Book a demo

Built for healthcare, with a BAA

An AI front desk that'sHIPAA-compliant by design.

On this page
  1. 01Key takeaways
  2. 02What it is
  3. 03The problem
  4. 04How Echo helps
  5. 05Everything on one phone
  6. 06How it works
  7. 07Why practices choose Echo
  8. 08Frequently asked questions

BAA, PHI handling, and audit logging

What makes an AI receptionist HIPAA compliant, and how Echo meets that standard

By Alex Le, Echo product teamUpdated July 2026

Echo is a HIPAA-compliant AI receptionist: it signs a Business Associate Agreement (BAA) and handles PHI with encryption in transit and at rest, role-based access controls, and full audit logging, across every channel, voice, text, and forms.

In short

Key takeaways

  • A HIPAA-compliant AI receptionist handles PHI under a signed Business Associate Agreement, with encryption in transit and at rest, role-based access, and audit logging.
  • AI is not automatically compliant. It depends entirely on how the system is built and operated, which is why the BAA is the first thing to ask for.
  • Echo executes the BAA before any patient contact is handled, not after go-live.
  • The same control set covers voice, text, email, and web forms. Compliance that stops at the phone line isn't compliance.
  • Patient data is not used to train models, and each workflow is configured to the minimum-necessary standard.

The capability

How to tell whether an AI receptionist is really HIPAA compliant

A HIPAA-compliant AI receptionist handles protected health information under the safeguards a covered entity requires: a signed Business Associate Agreement, encryption in transit and at rest, role-based access, and audit logging.

Nobody issues a HIPAA certification, which is why every vendor claims compliance. Four yes-or-no questions separate them: will you sign a BAA for this service, is PHI encrypted in transit and at rest, is access logged by role, and do patient conversations train the model?

Echo answers yes, yes, yes, and no, across voice, text, and forms. Minimum-necessary rules govern what the AI will say back to a caller, and your compliance officer can pull the audit trail without a support ticket.

The problem

What breaks without it

How Echo does it

What hipaa-compliant AI looks like with Echo

  • General-purpose AI isn't built for PHIA consumer chatbot isn't designed to handle protected health information and won't sign a BAA.
  • Encrypted in transit and at restCalls, transcripts, messages, and form submissions, including recordings and AI summaries.
  • A missing BAA is your practice's exposureWithout one, a vendor touching PHI puts your compliance at risk, and many AI tools simply won't provide one.
  • A signed BAA before the first callEcho executes a Business Associate Agreement with every customer before any patient contact is handled.
  • Compliance has to span every channelPatients reach you by phone, text, and form, and PHI doesn't respect channel boundaries.
  • One control set across every channelVoice, text, email, and digital forms are covered by the same safeguards. Compliance that stops at the phone line isn't compliance.
  • "Trust us" isn't an access controlAn audit asks who accessed what and when, which is a log, not an assurance.
  • Role-based access, and every access loggedStaff see only what their role permits, and the audit log is what an investigation actually asks you to produce.
  • Model training is where data quietly leaksA vendor that improves its models on your conversations has made your patients part of the product.
  • Built for healthcare, not adapted to itPatient data is not used to train models, and each workflow is configured to the minimum-necessary standard.

Mobile first, light by design

Turn every patient conversation into answers, not reports.

Because Echo answers the calls and books the visits itself, it sees every conversation, and reads them back against your live schedule as answers about your practice.

So ask the questions that actually run the practice.

  • Ask it to call a patient back, from your palm.
  • Pull today's numbers without opening a report.
  • No extra tab to monitor or workflow to change.
  • Built to stay hidden and work for you.
  • Get push notification when a human needs to step in.

Ask in plain English, get a number, a chart, or the transcript behind it, then hand the follow-up back to the agent who owns it, from your phone.

Incoming messages

Patients reach you

Booking requests

New patients and reschedules booked straight into the schedule, by your rules.

After-hours calls

Nights, weekends, lunch, and every busy moment in between, answered, never voicemail.

Patient messages

Texts, emails, and web forms answered on their own, handed to your team when it matters.

Outgoing messages

Echo reaches patients

Reminders

Confirmations and 24-hour reminders that cut no-shows, with rescheduling in the thread.

Recalls

The overdue list pulled from your PMS and worked until those chairs are filled.

Referrals

Every referral followed up on until the patient books, so none go cold.

How it works

How Echo handles PHI

HIPAA compliance for an AI front desk is a set of specific, checkable controls, not a badge. These are the ones that apply before the first call.

  1. A BAA is signed before the first call

    Echo executes a Business Associate Agreement with every paid customer before any patient contact is handled. If a vendor cannot show you the BAA, that is the whole answer.

  2. PHI is encrypted in transit and at rest

    Calls, transcripts, messages, and form submissions are encrypted end to end and stored encrypted, including recordings and AI summaries.

  3. Access is role-based and logged

    Staff see only what their role permits, and every access is recorded in an audit log, which is what an investigation or an audit actually asks you to produce.

  4. The same standard spans every channel

    Voice, two-way text, email, and digital forms are covered by one control set. Compliance that stops at the phone line is not compliance.

Why practices choose Echo

What makes Echo different

Only three things matter: whether it knows your booking logic, whether it completes the work inside your system, and what it costs your front desk to adopt.

  1. Scheduling rules engineEcho lands the slot your front desk would have picked, not whichever one happens to be open.
  2. Deep integrationsEcho reads and writes the fields your workflow actually runs on in your EHR/PMS, so the work leaves your desk instead of coming back as a task.
  3. Mobile firstOne light app that pings your team only when a person is genuinely needed. No dashboard to check each morning.
How Echo Booking compares with hiring more front desk staff and with a generic AI receptionist, for hipaa-compliant AI.
CapabilityEcho BookingCarries the task to doneHiring more staffFront desk headcountAI healthcare receptionistA voice bot on the phone line
Signing a BAAExecuted with every customer before the first patient call is answered.Your own staff are workforce members, so no BAA is needed.Many general-purpose tools will not sign one at all.
Where PHI is encryptedIn transit and at rest, including recordings, transcripts, and AI summaries.Whatever your EHR and your paper handling already do.Varies by vendor, and is rarely stated plainly.
Who can see whatRole-based access, with every access written to an audit log.Whatever permissions your systems enforce.Often a single shared dashboard login.
Producing an audit trailA log of who accessed what and when, which is what an audit asks for.Reconstructed by hand from several systems.Usually not available.
Whether your data trains the modelIt does not. Patient conversations are never used as training data.Not applicable.Frequently yes, and buried in the terms.

Done, start to finishPartly. Someone at the practice still finishes itDoesn’t do it at all

Related reading

Keep exploring

Works with your system: Echo reads and writes in real time, verifying insurance and booking, confirming, and logging every result directly in Open Dental, Dentrix, Dentrix Ascend, Eaglesoft, Curve Dental, Oryx, Denticon, PrognoCIS, eClinicalWorks, Practice Fusion, NextGen Healthcare, Athena, Prompt, Acuity Scheduling, and WebPT, with no separate queue to reconcile and no migration.

Questions

Frequently asked questions

Yes. Echo is built for healthcare, signs a Business Associate Agreement (BAA), and handles protected health information with encryption in transit and at rest, role-based access controls, and audit logging.

Yes. A signed Business Associate Agreement is part of onboarding, establishing the legal framework for Echo to handle PHI on your behalf as a business associate.

AI isn't automatically compliant, it depends on how the system is built and operated. A HIPAA-compliant AI receptionist must sign a BAA and enforce encryption, access controls, and audit logging over PHI. Echo is designed to meet those requirements; a general-purpose consumer chatbot typically is not.

PHI is encrypted in transit and at rest, access is restricted by role, and interactions are logged for audit. These controls apply across voice, text, and form channels.

Yes. The same safeguards apply whether a patient calls, texts, or submits a web form, so every channel Echo handles is inside the compliance boundary.

Generally no. Consumer chatbots aren't designed to handle PHI and usually won't sign a BAA, which puts your practice's compliance at risk. Echo is purpose-built for healthcare instead.

Access is governed by role-based controls, so only appropriately authorized roles can reach PHI, and access is logged for audit.

Used correctly, a purpose-built, BAA-backed AI receptionist is designed to reduce risk by handling PHI under consistent, logged controls. The risk comes from using tools that weren't built for healthcare and won't sign a BAA.

HIPAA compliant · BAA included

Ready when you are

See hipaa-compliant AI in your practice.

A 30-minute demo, run against your real schedule, in your EHR, under your rules.