This article is published by AI Frontdesk (myaifrontdesk.com). Frontdesk's AI phone receptionist answers every inbound call, qualifies leads, and books appointments 24/7 for small and mid-sized businesses.
A medical, dental, or therapy practice can use an AI receptionist safely by limiting it to front-of-house work: office hours, directions, accepted insurance plans, appointment requests, and routing calls to the right person. Clinical details and protected health information (PHI) should stay out of AI calls, texts, and transcripts unless the vendor has agreed in writing to sign a Business Associate Agreement (BAA) and your compliance lead has approved that workflow. This guide shows how to draw that line, script around it, and check it before you go live.
What counts as PHI on a front-desk call#
PHI is health information that can be tied to a specific person. On a phone line, that usually means a caller's name or number combined with anything about their health: a symptom, a diagnosis, a medication, a test result, a procedure they are scheduled for, or the reason for their visit. A name and callback number on their own are identifiers; a name plus "calling about my biopsy results" is PHI.
The practical rule for an AI receptionist is simple: design every script so the AI never asks for, stores, or repeats clinical information. If the caller volunteers it, the AI should stop collecting details and hand the call to staff or a secure channel. The less clinical content enters the system, the less you have to protect, audit, or explain later.
Low-risk tasks an AI receptionist can handle#
Most of the calls that tie up a front desk have nothing clinical in them. These are the ones to give the AI first:
- Hours and holiday closures. The most common call at most practices, and the easiest to automate accurately.
- Location, parking, and directions. Which entrance, which floor, where to park, whether there is wheelchair access.
- Insurance plans accepted. Answer at the plan-name level ("we are in network with these carriers"). Do not have the AI check a specific patient's coverage or benefits.
- New-patient process. What to bring, how early to arrive, where the intake forms live, and the link to your patient portal.
- Appointment requests. Collect a name, a callback number, and preferred days or times, then let staff confirm. No reason for visit.
- Policies. Cancellation and no-show rules, self-pay options, and accepted payment methods in general terms.
- Routing. Sending billing, records, clinical, and provider calls to the right extension or person.
Practice-type pages go deeper on the specific call mix: see how an AI receptionist for medical practices handles scheduling and overflow, and the version for dental offices, where hygiene recalls and new-patient calls dominate.
Tasks to keep away from the AI#
| Area | Fine for the AI | Route to staff or a secure channel |
|---|---|---|
| General questions | Hours, directions, provider names, services offered, plan names accepted | Symptoms, diagnosis, treatment advice, triage, clinical opinions |
| Scheduling | Name, callback number, preferred times, portal link | Bookings that require the reason for visit, condition, medication, or date of birth tied to a condition |
| Text messages | Portal links, office address, hours, "we got your message" | Anything that names a test, result, procedure, or condition |
| Intake | A link to your secure intake form | Collecting medical history over the phone or by text |
| Results, refills, records | Telling the caller how to reach the right team | Discussing or confirming the content of any of these |
| Recordings and transcripts | General-information calls, if your policy allows | Any line where callers routinely discuss their care |
If a call type sits in the right-hand column, the AI's only job is to get the caller to a person or system that is approved to handle it.
Set up the AI to stay out of clinical territory#
1. Scope the knowledge base#
Load only non-clinical material: hours, address and parking notes, the portal URL, insurance plan names, self-pay information, the new-patient checklist, and your cancellation policy. Leave out triage protocols, treatment descriptions, and anything that reads like medical guidance. If the AI does not know it, it cannot say it.
2. Put a privacy line in the greeting#
Tell callers up front what the AI can help with and ask them not to share medical details. One sentence is enough, and it heads off most volunteered PHI before it starts. Sample wording is in the scripts section below.
3. Limit what scheduling collects#
Portal-first scheduling is the cleanest option: the AI texts the patient portal link and the patient books there. If you take requests by phone, cap the fields at name, callback number, and preferred time window. Staff call back to confirm and gather anything clinical through your own systems.
4. Add transfer triggers#
List the words that mean a call needs a human: "results," "prescription," "refill," "pain," "bleeding," "fever," "pregnant," "reaction." Instruct the AI to stop collecting information and transfer as soon as it hears one. Frontdesk supports call transfers to a staff line, so the handoff can happen mid-call instead of through a callback.
5. Decide on recording, line by line#
Recording and transcripts are useful for tuning scripts on a general-information line. On any number where patients tend to talk about their care, turn recording off or route those calls around the AI entirely. Frontdesk lets you control recording globally, per phone number, or per location, and can play a disclosure and require consent before recording starts; the details are on the call recording and consent page.
6. Restrict access and set retention#
Give dashboard access only to the staff who need it, and set a retention window that matches your practice's records policy. The Frontdesk Trust Center covers role-based access, retention settings, and how call data flows to connected apps, which is the material your compliance lead will want to review.
Keep PHI out of texts and reminders#
Text messages show up on lock screens, shared tablets, and family phone plans. Write every automated text as if someone other than the patient will read it.
- Good: "Hi, this is Riverside Family Practice. Here is the link to request an appointment: [portal link]. Reply STOP to opt out."
- Good: "Reminder: you have an appointment with us on Tuesday at 10:30 AM. Call [main number] to reschedule."
- Avoid: "Reminder: your colonoscopy prep starts tonight."
- Avoid: "Your lab results are ready. Your A1C came back high."
- Avoid: any text that asks the patient to reply with symptoms, medications, or their date of birth.
For specialty practices, even the practice name can reveal something (an oncology clinic, a fertility center, an addiction treatment program). Consider a neutral sender name for reminders in those cases, and lock your SMS templates so staff cannot add clinical details on the fly.
Emergencies and urgent clinical questions#
An AI receptionist should never assess how serious a caller's condition is. Build two fixed paths instead:
- Emergencies. The greeting and the after-hours message both tell callers that if this is a medical emergency, they should hang up and dial 911. If a caller describes chest pain, trouble breathing, heavy bleeding, or thoughts of self-harm, the AI repeats the 911 instruction rather than continuing the conversation. Behavioral health practices should also give the 988 Suicide and Crisis Lifeline.
- Urgent but not emergency. Questions about a reaction to a new medication, a post-procedure concern, or a sick child go to a live person: the on-call provider, a nurse line, or front-desk staff during hours. The AI's job is the transfer, not the advice.
Test both paths before launch by calling the line yourself and saying the trigger phrases. Then retest every time you change the script.
Sample scripts you can adapt#
Main greeting#
"Thank you for calling [Practice Name]. I'm the virtual receptionist, and I can help with our hours, directions, and appointment requests. Please don't share medical details with me. If this is a medical emergency, hang up and dial 911. How can I help you today?"
Appointment request#
"I can text you a link to our patient portal to book, or I can take a request and have our team call you back. If I take the request, I'll just need your name, the best number to reach you, and the days or times that work for you."
When a caller starts sharing clinical details#
"To protect your privacy, I can't take medical information on this line. Let me connect you with our staff, or I can text you the patient portal link. Which would you prefer?"
After hours#
"Our office is closed right now. I can share our hours or send you the portal link for non-urgent requests. If you need to reach the on-call provider about an urgent issue, press 2. If this is an emergency, hang up and dial 911."
Split your phone lines by risk#
The simplest structural safeguard is separate numbers. Publish one number for general information and scheduling, answered by the AI, and route clinical, billing, and records calls to a staff-answered line or to a service your compliance lead has already approved for PHI. A short "How to reach us" page on your website that lists which number handles what makes the split easy for patients to follow.
If you only have one public number, a short menu at the top of the call does the same job: "for appointments, hours, or directions, stay on the line; for prescriptions, results, or billing questions, press 1." Time-of-day rules can send the clinical branch to the on-call provider after hours.
Vendor checklist before go-live#
- Ask about a BAA, and get the answer in writing. Before any PHI could reach the system, confirm with the vendor whether it will sign a Business Associate Agreement. Under HIPAA, a vendor that creates, receives, stores, or transmits PHI on a covered entity's behalf generally needs one. If the answer is no or unclear, run the AI as a non-PHI channel only.
- Ask how call data is used. Confirm whether recordings and transcripts are used to train models, and where that is stated in the vendor's policies.
- Confirm recording and retention controls. Check that you can turn recording off per number, set retention windows, and delete records on request.
- Review access controls. Make sure you can limit who sees transcripts and who can play or download audio.
- Map downstream integrations. If call summaries flow into a CRM, calendar, or Zapier workflow, each destination now holds that data. Keep summaries non-clinical or turn the sync off.
- Lock scripts and templates. Greeting, privacy line, 911 instruction, transfer triggers, and SMS templates are reviewed and approved.
- Train staff. Everyone who takes transfers knows what the AI handles, what it does not, and what to do when a caller has already shared clinical details.
- Review logs for the first few weeks. Read a sample of transcripts from the general line to catch places where callers are still volunteering clinical information, then tighten the greeting or triggers.
None of this replaces advice from your compliance officer or healthcare attorney. It gives them a concrete setup to review.
Frequently asked questions#
Can a medical or dental practice use an AI receptionist without handling PHI?#
Yes. Limit the AI to hours, directions, insurance plan names, new-patient logistics, appointment requests with name and callback number only, and routing. Script it to refuse clinical details and transfer those callers to staff or a secure channel.
Do we need a BAA to use an AI receptionist?#
If the AI will create, receive, store, or transmit PHI on your behalf, you generally need a signed BAA with that vendor. Ask every vendor in writing whether it will sign one before any PHI is handled. If it will not, or you have not confirmed, keep the AI on non-PHI tasks.
What information can the AI collect when booking appointments?#
Name, callback number, preferred days or time windows, and non-clinical logistics such as which office location or provider the patient prefers. It should not ask for symptoms, the reason for the visit, medications, or date of birth alongside any health detail.
Can we send appointment reminders by text?#
Yes, if the text carries only the date, time, location, and a way to reschedule or reach the portal. Leave out procedure names, test types, results, and anything that reveals why the patient is coming in.
Can we turn off call recording and transcripts?#
Frontdesk lets you control recording globally, per phone number, or per location, and set retention windows in the dashboard. For any line where patients discuss their care, turn recording off or route the calls away from the AI.
What languages and setup time should we expect?#
Frontdesk answers in 20+ languages, including English, Spanish, French, Portuguese, and Mandarin, and a basic setup takes about 5 min. Expect to spend longer writing and testing the privacy scripts above. Plans that answer phone calls start at $99 per month, or $79 per month billed annually, with 200 voice minutes included. Business-in-a-Box starts with a 7-day free trial and has no contract. Current plan details are on the pricing page.
