Small medical and dental practices lose patients to the phone. Calls go unanswered when front-desk staffing is thin, and a missed new-patient call is often a patient who simply rings the next clinic on the list.
An AI receptionist can absorb that routine load. It can also create a compliance problem, because a service that collects patient details for a covered practice is handling protected health information from the first sentence a caller speaks.
That makes vendor choice a contract decision before it is a feature decision. Neither a marketing claim nor a signed agreement on its own establishes compliance. The seven platforms below are the ones worth shortlisting, compared on BAA coverage, scheduling integration, call handling and published pricing.
What HIPAA compliance means for an AI receptionist
Under HIPAA, a vendor that creates, receives, maintains or transmits PHI on behalf of a covered practice generally acts as a business associate. A voice agent taking scheduling calls sits squarely in that definition, and the HHS guidance on business associate contracts sets out what the agreement has to cover.
A practice needs the BAA in place before sharing PHI, and it needs to review the service’s safeguards and configuration alongside it. Strong AI agent governance also means defining how data is handled, who can access it, what the system is allowed to do, and when human oversight is required. Confirm five things in writing.
- BAA scope: which services, recordings, transcripts and AI providers does the agreement cover?
- Encryption: how is information protected in transit and at rest?
- Access controls and audit logs: who can view patient data, and how is access recorded?
- Breach notification: when and how will the vendor notify your practice?
- Subcontractor terms: how are equivalent obligations passed to subcontractors touching PHI?
Ask specifically whether transcripts are used to train shared models. A vague answer is an answer.
AI Agentic Platform For Building Portable AI Agents
Say Hello To Agentic AI That Connects With Your CRM And Even Other Agents
The 7 best HIPAA-compliant AI receptionists
Ranking criteria: published compliance position, scheduling integration, call handling, pricing transparency and fit by practice size. Availability and contract terms change, so verify each claim for the plan you are considering.
1. Central AI
Compliance snapshot: States that it is fully HIPAA compliant and executes Business Associate Agreements with all customers handling protected health information. ISO 27001:2022 certified.
The agent answers every inbound call around the clock, qualifies the caller, answers questions from a knowledge base trained on your own site and documents, books the appointment live during the call and escalates to a human receptionist when one is available. Intake covers insurance information, reason for visit and contact details.
Practices weighing this against the best insurance verification software should note the distinction. Central describes capturing insurance details on the call, not running eligibility checks against payer systems. On the model-training question above, it states that customer data processed by its AI features is never used for training.
Key features: 24/7 answering, live booking into Cal.com, Calendly and Google Calendar, call summaries, escalation to a live receptionist at additional cost, 30+ languages, Zapier integrations.
Pricing: from $89 a month for 90 calls, with appointment booking, lead capture, call summaries and 24/7 answering on all plans. 10-day free trial.
Best for: independent practices that want a documented compliance position and published pricing rather than a quote-only process.
2. RingCentral AI Receptionist
Compliance snapshot: RingCentral’s published HIPAA documentation names AI Receptionist among the services covered by its BAA. Confirm eligibility for your own subscription and configuration.
This adds automated answering to an established business phone system, which matters if reception and telephony are one procurement rather than two. The documentation is unusually clear for this category, so the compliance review is faster than most. Test scheduling and staff transfers rather than assuming they are included in the base setup.
Key features: automated answering on a full phone platform, call routing, transfers to staff, published BAA service list.
Pricing: launch pricing was published at $39 per license with 100 minutes included. Request a current quote with overage charges.
Best for: clinics already using, or moving to, a cloud phone system.
3. Hyro
Compliance snapshot: Vendor materials describe HIPAA-compliant agents. Certifications and BAA terms are not prominent on its own pages, so request both directly.
Hyro runs patient conversations across call centers, websites, apps and SMS rather than the phone alone. Its Epic integration is certified through the Epic Showroom, which gives buyers a specific path to investigate. A certification is not the same as support for every appointment type or local configuration, so scope that in the demo.
Key features: voice and chat in one assistant, Epic Showroom certified integration, knowledge-graph approach that constrains what an agent can say.
Pricing: not public. Enterprise contracts, with implementation fees and minimum commitments to confirm.
Best for: multi-location groups with the budget and staff for a structured implementation.
4. Retell AI
Compliance snapshot: Its compliance documentation requires a BAA before PHI is sent and describes a self-service signing process at no additional fee.
This is a developer-oriented voice platform rather than a packaged receptionist, which is the point for practices that want custom AI agents and call flows built around their own logic.The agreement is one step. Confirm which speech, model, storage and telephony services your configuration touches and whether each can handle PHI under the required terms.
Key features: visual call flow builder, SIP trunking and warm transfer, configurable data retention, post-call analysis.
Pricing: usage-based per minute. Budget for setup and ongoing maintenance as well as call volume.
Best for: practices working with a technical partner to build custom call flows.
5. Vapi
Compliance snapshot: Its documentation describes a signed BAA and an organization-wide HIPAA mode before PHI is processed, and states that HIPAA mode and Zero Data Retention are mutually exclusive settings.
Vapi provides AI agent orchestration for teams that want to choose their own speech-to-text, model and voice, then wire those components to telephony. That flexibility is genuine, and so is the review burden, because every connected provider needs assessing separately. Ask what information is retained, where and for how long.
Key features: model-agnostic orchestration, organization-level HIPAA mode, configurable retention, developer APIs.
Pricing: per-minute platform cost plus model provider fees, with a HIPAA add-on on non-enterprise plans.
Best for: teams with technical support to configure the service, document settings and monitor changes.
6. Phonely
Compliance snapshot: Its terms permit transmitting PHI only when a written BAA is in place, so confirm healthcare eligibility before onboarding rather than after.
This is a managed AI receptionist aimed at small businesses, which makes it a lighter lift than the developer platforms above. The tradeoff is less control over how the conversation is designed. Test appointment requests, interruptions and transfers using your own scripts, and ask who maintains those scripts over time.
Key features: managed setup, call handling and transfers, business-hours and after-hours coverage, script configuration by the vendor.
Pricing: published subscription tiers. Confirm whether healthcare use requires a different plan.
Best for: smaller offices that want a managed setup rather than a build.
7. Echo Booking
Compliance snapshot: States that it is HIPAA compliant and signs a Business Associate Agreement with every customer before going live, with encryption in transit and at rest, role-based access and audit logging.
This is a healthcare-specific service rather than a general receptionist pointed at clinics, and its differentiator is write-back. It books directly into the practice management system rather than handing staff a callback list, with named two-way integrations including Athena, eClinicalWorks, NextGen, Practice Fusion, PrognoCIS, Open Dental and Dentrix.
It also lists insurance eligibility verification as a beta capability, which is worth scoping carefully rather than assuming. Ask for the recording-retention policy and the subprocessor list in writing, and during a pilot check both booking accuracy and how promptly uncertain requests reach a person.
Key features: EHR and PMS write-back, 70+ languages, calls plus text, email and web forms, after-hours triage, signed BAA before deployment.
Pricing: quote-based, priced per organization rather than per location. Ask for a complete figure rather than a headline rate.
Best for: practices that want the booking finished inside their existing system rather than handed back to the front desk.
How they compare
| Platform | BAA position | Published pricing | Scheduling integration |
| Central AI | States BAAs for all PHI customers | Yes, from $89/month | Calendar based |
| RingCentral AI Receptionist | AI Receptionist named in BAA docs | Launch price published | Phone platform, confirm scope |
| Hyro | Request directly | Not public | Epic, Showroom certified |
| Retell AI | Self-serve signing, no fee | Usage-based | Build your own |
| Vapi | Enterprise or paid add-on | Per minute plus model costs | Build your own |
| Phonely | Written BAA required first | Published tiers | Confirm before onboarding |
| Echo Booking | Signed BAA before go-live | Quote-based, per organization | EHR and PMS write-back |
Comparing what these actually cost
Sticker pricing misleads, because clinical calls run longer than retail calls and base tiers assume modest volume. A plan quoted per call behaves very differently from one quoted per minute once your average handle time is three or four minutes rather than one.
Compare total monthly cost at the same expected volume, and include every line: subscription fees, billable minutes, overages, phone charges, setup and support. Ask whether BAA coverage or a healthcare configuration requires a different plan from the one being quoted, because on several platforms it does.
A useful exercise before any demo is to pull last month’s call log, count inbound calls and estimate average duration. Every vendor on this list can price against those two numbers, and the answers become comparable in a way headline rates never are.
Pros and cons
Most practices end up with a hybrid setup: the agent takes routine calls and staff keep anything sensitive or complex. The tradeoffs between voice AI agents and human staff break down like this.
The case for adopting: 24/7 answering with no overtime or turnover, consistent intake capture, shorter hold times and better new-patient conversion, multilingual coverage without hiring for it, and an audit trail on every call.
The case against: hallucinated clinical advice remains a real risk on edge cases, weak triage logic can misroute urgent calls, some patient populations push back on AI, breach liability stays with the practice regardless of BAA terms, and workflow tuning usually takes weeks rather than days.
Buyer checklist
Use these ten questions to find gaps before a pilot.
- Is a signed BAA in place for the exact services you will use?
- Can you review the subprocessors that handle PHI?
- Are recordings, transcripts and retention periods covered?
- Are any model providers receiving PHI covered by the required agreements?
- Are encryption details documented in transit and at rest?
- Can you restrict access by role and review access logs?
- Are there clear limits on clinical advice and an approved urgent-call protocol?
- Can callers reach a person when they need one?
- Have appointment changes been tested in a nonproduction environment?
- Are SMS and voicemail data flows covered by appropriate safeguards?
A 90-day rollout plan
Treat this as a planning template, not a deadline that overrides unresolved safeguards. Managing the AI agent lifecycle also requires testing, monitoring and reviewing the system after deployment rather than treating launch as the end of the process.
Days 1 to 15: review the BAA, subcontractor list and retention terms with your compliance lead.
Days 16 to 30: test the scheduling integration using fictional patient records only.
Days 31 to 50: build call flows with limits on clinical advice, an approved urgent-call protocol and clear transfers to staff.
Days 51 to 75: pilot a limited set of routine calls with staff oversight and review a sample of interactions weekly.
Days 76 to 90: expand only if the pilot meets your accuracy and escalation requirements. Track booking errors, successful transfers, patient complaints and the share of calls completed without staff help.
Frequently asked questions
Is any AI receptionist HIPAA compliant on its own?
No. Compliance is a signed BAA covering the exact service you use, plus how you configure retention, access and disclosure. Treat any claim made without a BAA as marketing.
Do recordings and transcripts count as PHI?
Yes, when they contain patient information. The BAA should name recordings, transcripts and AI-generated summaries explicitly and set retention terms for each.
Can an AI receptionist verify insurance eligibility?
Capturing insurance details during intake and checking eligibility against payer systems are different capabilities. Most receptionist tools do the first, and a few are building the second. Ask directly whether results come from payer systems in real time, arrive in a batch or need staff follow-up, and confirm that eligibility is never presented to a patient as a guarantee of payment.
Can it handle prescription refills and urgent calls?
Refills are one of several potential AI agent use cases, but in healthcare the system should generally capture details and route the request to the appropriate clinical queue rather than make clinical decisions. Urgent calls need aggressive escalation thresholds, and the agent should never be the only layer between a patient and clinical judgment.
Portable AI Agents In Seconds, Use Everywhere
Prompt, Test, and Deploy AI Agents Across Social Platforms and LLMs. Automate Everything.