HIPAA and AI for Medical Practices: Ask Vendors

Can a medical practice use AI and still follow HIPAA?

Yes, with care. HIPAA does not ban AI. It sets rules for how protected health information is used, shared and secured. A practice can use an AI vendor if the vendor signs a business associate agreement where it handles patient information, the tool sees only the minimum data it needs, and the practice keeps its own safeguards.

This post is general information, not legal advice. Your practice remains responsible for its own HIPAA compliance program, so involve your compliance lead or counsel before you buy.

Is there such a thing as HIPAA certified AI?

No government body issues a HIPAA certification for software. The Department of Health and Human Services does not certify or endorse products as HIPAA compliant. When a vendor says it is HIPAA certified, treat that as a marketing phrase and ask what it actually means: which safeguards exist, and which agreements the vendor will sign.

Compliance is a property of how a practice and its vendors handle information together, not a badge on a product. A vendor can be a good fit and still never use the word certified. We do not claim a certification, and we would be wary of anyone who offers one as proof.

What is a business associate agreement?

A business associate agreement, or BAA, is the contract HIPAA expects between a covered entity, such as a medical practice, and a vendor that creates, receives, stores or sends protected health information on its behalf. It spells out what the vendor may do with the data, how it protects it and how it reports a breach.

Every vendor in the chain that touches patient information may need one. If an AI receptionist runs on a speech service and a language model, ask whether those providers are covered too, or whether patient details are kept out of them by design.

What does minimum necessary mean?

Minimum necessary is the HIPAA principle that a use or disclosure of patient information should be limited to what the task requires. For AI, it means designing each step to receive as little as possible. A scheduling agent can book from a name, a phone number and a time slot without ever seeing a chart.

This is the most practical design question you can ask. The less patient detail an AI step handles, the smaller the risk and the fewer contracts you need. Good designs separate the steps that need patient data from the ones that do not.

What should you ask an AI vendor?

Ask questions that produce specific answers, and get those answers in writing before you sign. The table below covers most of what a practice should settle with any AI vendor, from the business associate agreement to data retention. A vague answer to any of them is information in itself.

What should an AI receptionist never do?

It should never give medical advice, triage symptoms or handle an emergency. It should answer approved questions such as hours, location and how to book, schedule and reschedule appointments, and hand anything clinical to a staff member. For emergencies, it should tell callers to dial 911 and stop.

Limits are a design decision, written down before the build and tested with real calls. A practice should expect to approve the script, review early call logs and know exactly when the agent transfers a call to a person.

How does Cuanto Labs approach AI for medical practices?

We build in a HIPAA-aware way and do not claim a compliance certification. That means using vendors who will sign a BAA where protected health information is involved, sending as little patient information as each step needs, limiting access to the job and logging every action. Work that touches patient data is scoped separately first.

Projects are priced like other AI agent work: fixed price from $5K, typically 2 to 6 weeks, set in a written proposal after a discovery call. Code, repositories and accounts transfer to you at handover. Details are on AI for medical practices in South Florida.

Frequently asked questions

Does patient information go into the AI model?

Only if a step needs it, and designs should keep that to a minimum. Where PHI must pass through a vendor, use one that signs a BAA.

Can AI send appointment reminders?

Yes. Reminders can carry the minimum detail, such as a time and a reply option, with a person stepping in when a patient asks a question.

Do we need a BAA with every tool?

Generally with each vendor that handles PHI for you. Your compliance lead or counsel should confirm for your setup.

Is a free chatbot fine for patient questions?

Be cautious. Consumer tools rarely offer a BAA, so keep patient details out of them.

Who is responsible if something goes wrong?

Both sides have duties, but your practice stays responsible for its compliance program. Choose vendors that put their commitments in writing.

Next step

• • AI for medical practices in South Florida
• • AI voice receptionist for Florida businesses
• • AI voice receptionist cost in Florida

Written by Eliran Yihye, founder of Cuanto Labs, on October 15, 2026. Not legal advice.