Before any tool hears a patient call
What to require of a HIPAA-compliant AI receptionist
Deeplathe does not claim HIPAA compliance. This page is one checklist: what to require before any tool hears a patient call. A business associate agreement, no training on those calls, and access controls. Whether your practice is covered is for you and your counsel.
Consumer plans and team plans are not the same promise. Read whether business data is safe in a chat tool, which plan a shop should pay for, and how to get staff using the tools without pasting a chart.
Ask for a business associate agreement in writing
Before the first patient call is sent anywhere, ask the vendor to sign a business associate agreement. Ask which subcontractors sit on the path of the audio and the transcript. Write the answers down. A logo that says compliant is not that contract.
- Email the vendor and ask for the agreement before any recording is turned on.
- Ask them to name every company that stores or transcribes the audio.
- Do not send a live patient call until the signed agreement is in your file.
Require no training on patient calls
Ask where the audio is stored, how long it is kept, who can export it, and whether recordings or transcripts are used to train a general model. The answer you want is a setting you can see, plus a sentence in the contract. A line on a marketing page is not enough.
Require named access
Ask for a named login per person, a record of who opened a call, and a way to remove someone who leaves the practice. Test the removal with a dummy login before you trust it.
Strip the transcript before it touches a chat tool
If you paste a voicemail into a chat tool to make a booking note, take the name, the number, and the address out first. The article linked below shows the bracket method. Put the real details back only in the system your practice already uses.
If you would rather have it built
Deeplathe builds custom AI inside the system a practice already uses. If that work would touch patient calls, raise the agreement, the training rule, and the access list before anything is built. This page does not say that contract is signed. Deeplathe does not claim HIPAA compliance.
Questions
Is Deeplathe HIPAA compliant?
No. Deeplathe does not claim HIPAA compliance, and this page does not say otherwise. It lists what a practice should require of any tool before that tool hears a patient call.
What should we require before a tool hears patient calls?
A business associate agreement, a prohibition on training a model on those calls, and access controls that limit who can open a recording or a transcript.
Does signing a BAA by itself make a vendor compliant?
No. A business associate agreement is the contract a covered practice asks for. It is one requirement. Storage, training use, and access still have to be answered in writing.
Can I paste a patient voicemail into a chat tool?
Not with the name, number, or address still in it. Strip those first. The private-details article shows how. Put the real details back only inside the system the practice already uses.