--- title: Are AI Receptionists HIPAA Compliant? Which Sign a BAA (2026) description: No AI receptionist is HIPAA certified. Here is what a BAA covers, which AI receptionists say they sign one, and what to ask about call recordings. image: https://www.blog.callura.io/hubfs/hipaa-baa-featured.png --- [Skip to content](https://www.blog.callura.io/callura-blog/are-ai-receptionists-hipaa-compliant#main-content) [![Callura](https://www.blog.callura.io/hubfs/Logo%20(Black)%20(5).svg)Homepage](https://www.calluravoice.ai/) - [Home](https://www.calluravoice.ai/) - [Features](https://www.calluravoice.ai/features) - [Blog](https://www.blog.callura.io/callura-blog) - [Security](https://www.calluravoice.ai/security) - [Careers](https://www.calluravoice.ai/careers) - [Contact](https://www.calluravoice.ai/contact) - [Log In](https://dashboard.calluravoice.ai/login) [Talk to a Founder](https://cal.com/callura/15minutes?overlayCalendar=true) - [Home](https://www.calluravoice.ai/) - [Features](https://www.calluravoice.ai/features) - [Blog](https://www.blog.callura.io/callura-blog) - [Security](https://www.calluravoice.ai/security) - [Careers](https://www.calluravoice.ai/careers) - [Contact](https://www.calluravoice.ai/contact) - [Log In](https://dashboard.calluravoice.ai/login) [Talk to a Founder](https://cal.com/callura/15minutes?overlayCalendar=true) ![Is your AI receptionist HIPAA compliant? What a BAA covers, who signs one, and what happens to call recordings](https://www.blog.callura.io/hs-fs/hubfs/hipaa-baa-featured.png?width=1200&height=628&name=hipaa-baa-featured.png) AI Voice Agents # Are AI Receptionists HIPAA Compliant? Which Ones Sign a BAA (2026) ![Callura](https://7528315.fs1.hubspotusercontent-na1.net/hub/7528315/hubfs/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/avatar-placeholder.jpg?width=48&height=48&name=avatar-placeholder.jpg) Callura October 7, 2026 When we first showed Callura to the team at the largest dental practice in Manhattan, the first hard question wasn’t about booking, insurance or how natural the voice sounded. It was this: *“How do you protect patient information?”* It was the right question to ask first. An AI receptionist hears names, birthdays, insurance member IDs and the reason someone is calling, often before anyone on your team does. If you can’t answer how that information is protected, nothing else about the product matters. I learned how much patient information moves through a single phone call before I ever started Callura. I was working at a call center, and every call began the same way: “Can I get your first and last name? And your date of birth?” Even when the caller’s information was already in the system, we asked anyway, over and over. It was mundane for us, and nobody on the other end of the line enjoyed repeating themselves either. That’s one of the first things we fixed when we built Callura. Our assistants look up the caller by their phone number, so their profile, including first and last name and date of birth, is already up before the conversation starts. Your front desk doesn’t have to say the same words for the hundredth time that day. But it also means real patient information moves through every call, which is exactly why protecting it has to come first. *Brandon Kim, Founder, Callura* **Short answer: an AI receptionist can be used in a HIPAA-compliant way, but HHS does not certify AI receptionists, or any other product, as HIPAA compliant. What matters is whether the vendor will sign a Business Associate Agreement (BAA), how it protects call recordings and transcripts, and whether your practice configures and uses it safely.** ## Does a dental practice need a BAA with an AI receptionist? If your practice is a HIPAA covered entity and the service handles patient information on your behalf, you generally need a BAA before sharing that information. Under HIPAA, a vendor that creates, receives, stores or transmits protected health information on your behalf is a [business associate](https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html), and you need a written BAA with them before sharing that information. An AI receptionist that answers patient calls, takes their details and books them into your schedule fits that description. Two details trip practices up: - **Encryption doesn’t remove the need for a BAA.** HHS says a cloud vendor that stores encrypted patient data is still a business associate, even if it doesn’t hold the key ([HHS FAQ 2076](https://www.hhs.gov/hipaa/for-professionals/faq/2076/if-a-csp-stores-only-encrypted-ephi-and-does-not-have-a-decryption-key-is-it-a-hipaa-business-associate/index.html)). - **A “HIPAA certified” badge isn’t a government credential.** HHS doesn’t certify or endorse products as HIPAA compliant ([HHS FAQ 2003](https://www.hhs.gov/hipaa/for-professionals/faq/2003/are-we-required-to-certify-our-organizations-compliance-with-the-standards/index.html)), and a vendor can’t self-certify in place of signing a BAA ([HHS FAQ 237](https://www.hhs.gov/hipaa/for-professionals/faq/237/can-business-associates-self-certify/index.html)). Private assessments exist, but none of them replaces the BAA. ## Does signing a BAA make the whole setup compliant? No. A BAA sets the vendor’s contractual obligations for handling patient information. It doesn’t, by itself, verify the vendor’s safeguards or how your practice has set things up. Your practice still decides who can see call recordings, how long they’re kept, which questions the assistant may answer, and when it hands a patient to your team. Think of it the way you think about a new hire: the paperwork matters, and so does how you train them. ## Which AI receptionists say they sign a BAA? We checked each vendor’s own website on October 7, 2026. A check means the vendor’s own website says it signs a BAA. Every vendor here has other strengths and limits, so treat this as a starting point, not a ranking. Ask every vendor for the BAA itself before you sign anything. | Vendor | Website says it signs a BAA | | --- | --- | | **[Callura](https://www.calluravoice.ai/security)** (dental, med spa) | ✓ | | **[Viva](https://www.getviva.ai)** (dental) | ✓ | | **[Arini](https://www.arini.ai/blog/dentrix-integration-guide)** (dental) | ✓ | | **[Third Voice](https://www.thirdvoice.ai/security)** (dental) | ✓ | | **[VoxHealth](https://www.voxhealth.ai/security)** (dental, medical) | ✓ | | **[Dental Intelligence](https://www.dentalintel.com/terms/baa)** (dental) | ✓ | | **[Weave](https://www.getweave.com/legal/baa/)** (dental, medical) | ✓ | | **[Adit](https://adit.com/terms)** (dental, medical) | ✓ | | **[Clara AI](https://www.getclaraai.com/solutions/med-spas)** (med spa) | ✓¹ | | **[Goodcall](https://www.goodcall.com/answering-services/physicians)** (general) | ✓ | | **[Emitrr](https://emitrr.com/blog/hipaa-compliant-ai-agent/)** (healthcare) | ✓ | | **[Dialzara](https://dialzara.com/blog/best-medical-answering-services)** (general) | ✓² | | **[Smith.ai](https://www.smith.ai/industries/medical-wellness-answering-service)** (general) | ✗³ | Key: ✓ = stated on the vendor’s own website. ✗ = the vendor’s own website says otherwise. ¹ For “eligible deployments”, per its med spa page. ² On request. ³ Its medical and wellness page says its AI Receptionist “is not HIPAA-compliant and cannot handle protected health information (PHI) in regulated healthcare environments.” Ruby signs BAAs at no extra charge but uses human receptionists, so it isn’t listed. Each vendor name links to the page we used, checked October 7, 2026. Callura publishes this comparison and is included in it. We reviewed public statements, not vendors’ private audit reports or signed customer agreements. ## What happens to call recordings and transcripts? A BAA answers part of the question. Next, ask what happens to the recording and transcript after the call. Every call your AI receptionist answers can produce a recording and a written transcript full of patient details. Ask every vendor: 1. Where are recordings and transcripts stored, and are they encrypted at rest and in transit? 2. Who on their team can access them, and is that access logged? 3. How long are they kept, and can you have them deleted? 4. Are they used to train or improve AI models, even after de-identification? 5. Which subcontractors handle the data, and do they sign BAAs too? ## Five questions to ask before you sign 1. **Will you sign our BAA, or send yours today?** Read the AI and de-identification clauses, not just the signature line. 2. **Is the BAA included on the plan we’re buying?** Some vendors limit it to certain tiers or deployments. 3. **Do you have an independent security audit?** Ask for the report, not the badge. 4. **What do you do with recordings and transcripts?** Use the five questions above. 5. **What happens when the assistant can’t help?** It should hand the patient to your team, not guess. ## How Callura protects patient information Callura is an AI virtual assistant for dental practices and med spas, often called an AI receptionist. We sign a BAA with covered entities on request ([request one here](https://www.calluravoice.ai/contact)), encrypt patient information with AES-256 at rest and TLS 1.2 in transit, limit access with role-based controls and audit logs, and never sell patient data. [Read about Callura’s security](https://www.calluravoice.ai/security). We built it this way because the front desk already carries enough. Your team shouldn’t have to wonder where a patient’s information went after the call ended. **If you run a dental practice or med spa that needs after-hours or overflow coverage, and you want your security questions answered before you commit, you’re exactly who we want to work with. Bring your booking rules and your requirements, and we’ll confirm the fit first.** ## Frequently asked questions ### Are AI receptionists HIPAA compliant? An AI receptionist can be used in a HIPAA-compliant way if the vendor signs a BAA, protects patient information with appropriate safeguards, and your practice configures it safely. No AI receptionist is “HIPAA certified”, because HHS doesn’t certify products. ### Do I need a BAA with an AI receptionist? In most cases, yes. A vendor that receives, stores or transmits patient information on your behalf is a business associate under HIPAA, and you need a signed BAA before sharing that information. ### Which AI receptionists sign a BAA? As of October 7, 2026, Callura, Viva, Arini, Third Voice, VoxHealth, Dental Intelligence, Weave, Adit, Clara AI, Goodcall, Emitrr and Dialzara state on their own websites that they sign BAAs, some only on certain plans, deployments or on request. Smith.ai states its service is not HIPAA compliant. ### What should I ask an AI receptionist vendor about call recordings? Ask where recordings and transcripts are stored, who can access them, how long they are kept, and whether they are used to improve AI models. Then check the answers against the BAA and the vendor’s terms. ### Does a BAA cover every part of an AI receptionist service? Not automatically. Ask whether the BAA covers the exact AI receptionist product you’re buying and every subcontractor that handles patient information, such as phone, transcription and hosting providers. ### How do I request Callura’s BAA? Request it through Callura’s contact page or ask during your founder walkthrough. Callura signs BAAs with covered entities on request. ## Talk to a founder Bring your security questions. We’ll walk you through our BAA, how call data is handled, and how Callura would work with your practice’s rules. [**Talk to a founder**](https://cal.com/callura/15minutes?utm_source=callura_blog&utm_medium=referral&utm_campaign=hipaa_baa) ## About Callura Callura builds AI virtual assistants for dental practices, med spas and other healthcare practices, trained on each practice’s workflows, services and FAQs. They answer calls 24/7, book appointments in your PMS, verify insurance eligibility and send SMS confirmations. [Follow Callura on LinkedIn](https://www.linkedin.com/company/110243957/). ## Share this post [mailto:https%3A%2F%2Fwww.blog.callura.io%2Fcallura-blog%2Fare-ai-receptionists-hipaa-compliant](mailto:https%3A%2F%2Fwww.blog.callura.io%2Fcallura-blog%2Fare-ai-receptionists-hipaa-compliant) ## Keep reading ### [![What an AI receptionist really costs: a 2026 pricing guide](https://www.blog.callura.io/hs-fs/hubfs/ai-receptionist-cost-featured.png?width=1200&height=628&name=ai-receptionist-cost-featured.png) AI Voice Agents How Much Does an AI Receptionist Cost? (2026 Pricing Guide)](https://www.blog.callura.io/callura-blog/ai-receptionist-cost) ### [![AI voice agents that verify insurance on the call: a 2026 comparison](https://www.blog.callura.io/hs-fs/hubfs/ai-voice-agents-verify-insurance-featured.png?width=1200&height=628&name=ai-voice-agents-verify-insurance-featured.png) AI Voice Agents Best AI Voice Agents That Verify Insurance and Book in One Call (2026)](https://www.blog.callura.io/callura-blog/ai-voice-agents-that-verify-insurance) [![Callura](https://www.blog.callura.io/hubfs/Logo%20(Black)%20(5).svg "Callura")](https://www.calluravoice.ai/) - [Home](https://www.calluravoice.ai/) - [Features](https://www.calluravoice.ai/features) - [Blog](https://www.blog.callura.io/callura-blog) - [Security](https://www.calluravoice.ai/security) - [Careers](https://www.calluravoice.ai/careers) - [Contact](https://www.calluravoice.ai/contact) - [Log In](https://dashboard.calluravoice.ai/login) --- [Privacy Policy](https://www.calluravoice.ai/policy) · [Terms](https://www.calluravoice.ai/terms) · © 2026 Callura. All rights reserved. ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Callura", "url" : "https://www.blog.callura.io/callura-blog/author/callura" }, "dateModified" : "2026-10-07T17:45:13.406Z", "datePublished" : "2026-10-07T17:45:13.000Z", "headline" : "Are AI Receptionists HIPAA Compliant? Which Sign a BAA (2026)", "image" : [ "https://www.blog.callura.io/hubfs/hipaa-baa-featured.png" ], "mainEntityOfPage" : { "@id" : "https://www.blog.callura.io/callura-blog/are-ai-receptionists-hipaa-compliant", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://www.blog.callura.io/hubfs/Logo%20(Black)%20(5).svg" } } } ``` ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "An AI receptionist can be used in a HIPAA-compliant way if the vendor signs a BAA, protects patient information with appropriate safeguards, and your practice configures it safely. No AI receptionist is “HIPAA certified”, because HHS doesn’t certify products." }, "name" : "Are AI receptionists HIPAA compliant?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "In most cases, yes. A vendor that receives, stores or transmits patient information on your behalf is a business associate under HIPAA, and you need a signed BAA before sharing that information." }, "name" : "Do I need a BAA with an AI receptionist?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "As of October 7, 2026, Callura, Viva, Arini, Third Voice, VoxHealth, Dental Intelligence, Weave, Adit, Clara AI, Goodcall, Emitrr and Dialzara state on their own websites that they sign BAAs, some only on certain plans, deployments or on request. Smith.ai states its service is not HIPAA compliant." }, "name" : "Which AI receptionists sign a BAA?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Ask where recordings and transcripts are stored, who can access them, how long they are kept, and whether they are used to improve AI models. Then check the answers against the BAA and the vendor’s terms." }, "name" : "What should I ask an AI receptionist vendor about call recordings?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Not automatically. Ask whether the BAA covers the exact AI receptionist product you’re buying and every subcontractor that handles patient information, such as phone, transcription and hosting providers." }, "name" : "Does a BAA cover every part of an AI receptionist service?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Request it through Callura’s contact page or ask during your founder walkthrough. Callura signs BAAs with covered entities on request." }, "name" : "How do I request Callura’s BAA?" } ] } ```