HIPAA and MedSpas: What You Must Know Before Using an AI Phone Agent

Ask three MedSpa owners whether they are a HIPAA covered entity and you will usually get three different answers. The definition is not a matter of opinion. It is set out at 45 CFR 160.103, which defines a covered entity as a health plan, a health care clearinghouse, or a health care provider who transmits health information in electronic form in connection with a transaction covered by the rule [1]. The U.S. Department of Health and Human Services Office for Civil Rights enforces it. The National Institute of Standards and Technology publishes the implementation guide, SP 800-66 Revision 2 [2]. And in January 2025 the Office for Civil Rights published a proposed overhaul of the HIPAA Security Rule in the Federal Register at 90 FR 898, which would make encryption and multi-factor authentication mandatory rather than addressable [3]. That proposal is not final, so the rules below are the ones in force today.

This is the plain-English version of what those documents say, with the citations attached so you can check every one. It is not legal advice. If the answer below matters to your practice, take it to a healthcare attorney. The structural answer on our side is our Discretion standard, built around the controls named here.

You are a covered entity if you transmit health information electronically for a covered transaction

That is the whole test at 45 CFR 160.103 [1]. In practice, two points decide it:

• You transmit health information electronically in connection with a covered transaction. The most common one is billing insurance. This sweeps in most therapists, any cosmetic practice that bills medical insurance for any procedure, and MedSpas with a physician or nurse practitioner who files any claims.

• Having a medical director doesn't by itself make you a covered entity. The test is whether you (or a billing service on your behalf) send standard electronic transactions such as insurance claims or eligibility checks. Many cash-only practices with medical directors still choose HIPAA-grade safeguards because state privacy laws and payer relationships can apply. Confirm your status with counsel.

You are likely not covered if you are a pure cash aesthetic business that performs no medical procedures, keeps no medical records and never bills insurance. Eyelash extensions, basic facials and massage sit outside. The gray zone is wider than people assume, and the safer default is to assume coverage and build accordingly, because the cost of being wrong is asymmetric.

A caller naming a procedure is Protected Health Information

PHI is defined far more broadly than diagnosis. Under 45 CFR 160.103 it is individually identifiable health information relating to a person's past, present or future physical or mental health, the provision of care, or payment for care [1]. A caller saying "I am calling about my appointment for the Juvederm consult" plus a name and a phone number is PHI. A therapist's intake line capturing a first name and a reason for calling is PHI.

If your phone agent, whether software or a person, captures, transmits or stores any of that, the agent's infrastructure is in scope, and the vendor operating it is a business associate under 45 CFR 160.103 [1].

Five things to require from an AI phone agent vendor, each with a rule behind it

1. A signed Business Associate Agreement. This is required by 45 CFR 164.502(e), and the clauses the contract must contain are enumerated at 45 CFR 164.504(e)(2) [4]. Read that section and check the contract against it clause by clause. A vendor that cannot or will not sign one is telling you something about how it is built.

2. Encryption in transit and at rest, and an honest answer about what that means. Both encryption specifications are addressable, not required: 45 CFR 164.312(a)(2)(iv) for data at rest and 164.312(e)(2)(ii) for transmission [6]. Addressable does not mean optional. Under 45 CFR 164.306(d)(3) you must assess whether the specification is reasonable and appropriate, implement it if it is, and if it is not, document why and implement an equivalent alternative [6]. The commercial reason to encrypt anyway is the breach-notification safe harbor: PHI that has been rendered unusable, unreadable or indecipherable under the method the Secretary specifies is not "unsecured" PHI under 45 CFR 164.402, and its disclosure does not trigger the notification duties at 45 CFR 164.400 to 164.414 [7]. NIST SP 800-52 Revision 2 is the reference for TLS configuration [8].

3. Clear data retention and deletion policies. Note what HIPAA does and does not say here. It requires you to retain the Security Rule's required documentation for six years under 45 CFR 164.316(b)(2)(i) [9]. It sets no retention period for the records themselves, which is governed by state law. So "we keep recordings for X days" is a vendor policy, not a compliance answer, and you need to know where they live during those days and who can reach them.

4. Controlled sub-processors. If the vendor uses a voice or language model from another provider, that provider is a subcontractor, and 45 CFR 164.314(a)(2)(iii) requires your business associate to obtain satisfactory assurances through its own written agreement with it [10]. Ask for the list and ask which agreements are in place.

5. Audit logs. Audit controls are required, not addressable, at 45 CFR 164.312(b), which obliges hardware, software or procedural mechanisms that record and examine activity in systems containing ePHI [6]. Unique user identification at 164.312(a)(2)(i) is also required, which is why a shared vendor login is a finding rather than a convenience.

Three vendor answers that sound compliant and are not

"We use AWS, so we are HIPAA-compliant." The Office for Civil Rights addressed this directly in its Guidance on HIPAA and Cloud Computing. A cloud service provider that creates, receives, maintains or transmits ePHI is a business associate and a business associate agreement is required, even where the provider offers only no-view services and cannot decrypt the data it holds [5]. Hosting on a HIPAA-eligible platform is a precondition, not a conclusion. The application, the configuration, the contracts and the processes still have to exist.

"We transcribe calls with ChatGPT." The relevant question is which product tier and whether a business associate agreement covers it. Consumer tiers of general-purpose assistants are not offered under one. Enterprise arrangements can be. If the vendor cannot name the tier and produce the agreement, the subcontractor obligation at 164.314(a)(2)(iii) is unmet [10].

"We delete calls after 30 days." A retention window says nothing about the thirty days themselves. Where do the recordings live, who can listen, are they copied into a training corpus, and can you produce, amend or restrict a specific caller's data on request? Those last three are patient rights, not courtesies: access at 45 CFR 164.524, amendment at 164.526, and the right to request restriction at 164.522(a) [11]. If your vendor cannot honor them, you cannot honor them.

For MedSpas, the exposure is that callers disclose PHI without meaning to

MedSpas carry a specific wrinkle. Callers routinely volunteer PHI before anyone has told them what PHI is. "I am calling about my Botox appointment" is PHI. A prospective patient describing a skin condition she wants treated is PHI. Your agent has to handle that language naturally without recording or transmitting it outside the environment your business associate agreement covers. That intake discipline is the same one behind sound cosmetic consult intake protocols. The compliant capture of a consult inquiry is also what stops it leaking.

For therapists, two additional federal regimes may apply

The bar is higher in behavioral health, and it is higher for reasons that are written down rather than cultural.

• Psychotherapy notes are carved out for separate treatment. Under 45 CFR 164.508(a)(2), most uses and disclosures require a specific written authorization, and the general treatment, payment and operations permissions do not carry [12].

• Substance use disorder records from a federally assisted program are governed by 42 CFR Part 2, a separate and in several respects stricter confidentiality regime that sits alongside HIPAA rather than inside it [13].

State law can add further protection on top of both. A phone line is often where the most sensitive disclosure of the entire relationship happens, which is why the intake script matters as much as the infrastructure.

Six checks to complete before an AI phone agent takes a live call

• Signed business associate agreement in hand, checked clause by clause against 45 CFR 164.504(e)(2) [4].

• You know where call data is stored, for how long, and under whose state retention rule.

• You have run a test call containing realistic PHI and verified that retention and deletion behave as documented.

• You have the subcontractor list and know which agreements cover each name on it [10].

• Staff have a one-page document on when the agent handles a call and when it routes to a person.

• The intake script does not invite unnecessary PHI disclosure. "How can I help?" is a better opening than "What medical condition are you calling about?"

The test is whether the vendor will answer all of it in writing

Compliance is not the interesting part of bringing in an AI phone agent. It is the part that decides whether you can sleep. Every question in this post maps to a numbered section of the Code of Federal Regulations, which means every one of them has a right answer that a vendor can put in writing. A vendor that answers them without hesitating is showing you its posture. A vendor that cannot is showing you the same thing. The agent exists to secure the pipeline; your human team stays free for the conversations that need judgment.

References

• [1] 45 CFR 160.103, definitions of covered entity, business associate and protected health information. eCFR

• [2] National Institute of Standards and Technology, SP 800-66 Rev. 2, Implementing the HIPAA Security Rule: A Cybersecurity Resource Guide. csrc.nist.gov

• [3] HIPAA Security Rule To Strengthen the Cybersecurity of Electronic Protected Health Information, 90 FR 898 (6 January 2025). Proposed rule, not final. Federal Register

• [4] 45 CFR 164.502(e) and 45 CFR 164.504(e)(2), business associate contracts and required contract content. eCFR

• [5] U.S. Department of Health and Human Services, Office for Civil Rights, Guidance on HIPAA and Cloud Computing. hhs.gov

• [6] 45 CFR 164.312, technical safeguards, and 45 CFR 164.306(d), required and addressable implementation specifications. eCFR

• [7] 45 CFR 164.402 and 45 CFR 164.400 to 164.414, breach notification and the definition of unsecured protected health information. eCFR

• [8] National Institute of Standards and Technology, SP 800-52 Rev. 2, Guidelines for the Selection, Configuration, and Use of Transport Layer Security Implementations. csrc.nist.gov

• [9] 45 CFR 164.316(b)(2)(i), six-year documentation retention. eCFR

• [10] 45 CFR 164.314(a)(2)(iii), subcontractor assurances. eCFR

• [11] 45 CFR 164.524 access, 45 CFR 164.526 amendment, 45 CFR 164.522(a) right to request restriction. eCFR

• [12] 45 CFR 164.508(a)(2), authorization required for psychotherapy notes. eCFR

• [13] 42 CFR Part 2, confidentiality of substance use disorder patient records. eCFR

Next Step

If your premium practice runs more than 100 inbound consult inquiries a month and has no structured measurement of how many never reach a scheduled consultation, your pipeline may be leaking revenue you cannot see. The Line Audit shows you what actually happens: we call your line at the hours you're least likely to answer and send you the recordings with a written breakdown.

• Request The Line Audit: expand@thethinkingrobot.com

• Audit Real-Time Conversational Velocity: Talk to Rosey, our AI receptionist, at +1 (720) 776-1664 (an AI demo line; calls are recorded).