Which Agencies Handle AI Patient Communication for Cosmetic Surgery and Medical Aesthetics?
Three kinds of firm build AI patient communication for cosmetic practices. What the work covers, the HIPAA, TCPA and AI-disclosure rules that shape it, and seven questions to ask a provider.
Ed
Luxury Medical, AI Phone Agent, Patient Communication, Cosmetic Surgery, HIPAA
Firms that build AI patient communication for cosmetic surgery and medical aesthetics practices fall into three groups: software platforms the practice configures and runs itself, answering services that add AI to a staffed call center, and agencies that build and run the system for the practice. The Thinking Robot is in the third group. Whichever kind you choose, the same four questions separate a safe provider from a risky one: will it sign a Business Associate Agreement, does the agent say it is an AI at the start of every call, do clinical questions stay with your clinicians, and does it contact patients only with the consent the law requires?
This guide is about how a practice's patient communication should be designed. It is not medical or legal advice.
What AI patient communication covers in a cosmetic practice
The volume behind it is large. The American Society of Plastic Surgeons counted nearly 1.6 million cosmetic surgical procedures and more than 28.5 million minimally invasive procedures in 2024. Each one sits at the end of a chain of calls, forms and messages, and the practice's communication layer decides how many of those conversations reach a consult.
In practice, patient communication means five jobs:
Answering inquiries. Calls and forms that arrive while the coordinator is in a consult, after hours or on a weekend.
Booking the consult. Taking the caller's contact details and what they are asking about, in their own words, and putting a consult on the calendar.
Confirmations and reminders. Informational messages to patients who opted in at booking, with no procedure, diagnosis or result in a text or voicemail.
Cancellations and the waitlist. Offering a released slot to patients who asked to hear about openings.
Follow-up and re-engagement. Contact with past patients, which carries the strictest consent rules of the five.
Speed matters most on the first job. In a Harvard Business Review study of 1.25 million sales leads, firms that tried to contact a lead within an hour were nearly seven times as likely to have a meaningful conversation with a decision maker as firms that waited even an hour longer. It is not a healthcare study, so treat it as a direction rather than a benchmark for your practice.
Three kinds of provider
Software platforms. Your team writes the scripts, connects the calendar, sets the rules and watches the results. The lowest fee and the most internal work.
Answering services with AI. A call center that uses AI for some calls and people for others. Ask which calls a person handles, where those people work, and whether they sign the same BAA.
Build-and-run agencies. The provider configures the agent on your written rules, connects it to your calendar and runs it as a managed service. You give up control of the build in exchange for less work inside the practice.
None of the three is right for every practice. A practice with few after-hours inquiries may not need any of them, and a good provider will say so.
The rules that shape it
HIPAA. A vendor that creates, receives, maintains or transmits protected health information on a covered entity's behalf is a business associate, and HHS says a covered entity may share that information with it only after obtaining "satisfactory assurances" in a contract or other written arrangement. Not every cash-pay aesthetic practice is a covered entity: HHS counts a health care provider only if it transmits health information electronically in connection with a transaction for which HHS has adopted a standard, such as an insurance claim. A BAA is a sensible baseline either way.
Calls made with an AI voice. In a February 2024 declaratory ruling, the FCC confirmed that the Telephone Consumer Protection Act's restrictions on an "artificial or prerecorded voice" cover current AI technologies that generate human voices. A call that uses one needs the called party's prior express consent, and prior express written consent if the call contains telemarketing. That governs outbound reminders, waitlist offers and re-engagement calls.
Marketing messages. HIPAA requires a patient's written authorization before protected health information is used for marketing (45 CFR 164.508(a)(3)), and its definition of marketing has exceptions, such as a message describing the practice's own health-related services when no third party pays for it (45 CFR 164.501). Which messages need an authorization is a question for your privacy officer.
AI disclosure. California's AB 3030, in effect since January 1, 2025, requires health facilities, clinics and physician practices that use generative AI to write patient communications about clinical information to include a disclaimer and instructions for reaching a person, unless a licensed provider reviews the message. Scheduling and billing messages fall outside it. Check the rules in each state where your patients live.
Claims about results. When the FTC announced its Operation AI Comply cases in September 2024, its chair said "there is no AI exemption from the laws on the books" (FTC press release). A provider's outcome figures are advertising claims, so ask where each one comes from.
Clinical questions stay with clinicians
Cosmetic callers often ask clinical questions on the first call: which procedure suits them, what recovery involves, what result to expect. A phone agent should answer from the practice's approved, non-clinical information (what a service is, how to book, the price ranges the practice approves) and route every clinical question, such as product choice, side effects, results or recovery, to the clinical team. The FDA's guidance on clinical decision support software says that "Software functions that support or provide recommendations to patients or caregivers – not HCPs – meet the definition of a device." A line that tells a caller which procedure suits them is doing more than answering the phone.
Three safety rules belong in every build. A caller who describes a medical emergency is told to call 911 first, in line with 911.gov: "In an emergency, dial 911 from your phone immediately." A caller who mentions suicide, self-harm or a mental-health crisis is given the 988 Suicide & Crisis Lifeline (call or text 988), and the call is flagged for immediate review by a person. A caller who says they are under 18 is handed to a member of staff, and nothing is booked.
How to vet a provider
Ask each provider on your list these seven questions, and ask for the answers in writing:
Will you sign a BAA before go-live, and which of your vendors touch protected health information? Each of them should have its own BAA.
Does the agent say it is an AI assistant, and that the call is recorded, at the start of every call?
Can I hear recordings of it handling a clinical question, an emergency and a request for a person?
Who will it call or text, and what consent record does it check first? How is an opt-out honored across every channel?
Who owns the phone number, the transcripts and the patient data, and what happens to them if we leave?
Is any identifiable call content used to train AI models?
Where does each results figure in your sales material come from?
How the Watch handles this
The Thinking Robot builds AI phone agents, called the Watch, for businesses where a missed call is expensive. The luxury medical agent answers while the room is busy and takes the details a booking needs. It runs under a BAA, executed at onboarding, on every tier. It opens every call by saying it is an AI assistant and, on a line that records, that the call is recorded. It gives no clinical advice, tells anyone describing an emergency to call 911 first, and will not confirm or deny that a person is a patient. It records or matches no one's voiceprint, and no identifiable call content trains any AI model.
First Watch makes no outbound calls. Standing Watch adds cancellation recovery and re-engagement, only for patients who gave prior written consent (and HIPAA marketing authorization where a message promotes a service). In Standing Watch and Silent Watch, a caller who asks for a clinician is routed in the order your written rules set. Call the demonstration line at (720) 676-0088, or read how the agent works for a cosmetic surgery practice.
Tiers and prices are on the services page, and build time to go-live is four weeks. The Line Audit is $300, credited against setup, or you can book a call.
Frequently asked questions
Can an AI phone agent answer patient calls under HIPAA?
Yes, when the vendor is set up as a business associate under a signed BAA and the practice's own policies cover how the line is used. If the practice is not a HIPAA covered entity, a BAA is still a sensible baseline.
Do patients have to be told they are talking to an AI?
It depends on the state and the message. California's AB 3030 requires a disclaimer on generative-AI communications about clinical information unless a licensed provider reviews them. An agent that says it is an AI at the start of every call does not leave the question open.
Can an AI agent call past patients to book them again?
Only with consent. The FCC treats AI-generated voices as artificial voices under the TCPA, so the call needs prior express consent, and prior express written consent if it is telemarketing. HIPAA may also require a marketing authorization. Your privacy officer and counsel should approve the program before it starts.
Should the agent answer questions about results or recovery?
No. Those are clinical questions. The agent should share only the practice's approved, non-clinical information and route the question to the clinical team.
Related guides
What should a BAA cover when a medical practice uses an AI phone agent?
Can a medical practice confirm that someone is a patient over the phone?
Sources
American Society of Plastic Surgeons, 2024 statistics press release, June 25, 2025
US Department of Health and Human Services, Business Associates
US Department of Health and Human Services, Covered Entities and Business Associates
Federal Communications Commission, Declaratory Ruling FCC 24-17, released February 8, 2024
45 CFR 164.508, Uses and disclosures for which an authorization is required
