
• Annual HIPAA risk assessment (not yet performed)
• SOC 2 Type 2 attestation (planned for 2026/2027)
• HHS OCR breach notification playbook (drafted, not yet operationalized)

Which industries this matters for

HIPAA applies specifically to covered entities and their business associates. Not every healthcare-adjacent business is a covered entity. Here is a plain-language breakdown by vertical:

• Dental practices: Covered entities. Patient calls contain PHI (appointment details, conditions, insurance). BAA required for AI receptionist deployment. Wait for VantaWeb HIPAA tier.
• Veterinary clinics: Veterinary records are generally not covered under HIPAA — animals are not patients under the Act. Most vet practices do not require a BAA and can use VantaWeb today. However, practices that also handle human healthcare billing (rare) should verify with counsel.
• Chiropractic offices: Covered entities when billing through health insurance. Patient calls contain PHI. BAA required. Wait for HIPAA tier.
• Physical therapy practices: Covered entities. PHI exposure on intake calls. BAA required. Wait for HIPAA tier.
• Optometry clinics: Covered entities when billing through health insurance. BAA required for AI call handling. Wait for HIPAA tier.
• Home health agencies: Covered entities. High PHI sensitivity. BAA required. Wait for HIPAA tier.
• Medical spas (med spas): Depends on services. Med spas performing medical procedures billed through insurance are covered entities. Cosmetic-only med spas typically are not — those can use VantaWeb today. Verify with counsel before contracting.

For businesses outside this list — HVAC companies whose healthcare-worker clients call for service, pest control companies servicing medical buildings — HIPAA does not apply to your calls. Standard Pulse, Surge, or Apex configuration is appropriate and you can deploy VantaWeb today.

The PHI risk in voicemail and AI systems: three data points

An AI receptionist that captures patient calls without a BAA does not eliminate the voicemail PHI risk — it moves it to a different system without the legal framework to handle it. This is precisely why VantaWeb chose to hold the HIPAA tier rather than ship it half-built.

What VantaWeb does not do (today, even on Apex)

VantaWeb does not currently provide:

• A signed Business Associate Agreement on any plan
• HIPAA Security Rule-grade audit logging
• Encryption at rest on the call database
• BAAs with the sub-processors in Anna's underlying AI infrastructure (telephony, AI inference, speech processing, real-time media, edge network, and related services)
• A HIPAA risk assessment or compliance program documentation
• SOC 2 Type 2 attestation

If you need any of the above, VantaWeb is not the right vendor for you today. We are working toward the HIPAA tier. When it launches, we will publish the full configuration, the BAA chain, and the third-party attestation.