# HIPAA compliant AI receptionist? What to ask any vendor Whether an AI receptionist fits HIPAA depends on the vendor’s written contracts and how it handles patient data. A label on a website cannot show you that. The questions below help you check any vendor before you sign. Our team answers data-protection questions about AgentBlue on the free 30-minute demo call. ## How our AI shows its work When the AI tells a patient something, your team can see where it came from. We call this memory with receipts. Each fact the AI holds about a patient, such as a preferred day or the treatment they asked about, is kept with its source: the message, form or call it came from, and when. Your staff can open any fact, check it, correct it or delete it. When the AI does not know something, it says so and asks instead of guessing. - Each patient’s history stays with your clinic, and your staff can see and correct it. - When a patient needs a person, the AI hands the conversation to your team with the details so far. - The AI tells patients it is an AI. > Example > > Patient: Dana R., made up for this example > > What the AI holds: prefers Tuesday mornings > > Where it came from: her text message to the clinic, 3 March at 9:12 > > What your staff can do: see it, correct it or delete it ## How this site treats your data These points are about agentblue.io, the website you are reading, and its forms. - Please do not share patient or personal health details in the forms on this site. Use them for questions about AgentBlue. - The [privacy notice](https://agentblue.io/privacy) lists what the site collects, why, who receives it, how long it is kept and how to ask for a copy or deletion. - Non-essential cookies and tracking run only after you agree. The [cookies page](https://agentblue.io/cookies) lists them. - Privacy questions and requests go to one address on agentblue.io, given in the privacy notice. - A person replies within one business day, Monday to Friday, 9:00 to 17:00 US Eastern. - The demo call is free, 30 minutes long, with no obligation to buy. - The [terms of use](https://agentblue.io/terms) say who runs the site, how it may be used and how to get in touch. ## Data-protection questions to ask any vendor Plenty of AI receptionist websites say HIPAA compliant. The phrase on its own tells you little. What counts is what the vendor puts in writing and who handles patient data. Each question below comes from the HIPAA rules, so you can put it to any vendor. ### Will you sign a BAA before patient data reaches you? A clinic may let an outside company handle protected health information for it only with written assurances that the company will safeguard it. That written contract is usually called a business associate agreement (BAA). Ask for it before setup starts. Rule: 45 CFR 164.502(e) and 164.504(e). ### Who else touches patient data? A vendor’s own subcontractors, such as the companies behind its phone lines, text messages or AI models, count as business associates too when they handle protected health information for it. Ask for the list, and whether each one has agreed to the same restrictions as the vendor. Rule: 45 CFR 160.103 and 164.504(e)(2)(ii)(D). ### What happens to the data when the contract ends? The contract should say the vendor returns or destroys the protected health information it still holds where that is feasible, and keeps protecting it where it cannot. Ask which one the vendor does and how you will know. Rule: 45 CFR 164.504(e)(2)(ii)(J). ### How will the vendor tell you about a problem? The contract must require the vendor to report any use or disclosure of the information that the contract does not allow, breaches included. Ask who contacts you, how, and how quickly. Rule: 45 CFR 164.504(e)(2)(ii)(C). ### Has the vendor done a risk analysis? Clinics and business associates alike must assess the risks to the electronic protected health information they hold. Ask when the vendor last did one and what it covered. Rule: 45 CFR 164.308(a)(1)(ii)(A). ### What does HIPAA compliant mean on your website? If a vendor uses the phrase, ask what stands behind it: which signed agreements, which subcontractors and which written policies. A clear answer covers the five questions above. Bring these questions to the free 30-minute demo call. Our team answers data-protection questions about AgentBlue there. Sources - [45 CFR 160.103, definitions (eCFR)](https://www.ecfr.gov/current/title-45/section-160.103), 2026-10-15 - [45 CFR 164.502, uses and disclosures (eCFR)](https://www.ecfr.gov/current/title-45/section-164.502), 2026-10-15 - [45 CFR 164.504, organizational requirements (eCFR)](https://www.ecfr.gov/current/title-45/section-164.504), 2026-10-15 - [45 CFR 164.308, administrative safeguards (eCFR)](https://www.ecfr.gov/current/title-45/section-164.308), 2026-10-15 [Book your free demo](https://agentblue.io/demo) ## Frequently asked questions ### What is a BAA? A business associate agreement (BAA) is the written contract HIPAA expects between a clinic and a business associate: an outside company that creates, receives, keeps or sends protected health information for the clinic. The rule lists what it must cover, including reporting problems, subcontractors and what happens to the data at the end ([45 CFR 164.504(e)](https://www.ecfr.gov/current/title-45/section-164.504)). ### Do a vendor’s subcontractors need the same terms? Yes. Under the rule, a subcontractor that handles protected health information for a business associate is a business associate too, and it must agree to the same restrictions and conditions ([45 CFR 160.103](https://www.ecfr.gov/current/title-45/section-160.103) and [164\.504(e)](https://www.ecfr.gov/current/title-45/section-164.504)). ### Should I type patient details into this site’s forms? No. Please do not share patient or personal health details in the forms on this site. Use them for questions about AgentBlue. ### Where can I ask about AgentBlue’s data protection? On the free 30-minute demo call, where our team answers data-protection questions. Questions about this site’s [privacy notice](https://agentblue.io/privacy) go to the address it gives, and a person replies within one business day, Monday to Friday, 9:00 to 17:00 US Eastern. ### Is this page legal advice? No. It explains what the HIPAA rule text says so you know what to ask a vendor. For your own clinic’s duties, ask your privacy officer or a lawyer. ## Related pages - [AI receptionist buyer questions](https://agentblue.io/guides/ai-receptionist-buyer-questions): what to ask before you choose one. - [How to test an AI receptionist](https://agentblue.io/guides/how-to-test-an-ai-receptionist): calls and texts to try before you buy. - [Missed call calculator](https://agentblue.io/tools/missed-call-calculator): what missed calls may be worth to your clinic. - [Privacy notice](https://agentblue.io/privacy), [cookies](https://agentblue.io/cookies) and [terms of use](https://agentblue.io/terms) for this website. - [Report a vulnerability](https://agentblue.io/security) in this website. Source page: