AI can save dental and medical practices hours a week on front-office and administrative work: patient intake, appointment reminders and rescheduling, insurance verification and paperwork, routine patient messages, and drafting documentation for a clinician to review. The catch is patient data. Under HIPAA, any outside service that creates, receives, stores or transmits protected health information (PHI) for your practice is a business associate, and you need a signed business associate agreement (BAA) with it before it touches that data. That includes AI tools. Use AI where it fits, only through vendors that will sign a BAA, send it only the information it needs, and keep a person reviewing anything clinical.
This post is general information, not legal advice. Check specific decisions with your compliance officer or a healthcare attorney.
Where AI helps in a practice
Most of the time savings are in the front office, not the exam room.
Patient intake
New-patient forms, medical history updates and insurance cards are still re-typed into the practice management system at many offices. AI can read completed digital forms and photos of insurance cards, fill in the right fields, and flag anything missing or unclear for staff to check before the visit.
Scheduling, reminders and rescheduling
Automated confirmations and reminders cut no-shows, and two-way messages let patients confirm or ask to reschedule without a phone call. When someone cancels, the system can offer the opening to patients on a waitlist. These usually run through your scheduling or practice management system, or tools connected to it.
Insurance verification and paperwork
Checking eligibility, gathering pre-authorization details and organizing claim attachments are repetitive, rules-heavy tasks. AI can pull the right details from documents and payer responses into a summary for your billing staff, who still make the decisions and submit the claims.
Patient messages and phone calls
Questions like "What are your hours?", "Do you take my insurance?" and "How do I prepare for my appointment?" can be answered automatically from approved information. Anything about symptoms, results or treatment should go to staff, with the message already summarized and routed to the right person.
Clinical documentation
AI tools that draft visit notes from a recorded conversation or a clinician's dictation are now common. They can save significant time, but the clinician must review and sign every note. The AI drafts; the clinician decides what goes in the record.
Reports and operations
Daily schedules, production reports, recall lists and outstanding balances can be pulled together automatically instead of built by hand in spreadsheets.
What HIPAA means for AI tools
HIPAA doesn't ban AI. It applies the same rules to AI tools that it applies to any other service your practice uses.
Any AI vendor that handles PHI is a business associate. HHS describes a business associate as a person or organization that performs functions on behalf of a covered entity "that involve creating, receiving, maintaining, or transmitting" PHI (HHS, Business Associates FAQs). If you paste patient information into an AI tool, or connect it to your systems, the vendor is handling PHI.
You need a BAA first. HHS's cloud guidance says a practice may use a cloud service to store or process electronic PHI "provided the covered entity or business associate enters into a HIPAA-compliant business associate contract or agreement (BAA)" with that provider (HHS, HIPAA & Cloud Computing). It applies even when the vendor can't read the data: an entity that maintains electronic PHI for you "is a business associate, even if the entity cannot actually view the ePHI."
The BAA chain continues downstream. If your vendor uses its own subcontractors, such as an AI model provider behind a scheduling or scribe tool, HHS says the business associate "must establish a BAA with its subcontractor before disclosing PHI" to it (HHS). Ask your vendors how they handle this.
Consumer AI accounts are the most common risk. A staff member pasting a patient's details into a free or personal AI chat account almost certainly has no BAA behind it. Many AI providers offer business or healthcare plans with a BAA, usually with specific settings that must be turned on. Make sure staff know which tools are approved, and block the rest.
Send only what's needed. HIPAA's minimum necessary standard requires covered entities to "take reasonable steps to limit the use or disclosure of, and requests for, protected health information to the minimum necessary to accomplish the intended purpose" (HHS). An AI step that drafts an appointment reminder doesn't need a patient's diagnosis or full chart.
De-identified data is different. Health information properly de-identified under HIPAA's Expert Determination or Safe Harbor methods is no longer PHI (HHS). That can open up options for reporting and analysis, but de-identification has specific requirements. Removing the patient's name isn't enough.
Questions to ask any AI vendor
- Will you sign a business associate agreement, and on which plan?
- Is our data used to train your models? Can that be turned off, and is it off by default on our plan?
- Where is data stored, for how long, and how is it deleted?
- Which subcontractors (including AI model providers) receive our data, and do you have BAAs with them?
- How is access controlled and logged? Can we see who accessed what?
- Does it connect to our practice management or EHR system, and how?
- What happens when the AI is wrong, and how do our staff review its output?
If a vendor can't answer these clearly, it isn't ready for patient data.
Safe ways to start
- Start with work that doesn't touch PHI. Marketing content, general FAQs, staff training materials, job descriptions and internal procedures are a safe place to learn how AI fits your office.
- Then pick one administrative workflow with high volume and clear rules, like reminders and rescheduling, intake forms or insurance paperwork. Our guide on what to automate first explains how to choose.
- Use tools with a BAA and connect them properly, rather than having staff copy and paste between systems.
- Keep a person in the loop for anything clinical, financial or sent to patients, at least until a workflow has proven reliable.
- Write a short AI policy covering approved tools, what data may go into them, and who reviews the output. Then train staff on it. Our AI readiness checklist includes the basics.
- Update your HIPAA risk analysis to include each new AI tool and integration.
When off-the-shelf tools aren't enough
Many practices can get a long way with AI features built into their practice management, phone or scheduling systems. Custom work makes sense when you need to connect systems that don't talk to each other, automate a workflow no product handles, or give patients or field staff a tool built around how you actually work.
We've built healthcare software for organizations including American River Healthcare, where we built a custom web application that plans optimized daily routes for home health nurses; APA Medical, where we built a platform that connects HubSpot with their medical billing platform; and SeeInMe, a care app that helps care teams personalize care. Our healthcare web and software development page covers that work in more detail.
Get a plan before you buy tools
Our AI Readiness Audit maps how work flows through your practice, from the front desk to billing, and gives you a ranked, costed list of what to automate, including where AI is safe to use with patient data, where a person must stay in the loop, and which policies you need. The price is fixed and agreed before we start, and the roadmap is yours to keep.
Book a free call and tell us where your team's time goes. We'll tell you what we'd automate first, and what we'd leave alone.