AI HIPAA Compliance: Complete Guide for Medical & Dental Practices (2026)

Who Needs HIPAA-Compliant AI?

HIPAA applies to covered entities and their business associates. If you're any of these and deploying AI, you need HIPAA-compliant infrastructure:

• Healthcare providers — physicians, dentists, chiropractors, mental health providers, physical therapists
• Health plans — insurance companies, Medicare/Medicaid plans, HMOs
• Healthcare clearinghouses — billing services, claims processors
• Business associates — IT vendors, billing companies, transcription services, AI vendors handling PHI

If you're a healthcare-adjacent business (med spa with non-medical procedures, fitness coaching, wellness products), HIPAA may not apply — but if your AI captures any health information (allergies, medications, conditions, treatments) tied to patient identity, you should treat it as PHI to be safe.

What Counts as PHI in AI Conversations?

PHI (Protected Health Information) is any health information combined with identifiable patient data. The HHS lists 18 specific identifiers, but in practical terms for AI agents:

• Patient name + appointment type ("John Smith — Cleaning Appt 2pm")
• Patient name + provider/specialist ("Sarah Jones with Dr. Williams")
• Phone number + reason for call ("(555) 123-4567 — calling about test results")
• Email + medication mentioned
• Calendar entry with patient ID and procedure
• Voice recording of patient discussing symptoms
• Insurance verification details
• Any payment associated with a medical service

The pattern: identity + health context = PHI. Generic info (hours, location, "we accept Delta Dental") is not PHI even when delivered by AI.

The 5 Requirements for HIPAA-Compliant AI

1. Business Associate Agreement (BAA)

Any third party (your AI platform, telephony provider, CRM, voice synthesis vendor) handling PHI must sign a BAA with you. The BAA legally obligates them to protect PHI to HIPAA standards. Without a signed BAA in place, using a vendor with PHI is a HIPAA violation — period, regardless of the technical security.

2. End-to-End Encryption

PHI must be encrypted at rest (in storage) and in transit (network communication). All major HIPAA-compliant platforms handle this automatically. Verify TLS 1.3 for transit, AES-256 for storage.

3. Audit Logging

Every access to PHI must be logged — who accessed what, when, and why. AI conversations are full transcripts; the logs must capture every PHI interaction. Most HIPAA-compliant platforms include this; verify retention policies (typically 6 years).

4. Access Controls

Only authorized personnel and systems should access PHI. AI platforms must support role-based access, MFA for admin users, and minimum-necessary scope (the AI sees only what it needs to function).

5. Breach Notification Procedures

If a breach occurs, you must notify affected patients within 60 days, OCR within 60 days (or 60 days after end of year for breaches under 500 records), and media for breaches over 500 records. Your AI vendor must notify you of any breach within their reasonable timeframe (specified in BAA, typically 5-10 business days).

HIPAA-Compliant AI Platform Comparison

Platform	HIPAA Tier Available	Price Premium	BAA	Best For
GoHighLevel	Pro+ tier	+$200/mo over standard	Yes (request)	Service-business AI, dental, med spa
Twilio	Enterprise tier	+30% per minute	Yes (auto)	Telephony backbone for medical
AWS Bedrock	Default w/Business Support	$100/mo support minimum	Yes (auto)	Custom AI development
Azure OpenAI	Default w/agreement	None (BAA required)	Yes (auto)	Enterprise medical AI
Google Vertex AI	Default w/agreement	None (BAA required)	Yes (auto)	Enterprise medical AI
OpenAI Enterprise	Enterprise plan only	$60+/user/mo	Yes (Enterprise)	Internal medical AI tools
ChatGPT Plus/Team	❌ Not HIPAA	—	No	Don't use with PHI
Vapi standard	❌ Not HIPAA	—	No	Don't use with PHI
Bland AI standard	❌ Not HIPAA	—	No	Don't use with PHI
Retell AI	Enterprise (limited)	Custom pricing	Yes (enterprise)	Voice AI for healthcare

Implementation Path for Dental Practices

The most common healthcare AI deployment we handle. Here's the exact stack:

1. Platform: GoHighLevel Pro tier ($497/mo) — request BAA before deployment
2. Telephony: Twilio HIPAA Enterprise (auto-BAA) — adds ~$50-$100/mo over standard
3. LLM: Anthropic Claude or OpenAI GPT-4 via Azure OpenAI Service (auto-BAA when configured for HIPAA)
4. Voice: Use OpenAI TTS or Azure Cognitive Services voice (HIPAA-compliant). Avoid ElevenLabs default (no HIPAA tier as of 2026)
5. BAA chain: Get BAAs from GoHighLevel, Twilio, and your LLM provider before launch
6. Practice management integration: Most PMS systems (Dentrix, Open Dental, Eaglesoft) have API integrations that work with GoHighLevel — verify their HIPAA posture too

Total monthly cost: approximately $700-$1,200 depending on call volume. Yes, more than non-compliant deployment — but the alternative is a $50,000-$1.5M penalty risk.

Common Mistakes

Mistake 1: "We anonymize the data"

Removing names doesn't necessarily de-identify PHI. The 18 HIPAA identifiers include phone numbers, email addresses, dates of service, and ZIP codes. True de-identification requires expert determination or following the HHS Safe Harbor method — neither of which most teams do correctly. Default to BAA + full HIPAA compliance.

Mistake 2: "We're just doing scheduling, that's not PHI"

If the appointment includes the patient's name + service type + provider, that's PHI. Don't deploy non-HIPAA platforms for "just scheduling" if the schedule contains medical context.

Mistake 3: Forgetting the chain

Your AI platform might be HIPAA compliant, but if it routes through a non-HIPAA voice provider or non-HIPAA LLM, you're not covered. Every link in the chain needs a BAA.

Mistake 4: Using consumer AI tools

ChatGPT Plus, Claude Pro, and consumer Gemini do NOT have HIPAA BAAs. Using them with PHI is a violation. For internal AI assistance with PHI, use OpenAI Enterprise, Claude for Work (with appropriate BAA), or self-hosted models.

Mistake 5: Skipping audit logs

You need 6 years of audit logs showing all PHI access. Some standard plans don't retain logs that long. Verify retention before signing.

Practical Patient-Facing Disclaimers

Even with full HIPAA compliance, smart practices include AI disclosure in their patient-facing communication:

"Hi, this is the AI assistant for [Practice Name]. I can help schedule appointments, verify insurance, and answer general questions. For specific medical advice, I'll connect you with a clinical team member. Our conversation is recorded and protected under HIPAA standards. Is that okay?"

This disclosure is HIPAA-compliant communication and reduces patient confusion. Some states (California, Illinois) increasingly require AI disclosure, so the trend is toward more explicit disclosure regardless.

When in Doubt: Hire Help

HIPAA implementation is genuinely complex. If you're a small practice without a privacy officer or IT compliance staff, hire a HIPAA-specialized AI agency to handle the deployment. The cost ($2,000-$5,000 for setup + monthly retainer) is trivial compared to the risk of a violation.

Frequently Asked Questions