HIPAA-compliant AI receptionist: what dental, veterinary, and healthcare-adjacent practices need to know

What HIPAA actually requires of an AI receptionist

HIPAA's Privacy and Security Rules apply when your business is a covered entity (a healthcare provider, health plan, or healthcare clearinghouse) and you engage a vendor that creates, receives, maintains, or transmits PHI on your behalf. That vendor becomes a Business Associate, and the relationship must be formalized with a signed Business Associate Agreement.

When a patient calls your dental office and your AI receptionist answers, that call may contain PHI: the patient's name, date of birth, appointment details, medical history references, insurance information, or the nature of their condition. The AI must transcribe and process that audio. Every system that touches that data — the telephony provider, the speech-to-text engine, the language model, the database — is in scope.

Specific technical requirements

• Business Associate Agreement: A signed written contract specifying how the vendor may use PHI, what safeguards are in place, breach notification timelines, and data destruction obligations.
• Encryption in transit and at rest: Call audio and transcripts must be encrypted during transmission (TLS 1.2 or higher) and while stored (AES-256 or equivalent). Unencrypted voicemail storage is a recurring violation finding in HHS OCR audits.
• Audit logs: The Security Rule requires audit controls that record system activity involving PHI — who accessed it, when, and what they did. Logs must be retained and reviewable.
• Access controls: Minimum necessary access. Staff and systems should only see PHI relevant to their function. Role-based access with authentication required.
• Workforce training and HIPAA policies: The vendor agreement does not relieve your practice of training obligations. Your workforce must be trained; your policies must exist.
• Breach notification: If PHI is exposed, the Business Associate must notify the covered entity within 60 days of discovery. The covered entity then notifies patients and HHS OCR as required.

HIPAA does not define a specific software certification or compliance label. There is no "HIPAA certified" badge issued by HHS. Compliance is about whether your actual configuration meets the above requirements — not whether a vendor uses the word "compliant" in its marketing.

VantaWeb's HIPAA posture

We will be direct: VantaWeb is not marketed as a HIPAA-certified product, and we would not tell you that it is. Certification does not exist in HIPAA's framework, and claiming it would be misleading. What we can tell you is how our system is built, what protections are in place, and what the Apex plan specifically offers for practices with PHI obligations.

How the voice pipeline works

When a caller reaches VantaWeb's AI receptionist, the call routes through Telnyx (our telephony carrier), which offers HIPAA-eligible voice configuration and is capable of entering a BAA for covered-entity customers. Audio is processed in real time via a speech-to-text engine and a large language model — we use Anthropic's Claude and optionally OpenAI's GPT for inference. Both Anthropic and OpenAI offer BAAs for enterprise contracts. Call data and transcripts are stored in VantaWeb's own infrastructure: a self-hosted Postgres database on our dedicated server. No customer data routes through third-party analytics or ad-tech platforms.

What the Apex plan provides

Under the Apex plan ($599/mo), VantaWeb:

• Signs a Business Associate Agreement with your practice before the system goes live.
• Configures HIPAA-eligible voice paths through Telnyx under a Telnyx BAA arrangement.
• Routes LLM inference through enterprise-contracted API paths that support HIPAA BAAs.
• Restricts data retention to the terms specified in your BAA — no indefinite transcript storage.
• Implements access controls limiting transcript access to authorized users on your account.

What Surge and Pulse plans do not include

The Surge ($299/mo) and Pulse ($149/mo) plans use standard configurations. They are appropriate for businesses with incidental PHI exposure, low-volume practices weighing their actual risk profile, or B2B service companies with healthcare clients but no direct patient data handling. No BAA is available on these plans. If your practice is a covered entity under HIPAA and your patients' calls will touch the system, Apex is the correct plan. Speak with your legal counsel if you are unsure of your covered-entity status.

Which industries this matters for

HIPAA applies specifically to covered entities and their business associates. Not every healthcare-adjacent business is a covered entity. Here is a plain-language breakdown by vertical:

• Dental practices: Covered entities. Patient calls contain PHI (appointment details, conditions, insurance). BAA required for AI receptionist deployment. Apex plan appropriate.
• Veterinary clinics: Veterinary records are generally not covered under HIPAA — animals are not patients under the Act. Most vet practices do not require a BAA. However, practices that also handle human healthcare billing (rare) should verify with counsel.
• Chiropractic offices: Covered entities when billing through health insurance. Patient calls contain PHI. BAA required.
• Physical therapy practices: Covered entities. PHI exposure on intake calls. BAA required.
• Optometry clinics: Covered entities when billing through health insurance. BAA required for AI call handling.
• Home health agencies: Covered entities. High PHI sensitivity — patient conditions and addresses discussed on intake calls. BAA required; discuss data retention terms carefully.
• Medical spas (med spas): Depends on services. Med spas performing medical procedures billed through insurance are covered entities. Cosmetic-only med spas typically are not. Verify with counsel before contracting.

For businesses outside this list — HVAC companies whose healthcare-worker clients call for service, pest control companies servicing medical buildings — HIPAA does not apply to your calls. Standard Surge configuration is appropriate.

The PHI risk in voicemail and AI systems: three data points

An AI receptionist that captures patient calls without a BAA does not eliminate the voicemail PHI risk — it moves it to a different system without the legal framework to handle it. The right configuration solves the problem; the wrong configuration creates a new one.

What VantaWeb does not do

VantaWeb is not a replacement for your practice's own HIPAA training, internal policies, BAA review with your legal counsel, or ePHI workflow audit. We provide a HIPAA-compatible AI receptionist layer when configured under the Apex plan — that is a vendor safeguard, not a compliance program.

We do not perform HIPAA risk assessments for your practice. We do not advise on whether your practice is a covered entity. We do not guarantee that our configuration meets any specific regulatory standard. We do sign a BAA, configure the system appropriately, and take responsibility for our side of the agreement — the rest is your practice's obligation, as it should be.

If you need a compliance partner who provides full HIPAA program management, that is a different service category. We are an AI receptionist vendor that takes the BAA seriously.