AI for healthcare and medical practices: front desk, patient messages and HIPAA basics

General information, not legal advice. Talk to your compliance adviser about your practice’s specific obligations.

Who this is for

Small and mid-size practices of most kinds, including primary care and family medicine, dental, physical and occupational therapy, chiropractic, optometry, behavioral health, and specialty clinics. The details differ, but the front-office work is remarkably similar.

Where the time goes

Ask any practice manager and you’ll hear some version of this list:

• Phones: appointment requests, reschedules, directions, “do you take my insurance?”
• Scheduling and reminders: confirmations, no-shows, recalls and waitlists.
• Intake: forms, histories and consent paperwork, often re-typed from paper or PDFs.
• Insurance and billing admin: eligibility questions, documentation requests and claim follow-ups.
• Patient messages: portal and email questions, many of which repeat.
• Internal questions: “how do we handle…?”, “where’s the form for…?”

Much of that is repeated, text-heavy work, which is exactly where today’s AI is most useful.

Start with tasks that don’t touch patient information

You can get real value before any patient information is involved:

• An internal assistant for staff that answers from your own procedures, policies and office manual: “What’s our late-cancellation policy?”, “How do we process a records request?”
• Public FAQs on your website: hours, location, parking, accepted insurance types, what to bring to a first visit. This is general information, not anyone’s health information.
• Drafting general communications: office closure notices, new-service announcements, recall-campaign wording before it’s personalised.
• Summarising payer policies and manuals so staff can find answers faster.

These are low risk and teach your team how AI behaves before anything sensitive is involved.

When patient information is involved: HIPAA in plain words

HIPAA’s rules apply to “covered entities”, which include health care providers that transmit health information electronically in connection with certain standard transactions such as claims. They also apply to the vendors that handle protected health information (PHI) on a provider’s behalf. ^[1]

Business associates and BAAs

A business associate is, generally, a person or company outside your workforce that creates, receives, maintains or transmits PHI on your behalf. HHS’s own list of examples includes cloud service providers that store or process electronic PHI, IT vendors that support systems containing PHI, and, specifically, a “third-party vendor Artificial Intelligence (AI) chatbot on a provider’s patient portal” that handles things like symptom assessment, reminders and scheduling. ^[1]

Before a business associate handles PHI for you, HIPAA requires a written business associate agreement (BAA). Among other things, the agreement limits how the vendor may use and disclose the information, requires it to safeguard the information, and requires it to report security incidents and breaches to you. ^[1][2] HHS publishes sample BAA provisions that show what these agreements cover. ^[2]

Two points practices often miss:

• “We encrypt it” doesn’t remove the need for a BAA. HHS guidance says a cloud provider that stores electronic PHI is a business associate even if the data is encrypted and the provider doesn’t hold the key. ^[3]
• It flows downstream. If your vendor uses its own subcontractor to handle PHI, that subcontractor is a business associate too, and needs its own agreement with your vendor. ^[1]

In practice: don’t put patient information into any AI tool unless the vendor will sign a BAA, and check that the specific product and plan you’re using is covered.

What the HIPAA Security Rule asks for, in summary

The Security Rule applies to electronic PHI and to both providers and their business associates. HHS summarises its main requirements as including ^[4]:

• Risk analysis and risk management: an accurate, thorough assessment of the risks to electronic PHI, and measures to reduce them.
• A designated security official responsible for your security policies.
• Access control: only authorised people can reach electronic PHI, and access fits each person’s role.
• Audit controls: a way to record and review activity in systems that contain electronic PHI.
• Security awareness and training for your whole workforce.
• Contingency planning: backups, restoring lost data, and continuing to operate in an emergency.
• Business associate agreements before a vendor creates, receives, maintains or transmits electronic PHI for you.

The rule is designed to be flexible and scalable, so a small practice isn’t held to the same specific measures as a hospital system. It still has to make reasonable, documented choices. ^[4] HHS has also proposed changes to the Security Rule, so check the HHS site for current status. ^[4]

For a practical starting point, the federal Office of the National Coordinator for Health IT offers a free Security Risk Assessment (SRA) Tool, designed for small and medium providers, that walks you through a risk assessment. ^[5]

Where AI fits: any AI tool that touches PHI belongs in that risk analysis. Ask what it can see, who can see its output, where its data is stored, and how you’d know if something went wrong.

Examples by type of practice

These are illustrative examples, not descriptions of any specific practice.

Primary care and specialty clinics. An assistant drafts replies to common portal messages (“How do I get my lab results?”, “Can I get a refill?”) for staff to review. Intake forms are read and the key details entered into the right fields for staff to confirm.

Dental practices. Recall and reminder messages are drafted and scheduled, insurance documentation requests are summarised for the front desk, and website FAQs about new-patient visits answer questions after hours.

Physical therapy and chiropractic. Reschedule requests are triaged and routed, home-exercise handouts are drafted from the clinician’s notes for the clinician to approve, and no-show follow-ups are drafted automatically.

Behavioral health. Admin tasks like scheduling and intake paperwork can benefit, but this is an area for extra caution. Some records carry extra federal protections. For example, substance use disorder treatment records covered by 42 CFR Part 2, and psychotherapy notes under HIPAA. ^[6] Keep AI to administrative tasks unless your compliance adviser has reviewed the use.

Optometry. Recall reminders, eyewear-order status questions, and insurance and benefits questions are drafted for staff.

In every case, a person reviews anything clinical or patient-specific before it goes out. AI drafts, and your staff decide.

Questions to ask any AI vendor

1. Will you sign a BAA? For which products and plans exactly?
2. Is our data used to train or improve your models? Can that be turned off?
3. Where is PHI stored, and for how long? Can we delete it?
4. Who at your company can access it, and is that access logged?
5. Do you use subcontractors that handle PHI, and do you have BAAs with them?
6. How and how fast will you tell us about a security incident or breach?
7. Can we control user access by role, and remove people the same day they leave?
8. Is multi-factor authentication available and enforced?

How to get started

1. Pick one front-office task that repeats daily, ideally one that starts without PHI.
2. Measure it for a week: how many calls, messages or forms, and how long they take.
3. Add it to your risk analysis if PHI will be involved, and get a BAA in place first.
4. Run a small trial with a few staff, with clear rules: what AI may draft, what a person must approve, and what it must never do.
5. Decide with your numbers after a few weeks: keep it, fix it or stop.

There’s more on this approach in How to start with AI without wasting money, and general data rules in AI and your business data.