HIPAA and AI Patient Scheduling: What to Ask

Any vendor that sees patient names, numbers, and appointment times is handling PHI. HIPAA expects a Business Associate Agreement before that data moves. If a cheap SMS tool will not sign a BAA, do not put your schedule in it.

Technical questions that matter: TLS in transit, encryption at rest, who on the vendor side can open a reminder log, and whether voicemails omit extra clinical detail by default.

VCare Health signs a BAA at onboarding and uses role-based clinic accounts (doctor, nurse, therapist, admin). We describe that as HIPAA-aligned. We do not treat SOC 2 or GDPR as public badges unless you have the report in hand.

Continue: HIPAA-aligned scheduling · Reminder calls & SMS