HIPAA-compliant voice AI for dental clinics gives each call type a written rule for what the agent may say before and after it verifies the patient. Recall calls stay about care. Card numbers never go through the call, and every recording and transcript sits on a server the practice controls.
Key Takeaways
- New patient, recall, insurance and balance calls each need their own disclosure rule.
- A recall call that mentions an offer or a balance stops being a care call.
- One self-hosted server can hold every recording, transcript and log the agent creates.
A dental front desk talks treatment plans, insurance and balances by phone all day. We set a disclosure rule for each call type, stop recall calls becoming marketing, handle copays without card numbers and keep every copy on one practice server running Dograh. For the full picture, see our guide to voice AI in healthcare.
Every front desk call carries PHI
A dental front desk talks about treatment plans and insurance coverage by phone all day, and balances come up nearly as often. Under the Health Insurance Portability and Accountability Act (HIPAA), spoken information counts as protected health information (PHI) just as a chart does, and payment details count too. A voice agent answering that line is handling PHI from the first "hello".
Small offices are not below the regulator's notice. The HHS Office for Civil Rights settled with Shen Smiles, a Pennsylvania dental practice, for $140,000 after a patient's records requests went unanswered. The case was about records access and basic safeguards, not phones. Its point for a voice agent is simpler: OCR acts against single-location practices too.
AI voice agents for dental clinics covers how the reception calls run. Here the question is what each call is allowed to reveal.
What the agent may say on each dental call
The Greeting Text on the Start Call node plays before the agent knows who is calling, so it names the practice and offers help, nothing more. If you put a recording notice in it, switch off Allow Greeting Interruption on that node. The setting is on by default, and a caller who starts talking can cut the notice off after two words.
After the greeting, each call type gets its own line:
| Call type | Before verification | After verification |
|---|---|---|
| New patient | Name, callback number, reason in the caller's words | Booking from live slots |
| Reschedule | That the practice can help | Current time, dentist, new slot |
| Recall | That it is time to book a visit | Hygiene slots, last visit date |
| Insurance question | Plans the practice accepts in general | What the practice has on file for this patient |
| Balance | Nothing | Amount, on inbound calls only |
Verification is one HTTP API tool call. The agent collects a date of birth plus one more detail, your endpoint compares them with the practice management system and answers yes or no, and only then does a second tool fetch the appointment or the balance. Verifying patient identity before a voice agent shares PHI covers the endpoint and what happens when the check fails.
Dental offices get many calls from parents booking for children, who are often the child's personal representative, and from spouses managing a partner's care. HIPAA's rule on family and friends leaves those disclosures to a staff member's professional judgment, and state rules on minors vary. A prompt instruction should send those callers to the front desk instead of letting the agent decide.
Open Source Alternative to Vapi / Retell
Self-hosted voice agent platform — no per-minute fees
dograh-hq/dograh
Star on GitHub
Recall calls stay about care
Recall is where most outbound dental calls happen, and the FCC's healthcare exemption only fits while the call is about care. The call names the practice and says it is time to book a cleaning, then offers a slot. Mention a whitening offer and the call is marketing, which needs prior written consent. Mention a balance and it falls outside the exemption, since billing content is excluded.
Keep the voicemail just as plain, because HIPAA's minimum necessary principle applies to anything a household can hear. It says who is calling and asks for a callback, and it never names the procedure or the dentist. Anyone in the household can play the message back.
AI voice agents for dental recall and recare outreach covers call frequency, opt-outs and how a recall campaign runs.
Copays and balances without card numbers
A balance comes up only on an inbound call, after the patient is verified. The agent then reads the amount from the practice system and never takes card details by voice. When the patient wants to pay, an HTTP API tool asks the practice's billing system or payment provider to send its secure payment link by text or email. A patient who prefers the phone goes to the practice's payment line. HIPAA-compliant voice AI for medical billing covers the billing call in full.
One server for every copy of the call
A small practice can run the whole platform on one machine with Docker Compose, in the office or in a cloud account the practice controls. Each call then leaves three recordings (the full call, the patient's side and the agent's side) and a transcript in that server's object storage, plus a call record in its Postgres database. Server logs record each tool call's inputs, so treat log files as PHI as well.
Recording is on by default. The switch is server-wide, and turning it off stops the audio files while transcripts are still saved. Copies stay until the practice removes them, so set the practice's retention schedule on its storage and run one patient's deletion through its own process on the database and storage.
Join the Dograh Community
Dograh is an OSS alternative to Vapi. Join our Slack community for queries, releases, best practices & community interactions.
Self-hosted, the practice signs no business associate agreement (BAA) with Dograh, which never receives the call data. A cloud account needs that provider's BAA, while a server in the practice's own premises needs none. Ask the phone carrier too, since its need for a BAA depends on what it stores. Carriers such as Twilio offer one. Anonymous usage telemetry also goes out from a self-hosted install by default, so the go-live checklist includes ENABLE_TELEMETRY=false and removing POSTHOG_API_KEY.
The speech and language models are a separate layer from the platform. Hosted models each need their own check, and open-weight models on the same server keep patient audio in the building. For a practice running its own server, Dograh adds no per-minute platform fee, though the server, model keys and phone minutes still cost money, and Dograh Cloud charges a 1¢-a-minute platform fee. Which vendors need a BAA depends on what each stores, so have counsel review the list before the first patient call.
When a patient needs a person, Transfer Call works on Twilio, Telnyx, Plivo, Cloudonix and Asterisk ARI. The front desk is rung first, and the patient is put through only after someone there picks up. Facial swelling that makes breathing hard is not a booking problem, so a pathway's fixed Transition Speech says: "If this is a medical emergency, please call 911 now."
Glossary
- Recall call
- An outbound call reminding a patient that a cleaning or checkup is due. It fits the FCC healthcare exemption only while it stays about care, with no offers and no balances.
- Minimum necessary
- HIPAA's principle that a disclosure should include only what the purpose needs. A recall call says a cleaning is due and leaves out the treatment history.
- Personal representative
- Someone HIPAA lets act for a patient, such as a parent of a minor in most cases. State law on minors varies, so a dental agent sends these callers to staff.
- Business associate agreement (BAA)
- The contract HIPAA requires with a vendor that creates, receives, keeps or sends PHI for a practice. Self-hosting removes the platform vendor from that list but not the carrier or hosted models.
