Can a dentist use AI safely?

One line you can't cross

Health data is governed by HIPAA — the federal law that protects patient information. If information can identify a patient, it is protected: name, phone number, appointment history, x-ray notes, payment records.

Run that through a tool that isn't covered by a business associate agreement — the contract that makes a vendor legally responsible for protecting patient data — and it's a federal problem, not a settings problem. Penalties run into the five figures per violation, and "we didn't know" doesn't soften it.

This one habit — de-identify before you paste — puts most of what AI is good at back in reach without touching a compliance line.

What's safe to start with

Four uses that carry real payoff and no patient-data exposure. Each links to the vetted review that covers it.

The phone-agent warning: a phone agent will hear patients say their names, insurance details, and symptoms out loud — that can make it patient data. Rosie publishes no HIPAA statement anywhere, and Goodcall markets to healthcare but shows no confirmed independent security certification in its public record.

If calls will carry patient details, you need documented compliance: Retell signs a HIPAA agreement self-serve at no extra cost, and Bland includes HIPAA in its standard rate. For a non-clinical line — directions, hours, marketing — the cheaper tools are fine.

What never goes in a public tool

The test that survives training a new front-desk hire on day one: would you post this on the waiting-room wall? Same rule for the chatbot.

The five-minute vendor check

Run any vendor through these before money moves. A good vendor answers plainly. A deflecting one tells you what you need to know.

1. Will you sign a business associate agreement? If the tool touches anything a patient could identify, this is the whole ballgame — a privacy-policy promise is not a BAA. Retell and Bland hand it over without a tier fight; if a salesperson hedges, walk.
2. Where are call recordings and transcripts stored, and for how long? "We keep everything for training" is a different universe from "30 days, then gone." You want a number.
3. Is your staff able to listen to our calls? Some platforms review audio; you want to know who and when.
4. What happens to recordings if we cancel? Do you delete everything on cancellation, in writing?
5. Which of your own vendors touch our data? The phone agent is a stack — speech recognition, the language model, the voice, the phone carrier. Each is a company. A serious vendor names them; a vague answer is your answer.

If something goes wrong

AI doesn't need to be perfect in a practice — it needs to fail quietly and get caught. Three steps, in order:

This is general information, not legal advice. Your carrier's breach line exists for this call — that's what you pay it for.

The honest trade-off

Most businesses can pick any tool on price and convenience. Yours can't quite: the compliance question arrives earlier, and the cheapest option on the phone is the one most likely to fail it. The pattern that works: keep patient data out of general tools entirely, use HIPAA-covered platforms for anything clinical, and lean on free chatbots for the de-identified work — drafting, admin, marketing.

The upside is real and it doesn't require a project: a phone agent answering after hours costs $79–299 a month in this category, and a hyphen of missed calls is worth more than a year of it.