For practices that take patient calls
What to require of a HIPAA-compliant AI receptionist
Deeplathe does not claim HIPAA compliance. This page is the short list a practice should require of any AI receptionist before that receptionist hears a patient call: a business associate agreement, no training on those calls, and access controls. Whether a practice is covered, and whether a vendor meets that practice's own rules, is for the practice and its counsel.
A business associate agreement
A covered practice asks a vendor that handles patient information to sign a business associate agreement before the first call is sent. Ask for it in writing, and ask which subcontractors sit on the path of the audio and the transcript. A logo that says compliant is not that contract.
No training on patient calls
Require that recordings, transcripts, and the contents of the call are not used to train a general model. Ask where the audio is stored, how long it is kept, and who can export it. The answer should be a setting you can see, not a sentence in a marketing page.
Access controls
Require named access, a record of who opened a call, and a way to remove a person who leaves the practice. The agent should book and reschedule from the rules you set, and hand a clinical question to a person. It should not decide care.
If your practice needs this in writing for Deeplathe, raise it before anything is built. This page does not say that work is already done.
Questions
Is Deeplathe HIPAA compliant?
No. Deeplathe does not claim HIPAA compliance, and this page does not say otherwise. It lists what a practice should require of any AI receptionist.
What should we require before an AI receptionist hears patient calls?
A business associate agreement, a prohibition on training a model on those calls, and access controls that limit who can open a recording or a transcript.
Does signing a BAA by itself make a vendor compliant?
No. A business associate agreement is the contract a covered practice asks for. It is one requirement. Storage, training use, and access still have to be answered.
Which Deeplathe pages is this for?
Dental offices, med spas, and physical therapy clinics are the pages that send patient calls to an AI receptionist. Read this before you send one. HVAC, plumbing, and law firms are a different set of rules.