If patient privacy is the thing holding you back from AI, you’re in good company. In Weave’s 2026 survey, 60% of healthcare practices named data privacy as their top concern about AI.
It should be a concern. An AI receptionist on your phones will hear patient names, phone numbers, and appointment details. That isn’t a reason to avoid it. It’s a reason to ask the right questions before you sign anything.
Eight questions to ask any vendor
- Will the platform sign a business associate agreement (BAA) with my practice? If the answer is no, stop there.
- Whose name is the account in? It should be your practice’s. If it lives in someone else’s account, your patients’ calls do too.
- Where are call recordings and transcripts stored, and for how long? Get a specific answer, not “it’s secure.”
- Who can access those recordings? Ask about the vendor’s staff and anyone who helped set it up.
- Is my patients’ information used to train AI models? You want a clear no, in writing.
- What happens when a caller asks a medical question? It should go to your people, following rules you set. The AI shouldn’t guess.
- Can I turn off recording, or limit what’s kept? Less stored information means less risk.
- How do I get my data out, or delete it, if I leave? You should never be locked in.
Copy these eight questions into an email and ask the vendor to answer them in writing. How quickly and clearly they respond tells you a lot about how they’ll treat your patients’ information.
Watch out for the badge
Be careful with any tool that simply says “HIPAA compliant” and leaves it there. Compliance isn’t a label a product can carry. It’s the result of how the whole system is set up and run in your practice. The eight questions above get you closer to the truth than any badge.
How we handle it
We set it up. You own it. Here’s what that means in practice:
- Your accounts. Your AI front desk runs in your practice’s own accounts, and you sign the business associate agreement directly with the platform.
- Test calls, not patient calls. We build and test with made-up scenarios. After launch, we don’t keep access to recordings or transcripts.
- Clinical questions go to your people. Your AI front desk books, answers logistics, and takes messages. Anything clinical goes to your staff.
We never store, view, or process your patients’ information. We’ll walk through all of this with you, and your compliance contact if you have one, during the workflow assessment.
This guide is general information, not legal advice. For your specific situation, check with your compliance advisor or a healthcare attorney.