An AI receptionist that answers calls for a medical or dental practice hears names, dates of birth, symptoms and appointment details. That makes the vendor a business associate of the practice, and HIPAA requires a written agreement before it handles that information.
The agreement sets out what the vendor may do with the information, which safeguards it applies, how it reports breaches and how it binds its own subcontractors. HHS publishes sample provisions.
Some providers offer a BAA on every plan, others only on higher tiers or on request. Our comparison shows what each provider states publicly.
As of November 11, 2026. General information, not legal advice.