# AI for Medical Practices: Where It Pays and What HIPAA Asks of It

*AI pays first at the front desk of a medical practice. That means the phones, booking and the insurance paperwork. The visit note comes next. It is safe on three terms. It checks who is calling before it says a word. Each firm that touches patient data signs a HIPAA contract. And any care question goes to a person.*

By Cameron Sullivan, Founder & CEO, Techify AI · October 15, 2026 · 11 min read

> **Key takeaways**
>
> - MGMA polled practice leaders in March 2026. It asked which phone work takes their staff the most time. Payer work (checking coverage and prior auth) came first, at 45%. Scheduling came next, at 31%.
> - Prior auth means the insurer has to approve care before it happens. An AMA survey asked 1,000 doctors in late 2024. On average, each had 39 of these requests a week. Doctors and staff spent 13 hours a week on them.
> - HIPAA makes a practice check who is asking for health data, if it doesn't know them. An AI phone agent has to do the same. It does it before it says a word about the patient.
> - A BAA is the HIPAA contract that makes a firm guard patient data. Each firm that stores or handles that data for the practice needs one. That includes the model, speech and cloud firms behind an AI vendor. HHS says holding only locked data, without the key, doesn't change that.
> - California has a rule for AI messages to patients about their health. Each one needs a notice that AI wrote it, and a way to reach a human. The rule falls away if a licensed provider read and reviewed it first.

AI pays in a medical practice where staff hours go to work that follows a script. Think of the phone, and booking or moving visits. Think of coverage checks, prior auths and writing up the visit. It doesn't pay where the work takes a doctor's judgment. That should never be the first project.

Build in the order the hours are lost. Phones and booking first. Then payer work. Then notes. Then billing follow-up.

HIPAA is the federal law that guards patient health data. Each job is safe only with the controls HIPAA asks of your staff. Know who is calling. Share the least you can. Change nothing without a yes. Hand any care question to a person.

## Where does AI pay in a medical practice?

Here are five jobs. I rank them on two things. One is the staff hours each gives back. The other is how far each sits from a decision about care. The ranking is ours, from build work. The figures next to it are from outside sources, listed at the end.

A payer is the insurer or health plan that pays the claim.

| Rank | The job | What the AI does | Why it ranks here |
|---|---|---|---|
| 1 | Phones and scheduling | Answers each call. Books, moves and cancels visits in the practice system. Gives hours and directions. Takes messages with a summary | It is the front door. A call that rings out is a patient who books somewhere else. And 31% of practice leaders say scheduling is their staff's heaviest phone work |
| 2 | Coverage checks and prior auth | Checks coverage before the visit. Pulls what the payer wants from the chart into the request. Tracks each one until it's decided | 39 requests per doctor per week, and 13 hours of doctor and staff time. 40% of doctors have staff who do nothing else |
| 3 | The visit note | An AI scribe drafts the note from the talk in the room. The clinician edits and signs | Large, proven savings where it's used, and the clinician stays the author |
| 4 | Billing follow-up | Sorts denials by reason, drafts appeals, answers billing calls | Real money. But it sits behind the claims system, so it needs clean data and a good link to it |
| 5 | The patient inbox | Sorts portal messages by what they ask, and drafts replies for staff or a clinician to send | Useful. But most clinical replies need review, which caps the saving |

One job is missing on purpose. Triage means judging how urgent a symptom is. Triage and medical advice are a clinician's work. Say a caller tells the AI "my chest hurts." It can route them to the right person in seconds. It shouldn't decide what that caller does next.

## How should an AI phone system for a medical practice work?

The design that holds up under HIPAA is simple to say. We call it Verify, Then Answer. The agent proves who it is talking to before it says a word about the patient. Then it shares only a short list of approved facts. Then it confirms before it writes a change.

HIPAA's own rule is the place to start. Before it shares health data, a practice must check two things it doesn't already know. Who is this person? And do they have the right to the data? That rule is 45 CFR 164.514(h).

Caller ID doesn't prove who someone is. Nor does a voice that sounds like Mrs. Alvarez. At the least, the agent asks for a name and a date of birth. Both must match the record.

A well-built call runs in this order:

1. **Verify.** The agent asks for a name and date of birth. It matches them to the record. If they don't match, it can still give hours, offices and the way there. It can offer a callback. It says nothing about a patient.
2. **Answer from approved fields only.** A written list says what the agent may read back. The next visit's date, time and office is one. Whether a refill request came in is another. HIPAA's "minimum necessary" rule (164.514(d)) asks the same of staff. They share the least the task needs. Test results, diagnoses and the rest go to a person.
3. **Confirm before you write.** "Thursday at 9:40, at the Elm Street office. Is that right?" Only a yes books it. A wrong office costs a patient a morning.
4. **Hand off with the summary.** Care questions go to a person. So does a caller who is upset, and any call the agent isn't sure of. A summary waits on their screen. The patient never tells the story twice.
5. **Record everything.** Each call gets a transcript. Each lookup and change is logged. A month later, the practice can still answer "what did it say to her?"

We're building one now, for a practice with several locations. It checks name and date of birth before it shares a thing. It reads back approved fields only, confirms before it writes and hands off to staff. The practice's compliance team signed off on that design before the build began.

## Which phone work takes the most staff time?

MGMA is the trade group for medical practice managers. In March 2026 it asked practice leaders a question. Which phone work takes your staff the most time? Of 294 answers that counted, nearly half named payer work.

That split shapes what you build first. Booking calls are many and short. An agent can finish most of them on its own.

Coverage and prior auth calls are fewer and longer. Much of that time goes on hold with a payer. It needs its own kind of system. That one reads the chart, fills in the payer's form and tracks the answer. It doesn't talk to patients at all.

## Prior authorization and the visit note

Prior auth is the job with the clearest number. The payer must approve a test, drug or procedure before the practice goes ahead.

The AMA is the largest group of US doctors. In its late-2024 survey, practices sent 39 prior auth requests per doctor per week. Doctors and staff spent 13 hours a week on them, on average.

Here is the AI's part. It reads the order and the chart. It gathers what the payer asks for. It sends that through the payer's portal or a clearinghouse. Then it watches for the answer. A clearinghouse is a service that passes claims between practices and payers. A person still signs any form that says the care is medically needed.

The visit note has the largest published study. An ambient scribe is an AI that listens to the visit and drafts the note. Take The Permanente Medical Group. Its 7,260 doctors used these scribes in 2,576,627 visits. That ran from October 2023 to December 2024. A follow-up in the journal NEJM Catalyst put the time saved on notes at 15,791 hours.

The fine print matters as much as the headline. The top third of users made up 89% of the times a scribe was switched on. The light users had two complaints. Notes didn't fit their templates. And fixing a note took longer than typing it. A scribe that doesn't write in each clinician's format gets switched off.

## What HIPAA, the TCPA and state law require of AI in a practice

This is not legal advice. Your lawyer reads the law. These are the rules that shape the design.

**The BAA chain.** HHS is the US health department, and it enforces HIPAA. It doesn't certify any firm as HIPAA compliant. The contract that counts is the business associate agreement, or BAA. It has to run down the whole data path. That means the AI vendor, the model provider and the speech-to-text service. It means the phone carrier if it stores recordings. And it means the cloud host.

HHS was blunt about the usual excuse in its 2016 cloud guidance. "Lacking an encryption key does not exempt a CSP from business associate status." A CSP is a cloud service provider. Ask the vendor which other firms it uses. These are its subprocessors. Then ask for a signed BAA behind each one. The fuller review is in [HIPAA compliant AI](/insights/hipaa-compliant-ai).

**Checking callers, and the minimum necessary.** The two rules above, 164.514(h) and (d), are the agent's first two steps. Write them into the scope as tests.

**Texts and calls (TCPA).** The TCPA is the federal law on robocalls and mass texts. In 2015 the FCC, which sets the rules for phone lines, made an exception. Some health calls and texts can go to cell phones without prior consent. Think of appointment reminders and prescription notices. But only when all of this is true:

- The patient is not charged for it.
- It goes to the number the patient gave.
- There is no more than one a day and three a week.
- It has no marketing, and no billing or collections content.
- An opt-out is honored at once.

Add a "your balance is due" line to a reminder, and the exception is gone.

**California's AB 3030.** This law has applied since January 2025. It covers generative AI, the kind that writes text. Say a practice in the state uses it to write to a patient about their health. The message must carry a notice that AI wrote it. In a letter or email, the notice goes at the top. On a call, it comes at the start and the end. In a chat, it stays on screen the whole time. The practice must also tell the patient how to reach a human. A message a licensed provider has read and reviewed is exempt. So are booking and billing messages.

**Decision support tools.** Some tools help with clinical decisions. Add one, and a federal rule applies. Section 1557 is the rule against discrimination in health care. Its part on these tools (45 CFR 92.210) gives the practice an ongoing duty. It must find the tools that use race, sex, age or disability as inputs. Then it must reduce the risk of bias from them. A phone agent seldom touches this. A triage model would.

**Recording.** Some states need every party's consent to record a call. The agent should say so at the start, each time.

## What it costs and takes to run in production

On the builds we run, model and hosting bills sit on the client's own accounts. So no one marks up the tokens, the units AI models bill by. Take a system with 1,000+ daily AI interactions. All in, its model costs typically run $200 to $1,200 a month. A voice agent adds phone and speech minutes on top. The detail is in [what it costs to run an AI system](/insights/cost-to-run-an-ai-system).

The model is the cheap part. The work sits in three places.

- **The link to your practice system.** This is the software that holds your schedule. The agent is only as useful as what it can read and write there. Some systems let outside software book visits. Some allow read-only access. Some offer a hookup built for some other job. Find out in the first phase, before the rest is built. It decides whether the agent can book or can only take a message.
- **The rollout.** It goes in phases, each one accepted before the next. First comes a test line with made-up patients. Then only the calls after hours. Then daytime overflow. Then the main line. Each phase has a pass line, set down in writing before it starts.
- **The people.** Someone owns the handoff queue. Someone reads a sample of transcripts each week in the first months. The design for that review is in [human in the loop AI](/insights/human-in-the-loop-ai).

## What goes wrong with AI in medical practices

**It speaks before it checks.** "Your appointment with Dr. Patel is Thursday" shares health data. Said to the wrong caller, it is a breach.

**One link in the chain has no BAA.** Most often it's the speech-to-text service or the model API. Someone added it late in the build, and no one checked it.

**It writes without reading back.** Double bookings. The wrong office. A visit dropped that the patient wanted to keep.

**There's no way out.** A patient says "let me talk to someone" twice and still gets the agent. That patient will not call back. One ask should reach a person.

**It drifts into advice.** "Should I take another dose?" is a question for a nurse. The agent's only job is to get the caller to one, fast.

**The reminder carries a balance.** Billing content breaks the exception. Now the reminder needs consent the practice may not have.

**The scribe nobody uses.** Notes that don't match the clinician's template get edited, then dropped. Pilot it with the clinicians who will use it most, in their format.

## What to ask an AI vendor before patients hear it

Put these in writing. Read the answers before you talk price.

- Will you sign a BAA? Who are your subprocessors (model, speech, phone, hosting)? Does each one sign a BAA with you?
- How does the agent check who it's talking to before it shares a thing? What does it say when the check fails?
- Which fields can it read back to a checked patient? Send the list.
- Does it confirm each change before it writes to our practice system? Play us a recorded test call.
- How many asks does it take a caller to reach a person? What does that person see on screen?
- Where are recordings and transcripts kept? For how long, and on whose cloud account?
- Is our data used to train any model, yours or a provider's? Is the answer a clause in the contract?
- What does the agent do when our practice system is down?
- If we leave, what do we keep: the code, the prompts, the call logs, the accounts? The longer list is in [who owns the code an AI vendor writes](/insights/who-owns-ai-code).

A vendor who answers all nine in writing, with the diagram, is worth a second call.

## When not to use AI in a practice

**A small practice with few calls.** An answering service and online booking may cover it, for less than any build.

**No way into the practice system.** Say the agent can't read the schedule or write to it. Then it can only take messages. That is voicemail with better manners. It is seldom worth the build.

**Clinical triage.** Route it. Don't automate it.

**No one to own the queue.** Say the agent hands off to an inbox no one watches. That is worse than a ringing phone. The patient thinks someone heard them.

## FAQ

### Can an AI receptionist be HIPAA compliant?

No product has an official HIPAA badge, because HHS doesn't certify vendors. What makes an AI receptionist safe is how it's built. A signed BAA with the vendor and each firm behind it. A check of who is calling before any patient data is shared. A short list of approved fields. A read-back before each change. A log of each call. And a fast route to a person for any care question.

### Does an AI phone agent need a BAA?

Yes, if it creates, receives, stores or sends patient data for the practice. Any agent that looks up appointments does. The BAA has to reach past the vendor. It covers the model provider, the speech-to-text service and the cloud host. HHS's cloud guidance is clear on one point. A cloud firm that stores locked patient data without the key is still a business associate.

### Can AI send appointment reminders by text without consent?

Sometimes. A 2015 FCC ruling made an exception for health reminders to cell phones. They can go out without prior consent, on five terms. The patient isn't charged. It goes to the number the patient gave. There is no more than one a day and three a week. It has no marketing, billing or collections content. And opt-outs are honored at once. Billing reminders fall outside the rule and need consent.

### Do patients have to be told they are talking to AI?

In California, yes, when generative AI writes to them about their health. AB 3030 calls for a notice. It also calls for a way to reach a human. The rule falls away if a licensed provider reviewed the message. Booking and billing messages are outside it. Other states have their own rules, so check with your lawyer. We build each agent to say what it is at the start of the call.

### How much does an AI phone system for a medical practice cost to run?

At 1,000+ daily AI interactions, all-in model costs typically run $200 to $1,200 a month. Phone and speech minutes come on top. The larger cost is the build itself. Most of that is the link to the practice system. It decides whether the agent can book visits or only take messages.

## Sources

- MGMA Stat, "Phones are still a backlog costing medical practices time" (poll of March 10, 2026, 294 applicable responses): [mgma.com](https://mgma.com/mgma-stat/phones-are-still-a-backlog-costing-medical-practices-time)
- American Medical Association, "Fixing prior auth: Nearly 40 prior authorizations a week is way too many" (April 24, 2025), on its late-2024 survey of 1,000 physicians: [ama-assn.org](https://ama-assn.org/practice-management/prior-authorization/fixing-prior-auth-nearly-40-prior-authorizations-week-way)
- American Medical Association, "AI scribes save 15,000 hours, and restore the human side of medicine" (June 2025), on The Permanente Medical Group's evaluation in NEJM Catalyst: [ama-assn.org](https://www.ama-assn.org/practice-management/digital-health/ai-scribes-save-15000-hours-and-restore-human-side-medicine)
- 45 CFR 164.514, including (d) minimum necessary and (h) verification: [law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.514)
- Mintz, on HHS's October 2016 guidance on HIPAA and cloud computing: [mintz.com](https://www.mintz.com/insights-center/viewpoints/2146/2016-10-19-hhs-publishes-guidance-hipaa-and-cloud-computing)
- Lewis Rice, on the FCC's July 10, 2015 TCPA declaratory ruling and its healthcare exemption: [lewisrice.com](https://www.lewisrice.com/publications/the-silver-lining-in-the-fcc%E2%80%99s-tcpa-declaratory-ruling-exemptions-for-certain-healthcare-and-financial-communications/)
- ArentFox Schiff, on California AB 3030: [afslaw.com](https://www.afslaw.com/perspectives/alerts/california-requires-disclaimers-health-care-providers-ai-generated-patient)
- 45 CFR 92.210, patient care decision support tools: [law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/92.210)
- What Techify signs and builds to (BAAs; HIPAA controls built to, not a third-party certification): /commitments#security
- The $200 to $1,200 monthly model cost at 1,000+ daily AI interactions is a company figure.

## Related

- [HIPAA compliant AI: the questions to ask instead of trusting a badge](/insights/hipaa-compliant-ai)
- [Human in the loop AI: where a person approves](/insights/human-in-the-loop-ai)
- [What it costs to run an AI system](/insights/cost-to-run-an-ai-system)