A patient chatbot your compliance officer will actually sign off on.
A chatbot on a medical practice’s website will collect protected health information whether you plan for it or not. We build custom, HIPAA-aware assistants inside a BAA-covered boundary — so you get 24/7 intake without the compliance liability.
Security review led by a CISSP-certified practitioner, and available paired with a full HIPAA Security Risk Assessment.
The chatbot on your medical site is probably a breach waiting to happen.
Practices add a website chatbot for a good reason — patients want fast answers, and a bot that captures inquiries 24/7 clearly beats a contact form nobody fills out. The problem is what patients actually type into it. They don’t stay on script. They describe symptoms, list medications, mention a diagnosis, and explain exactly why they need to be seen. The moment they do, that conversation contains protected health information.
Most chatbots bolted onto a medical site were never built to hold PHI. They’re e-commerce and marketing tools that store conversations, pipe them through analytics and advertising pixels, and run on AI models that may retain and train on whatever is sent. There’s no Business Associate Agreement covering the model, no documented data flow, and no audit trail. Under HIPAA, that’s an impermissible disclosure — a reportable breach, complete with patient notifications, a possible OCR filing, fines, and the kind of trust damage a local practice can’t easily undo.
The fix isn’t to avoid a chatbot — it’s to build one correctly. We design custom, HIPAA-aware assistants inside a BAA-covered boundary, with zero-retention model endpoints, least-privilege access, audit logging, and a data flow your compliance officer can trace end to end. You get the 24/7 intake you wanted, without quietly manufacturing liability every time a patient says what’s wrong.
Six things a medical chatbot must have.
Every one of these is built in from the start — not bolted on after a patient has already typed something sensitive.
BAA across the whole chain
A signed Business Associate Agreement covering both the chat platform and the AI model behind it. The chain is only as compliant as its weakest link — a BAA with the widget vendor means nothing if the model provider won’t sign one.
Zero-retention model endpoints
The AI runs against BAA-covered, zero-data-retention endpoints, so patient messages are never stored by the model provider or used to train or improve any model.
Controlled, documented data flow
You can draw the exact path every message takes — browser to platform to model to storage — with no hidden forks into analytics, advertising pixels, or marketing tools.
Least-privilege access + audit logs
Only authorized staff can read conversations, every access is logged, and the system produces an audit trail your compliance officer can actually use in a review or investigation.
Trained on your practice
It knows your services, providers, locations, and intake criteria — not generic medical information — and is designed to escalate anything clinical or sensitive to a human rather than improvise.
Documented in your SRA
The chatbot, its data flow, and its vendors are reflected in a current Security Risk Assessment. We can deliver that assessment too, so the tool and its paperwork match.
Related reading: is ChatGPT HIPAA compliant?, HIPAA Security Risk Assessment, and healthcare AI automation.
Compliance designed in, not bolted on.
Scope & data-flow design
We map exactly what the chatbot will handle, what counts as PHI in your context, and the precise path every message will take — then design the BAA-covered boundary around it before writing a line of code.
Vendor & BAA chain
We select platform and model providers that will sign BAAs and offer zero-retention endpoints, and we get those agreements in place so the entire chain is covered, not just the front end.
Build & train on your practice
We custom-train the assistant on your services, providers, and intake rules, with guardrails that escalate clinical or sensitive questions to a human instead of guessing.
Document & hand off
We document the data flow and vendors in your Security Risk Assessment and give your compliance officer what they need to sign off with confidence.
Built for practices that handle real patient data.
Primary care & specialty clinics
Capture new-patient inquiries and answer routine questions 24/7 without routing symptom details through a non-compliant widget.
Dental & orthodontics
Handle appointment requests, insurance questions, and new-patient intake with messaging built for PHI from the start.
MedSpas & aesthetics
Book high-value consultations and answer treatment questions while keeping any health information inside a compliant boundary.
Behavioral & mental health
Where sensitivity is highest, a purpose-built, audit-logged assistant protects patients and the practice alike.
HIPAA-compliant chatbots — frequently asked questions.
What makes a chatbot HIPAA compliant?
Compliance is a property of architecture and contracts, not a badge you buy. A HIPAA-compliant chatbot has a signed BAA with every vendor that touches PHI, encryption in transit and at rest, zero-retention model endpoints, least-privilege access, audit logging, and a data flow documented in your Security Risk Assessment. If any one of those is missing, the tool isn’t compliant no matter what the marketing says.
Does a website chatbot really handle protected health information?
Almost always. Patients volunteer symptoms, medications, and reasons for their visit regardless of what you intended the chatbot to do — it’s human nature to just say what’s wrong. The only safe design assumption is that the chatbot will handle PHI, which means it must be architected for compliance from day one rather than hoping patients stay generic.
Can we just use an off-the-shelf chatbot builder?
Rarely, and it’s the most common way practices create risk. Most chatbot builders were designed for e-commerce and marketing; they can’t sign a BAA that covers both their platform and the underlying model, and they often store conversation data or use it to improve their models. That’s exactly the exposure HIPAA is meant to prevent, which is why medical chatbots are typically purpose-built.
What actually happens if we get this wrong?
An impermissible disclosure of PHI through a non-compliant chatbot is a reportable breach. That can mean notifying every affected patient, a filing with the HHS Office for Civil Rights, potential fines, and — often most damaging for a local practice — the public erosion of patient trust. The cost of building it correctly is trivial next to the cost of a breach.
Will a compliant chatbot still feel helpful, or is it locked down to uselessness?
It stays genuinely useful. Compliance governs how data is handled, not how helpful the assistant is. Because it’s trained specifically on your practice, it answers new-patient questions, explains services, and guides scheduling accurately — while escalating anything clinical to a human. Patients get fast answers; you get a defensible data flow.
Who leads the security work?
Our security review is led by a CISSP-certified practitioner — the same expertise behind our HIPAA Security Risk Assessments. Every build is scoped to the confidentiality and compliance your practice requires, and we can pair the chatbot with a full SRA so the tool and its documentation line up.
Can it integrate with our scheduling or EHR?
Yes, where appropriate and inside the compliant boundary. We can connect it to your scheduling system so patients book directly, and integrate with other systems as your workflow requires — always keeping PHI within the BAA-covered chain.
How much does a HIPAA-compliant chatbot cost?
A custom-trained assistant starts at $1,500 as a single build, with larger engagements that combine the chatbot with website, automation, or a Security Risk Assessment ranging higher. Every engagement starts with a discovery call to scope the right fit and the right level of compliance documentation.
Add AI to your practice without the risk.
Book a discovery call. We map where a compliant chatbot fits your intake and show you exactly how the data flow stays inside a BAA-covered boundary.