Dental practices in the United States are usually covered entities under HIPAA, the federal law that protects patients' health information. That has consequences for any technology that touches patient information, including a website chatbot. A chatbot can be useful for a practice, answering questions about hours, treatments and new-patient steps and booking appointments, but it must be used in a way that respects the rules. This guide explains, in plain language and without pretending to be legal advice, what practices should think about before using an AI chatbot: what counts as protected health information, when a business associate agreement is needed, how to design the chat to avoid collecting what it should not, what to ask any vendor and a set of practical safeguards.
This is general information, not legal advice or a statement that any product is HIPAA compliant. HIPAA and state laws are detailed. Ask a qualified healthcare privacy lawyer or compliance adviser about your practice, and read the guidance at HHS.gov. Practices outside the United States have their own rules.
What HIPAA covers in plain terms
HIPAA regulates how covered entities, such as dental practices, and their business associates handle protected health information, or PHI. PHI is health information that identifies a person, such as a name together with a treatment, an appointment for a specific procedure, insurance details or a description of symptoms. Even the fact that a named person is a patient can be PHI. The rules require safeguards for how PHI is stored and transmitted, limit who can see it and require written agreements with vendors that handle it on your behalf.
| Term | Meaning |
|---|---|
| Covered entity | A healthcare provider, health plan or clearinghouse subject to HIPAA, such as most dental practices |
| Business associate | A vendor that handles PHI on behalf of a covered entity |
| PHI | Individually identifiable health information |
| Business associate agreement (BAA) | A contract that requires a business associate to safeguard PHI |
| Minimum necessary | Use and share only the information needed for the purpose |
Does a website chatbot handle PHI?
It depends on what visitors type and what the chatbot collects. A visitor who asks 'what are your opening hours?' provides no PHI. A visitor who writes 'I am John Smith, I have a cracked molar and pain, can I come in today?' has just typed PHI. The chatbot's design decides how often that happens. If you invite health details, or if visitors volunteer them, your chatbot vendor and AI provider may be handling PHI, which brings business associate requirements.
Two design approaches
| Approach | What it means | Consideration |
|---|---|---|
| Keep PHI out of the chat | Design and instruct the assistant to avoid collecting health information; use it for hours, prices, general treatment information and booking basics; move clinical detail to your secure systems | Reduces exposure, but visitors may still volunteer details; you need safeguards |
| Use a chat that is set up to handle PHI | Choose a vendor and AI provider willing to sign a BAA and meet HIPAA safeguards | Requires careful due diligence and contracts; ask your adviser |
Many practices start with the first approach: a chatbot for non-clinical questions and scheduling, with clear guidance to visitors not to share health details in chat.
Practical safeguards if you keep PHI out
- Put a notice in the chat: 'I am an AI assistant. Please do not share medical details or insurance numbers here. Call us or use our secure form for those.'
- Instruct the assistant to avoid asking for symptoms, history, medications or insurance identifiers.
- Collect only what is needed to book: name and contact details, and the type of visit in general terms.
- Have the assistant hand over anything clinical to a person, and direct emergencies to emergency services or your emergency line.
- Do not let the assistant diagnose, advise on medication or reassure about symptoms.
- Review transcripts to see what visitors volunteer, and refine the notice and instructions.
- Delete transcripts you do not need and limit who can read them.
Even booking information can identify a patient. Use your practice's secure systems for anything beyond basic scheduling, and check with your adviser whether appointment details in chat are acceptable for your situation.
Questions to ask a chatbot vendor
| Question | Why |
|---|---|
| Will you sign a business associate agreement? | Required if the vendor handles PHI for you; the answer tells you which approach you can use |
| Where is data stored and processed? | Location and security of PHI |
| Which sub-processors, including the AI provider, see chat content? | Each may be a subcontractor business associate |
| Is chat data used to train models? | PHI should not be used for training |
| How is data encrypted and access controlled? | Safeguards required by the Security Rule |
| Can transcripts be deleted, and how long are they kept? | Retention and deletion |
| Do you keep audit logs? | Accountability |
| What is your breach notification process? | Required timelines |
Crescelo does not claim any compliance certification. It stores AI provider keys encrypted, isolates customer workspaces, lets you delete conversations, leads and knowledge sources, publishes a data processing addendum and lists its sub-processors. With a bring-your-own-key setup you choose the AI provider, so you decide whether its terms suit your practice. Do not put PHI into any chatbot unless you have confirmed in writing, with your adviser, that the whole chain meets your obligations.
The AI provider is part of the chain
The model that writes replies receives what visitors type. If PHI could be in that text, the AI provider also matters. Some providers offer business terms that include agreements for regulated data; others do not, or only for certain products or plans. Read their terms, ask their sales or compliance team, and get commitments in writing. Never assume a provider will sign what you need; check first.
Marketing, tracking and analytics
HIPAA also affects tracking technologies on healthcare websites. Analytics and advertising scripts on pages where visitors read about treatments, or on patient portals, can transmit information to third parties. Regulators have issued guidance on this. Review which scripts run on your site, including the chat widget, and take advice about consent and business associate requirements.
Emergencies and clinical questions
A chatbot must not triage. If a visitor describes severe pain, swelling, bleeding, difficulty breathing or swallowing, or a knocked-out tooth, the assistant should give your approved instructions, such as contacting emergency services or your emergency line, and alert your team. It should not diagnose or advise. See dental emergency triage with AI chat and handling emergencies in automated chat.
A practical launch checklist
- Decide, with your privacy officer or adviser, whether the chat will handle PHI.
- If not, write the notice and instructions that keep it out, and test them with realistic messages.
- If yes, get a BAA with every vendor in the chain before you start.
- Review the vendor's security and data practices.
- Turn off any features that collect or store more than you need.
- Train staff on what the assistant does and how to handle handovers.
- Document your decisions, and review them regularly.
What the chatbot can safely help with
- Opening hours, location, parking and accessibility.
- General descriptions of services, from approved documents.
- New-patient process and what to bring.
- Fees and payment options that you publish.
- Booking appointments with minimal information.
- Directing people to secure channels for clinical questions.
Used this way, a chatbot can reduce phone volume and after-hours enquiries without collecting sensitive information. See AI chatbot for dental practices for how the pieces fit.
Staff training points
- Explain to the front desk what the assistant will and will not do, and where transcripts are stored.
- Teach them to move any clinical detail that appears in chat into your secure systems.
- Agree what to do when a visitor shares more than they should: reply through a secure route and do not repeat the details in an open channel.
- Make sure everyone knows the emergency handover path.
Frequently asked questions
Is a dental website chatbot covered by HIPAA?
If it handles protected health information for a covered entity, the vendor may be a business associate. Whether your chat does depends on what it collects and what visitors type.
Can I use an AI chatbot without a BAA?
If you can genuinely keep PHI out of it, some practices do. Take advice, design the chat and notice carefully and review transcripts.
Is Crescelo HIPAA compliant?
Crescelo does not claim any compliance certification. Do not put PHI into it unless you have confirmed in writing, with your adviser, that your obligations are met.
Can the chatbot take insurance details?
It is safer not to collect insurance identifiers in chat. Use your secure systems for those.
What should the chat say about privacy?
That it is an AI assistant, that visitors should not share medical details, and where to find your privacy policy.
Who is responsible for compliance?
The practice, as the covered entity, remains responsible. Vendors help, but they do not remove your obligations.
Try a non-clinical question flow in the playground with your own practice information, and see the AI assistant feature. For wider privacy points, read the GDPR checklist for website chatbots.
SVARA ALLA BESÖKARE. BOKA DEM SOM ÄR REDO.
Lägg in Crescelo på din webbplats på 15 minuter
Träna din assistent på dina prislistor, dokument och tjänstevillkor. Aktivera välgrundade svar dygnet runt och bokning av tider direkt i chatten utan krockar.