Built for healthcare, with a BAA
A HIPAA-compliant AI receptionistwith a BAA signed before go-live.
BAA, PHI handling, and audit logging
What makes an AI receptionist HIPAA compliant, and how Echo meets that standard
Echo Booking is a HIPAA-compliant AI receptionist for medical practices and imaging centers. It signs a Business Associate Agreement (BAA) before go-live and handles PHI with encryption in transit and at rest, role-based access controls, and full audit logging across every channel: voice, text, email, and forms.
Hear it for yourself
A real call from inquiry to booked appointment.
Echo in action
0:00 / 0:00
In short
Key takeaways
- A HIPAA-compliant AI receptionist handles PHI under a signed Business Associate Agreement, with encryption in transit and at rest, role-based access, and audit logging.
- AI is not automatically compliant. It depends entirely on how the system is built and operated, which is why the BAA is the first thing to ask for.
- Echo executes the BAA before any patient contact is handled, not after go-live.
- The same control set covers voice, text, email, and web forms. Compliance that stops at the phone line isn't compliance.
- Patient data is not used to train models, and each workflow is configured to the minimum-necessary standard.
The capability
How to tell whether an AI receptionist is really HIPAA compliant
A HIPAA-compliant AI receptionist handles protected health information under the safeguards a covered entity requires: a signed Business Associate Agreement, encryption in transit and at rest, role-based access, and audit logging.
Nobody issues a HIPAA certification, which is why every vendor claims compliance. Four yes-or-no questions separate them: will you sign a BAA for this service, is PHI encrypted in transit and at rest, is access logged by role, and do patient conversations train the model?
Echo answers yes, yes, yes, and no, across voice, text, and forms. Minimum-necessary rules govern what the AI will say back to a caller, and your compliance officer can pull the audit trail without a support ticket.
The problem
What breaks without it
How Echo does it
What hipaa-compliant AI looks like with Echo
- General-purpose AI isn't built for PHIA consumer chatbot isn't designed to handle protected health information and won't sign a BAA.
- Encrypted in transit and at restCalls, transcripts, messages, and form submissions, including recordings and AI summaries.
- A missing BAA is your practice's exposureWithout one, a vendor touching PHI puts your compliance at risk, and many AI tools simply won't provide one.
- A signed BAA before the first callEcho executes a Business Associate Agreement with every customer before any patient contact is handled.
- Compliance has to span every channelPatients reach you by phone, text, and form, and PHI doesn't respect channel boundaries.
- One control set across every channelVoice, text, email, and digital forms are covered by the same safeguards. Compliance that stops at the phone line isn't compliance.
- "Trust us" isn't an access controlAn audit asks who accessed what and when, which is a log, not an assurance.
- Role-based access, and every access loggedStaff see only what their role permits, and the audit log is what an investigation actually asks you to produce.
- Model training is where data quietly leaksA vendor that improves its models on your conversations has made your patients part of the product.
- Built for healthcare, not adapted to itPatient data is not used to train models, and each workflow is configured to the minimum-necessary standard.
Mobile first, light by design
Turn every patient conversation into answers, not reports.
Because Echo answers the calls and books the visits itself, it sees every conversation, and reads them back against your live schedule as answers about your practice.
So ask the questions that actually run the practice.
- Ask it to call a patient back, from your palm.
- Pull today's numbers without opening a report.
- No extra tab to monitor or workflow to change.
- Built to stay hidden and work for you.
- Get push notification when a human needs to step in.
Ask in plain English, get a number, a chart, or the transcript behind it, then hand the follow-up back to the agent who owns it, from your phone.
Incoming messages
Patients reach you
Booking requests
New patients and reschedules booked straight into the schedule, by your rules.
After-hours calls
Nights, weekends, lunch, and every busy moment in between, answered, never voicemail.
Patient messages
Texts, emails, and web forms answered on their own, handed to your team when it matters.
Outgoing messages
Echo reaches patients
How it works
How Echo handles PHI
HIPAA compliance for an AI front desk is a set of specific, checkable controls, not a badge. These are the ones that apply before the first call.
A BAA is signed before the first call
Echo executes a Business Associate Agreement with every paid customer before any patient contact is handled. If a vendor cannot show you the BAA, that is the whole answer.
PHI is encrypted in transit and at rest
Calls, transcripts, messages, and form submissions are encrypted end to end and stored encrypted, including recordings and AI summaries.
Access is role-based and logged
Staff see only what their role permits, and every access is recorded in an audit log, which is what an investigation or an audit actually asks you to produce.
The same standard spans every channel
Voice, two-way text, email, and digital forms are covered by one control set. Compliance that stops at the phone line is not compliance.
How Echo Booking compares
Don't buy another tool. Buy less work.
One patient request
Turn calls, texts, and emails into booked appointments
Incoming call, text, email, or fax
Deep integrations, so Echo knows the patient before saying "Hello"
Custom scheduling rules, so no patient lands in the wrong slot
Booked on autopilot
Echo finishes
How does Echo handle a patient from first contact to recall?
- Calls, texts, emails and faxes all land in one place
- Answered 24/7, including nights and weekends
- Speaks with each patient in their own language
- Identifies who it is and what they need
- Picks up the thread instead of leaving a message to return
Step 1 of 7
Incoming call, text, email, or fax
- Calls, texts, emails and faxes all land in one place
- Answered 24/7, including nights and weekends
- Speaks with each patient in their own language
- Identifies who it is and what they need
- Picks up the thread instead of leaving a message to return
Why practices choose Echo
What makes Echo different
Only three things matter: whether it knows your booking logic, whether it completes the work inside your system, and what it costs your front desk to adopt.
- Scheduling rules engineEcho lands the slot your front desk would have picked, not whichever one happens to be open.
- Deep integrationsEcho reads and writes the fields your workflow actually runs on in your RIS or EHR, so the work leaves your desk instead of coming back as a task.
- Mobile firstOne light app that pings your team only when a person is genuinely needed. No dashboard to check each morning.
| Capability | Echo BookingCarries the task to done | Hiring more staffFront desk headcount | Generic AI voice botAnswers the phone, stops there |
|---|---|---|---|
| Signing a BAA | Executed with every customer before the first patient call is answered. | Your own staff are workforce members, so no BAA is needed. | Many general-purpose tools will not sign one at all. |
| Where PHI is encrypted | In transit and at rest, including recordings, transcripts, and AI summaries. | Whatever your EHR and your paper handling already do. | Varies by vendor, and is rarely stated plainly. |
| Who can see what | Role-based access, with every access written to an audit log. | Whatever permissions your systems enforce. | Often a single shared dashboard login. |
| Producing an audit trail | A log of who accessed what and when, which is what an audit asks for. | Reconstructed by hand from several systems. | Usually not available. |
| Whether your data trains the model | It does not. Patient conversations are never used as training data. | Not applicable. | Frequently yes, and buried in the terms. |
Done, start to finishPartly. Someone at the practice still finishes itDoesn’t do it at all
Related reading
Keep exploring
Works with your system: Echo reads and writes in real time, verifying insurance and booking, confirming, and logging every result directly in AbbaDox, Exa RIS, RamSoft, Karisma, Aura, Visage, Synapse RIS, Epic, Oracle Health, MEDITECH, eClinicalWorks, Athena, PrognoCIS, Practice Fusion, NextGen Office, Prompt, Acuity Scheduling, WebPT, Open Dental, Dentrix Ascend, Curve Dental, Oryx, Dentrix, Eaglesoft, and Denticon, with no separate queue to reconcile and no migration.
Questions
Frequently asked questions
Yes. Echo Booking is HIPAA compliant: it is built for healthcare, signs a Business Associate Agreement (BAA) before any patient contact, and handles protected health information with encryption in transit and at rest, role-based access controls, and audit logging across calls, texts, emails, and forms.
Yes. Echo Booking signs a Business Associate Agreement with every customer as part of onboarding, before any patient call is answered. The BAA establishes the legal framework for Echo to handle PHI on your practice's behalf as a business associate, and your compliance officer can review it before go-live.
AI isn't automatically compliant, it depends on how the system is built and operated. A HIPAA-compliant AI receptionist must sign a BAA and enforce encryption, access controls, and audit logging over PHI. Echo is designed to meet those requirements; a general-purpose consumer chatbot typically is not.
Echo Booking protects PHI with encryption in transit and at rest, including recordings, transcripts, and AI summaries; access restricted by role; and an audit log of who accessed what and when. The same controls apply across voice, text, email, and form channels, and patient conversations are never used to train models.
Yes. Echo Booking applies the same HIPAA safeguards whether a patient calls, texts, emails, or submits a web form: one BAA, encryption in transit and at rest, role-based access, and audit logging. Every channel Echo handles is inside the compliance boundary, because compliance that stops at the phone line isn't compliance.
Generally no. Consumer chatbots aren't designed to handle PHI and usually won't sign a BAA, which puts your practice's compliance at risk. Echo is purpose-built for healthcare instead.
In Echo Booking, access to PHI is governed by role-based controls, so staff see only what their role permits, whether in the web dashboard or the mobile app. Every access is written to an audit log, which is what a HIPAA audit or investigation actually asks your practice to produce.
Yes. Echo Booking's BAA and control set cover the PHI it reads from and writes to your RIS, EHR, or practice-management system, such as schedules, demographics, insurance, and appointment notes, as well as the calls, texts, and forms themselves. The integration is held to the same encryption, role-based access, and audit logging as every other channel.
Used correctly, a purpose-built, BAA-backed AI receptionist is designed to reduce risk by handling PHI under consistent, logged controls. The risk comes from using tools that weren't built for healthcare and won't sign a BAA.
Ready when you are
See hipaa-compliant AI in your practice.
A 30-minute demo, run against your real schedule, in your EHR, under your rules.