Clinics searching for a HIPAA compliant AI receptionist — or a HIPAA compliant AI voice agent — deserve an honest answer before a sales pitch. Here it is: there is no official HIPAA certification. The U.S. Department of Health and Human Services does not certify products, and no seal makes a tool “HIPAA compliant.” What exists is a set of safeguards your practice must implement, a Business Associate Agreement (BAA) you must have with any vendor that handles protected health information (PHI), and your own documented risk analysis. Any vendor who leads with a certification badge is telling you something about their honesty, not their security. This guide explains what HIPAA actually requires of a clinic using AI to answer patient calls, what to verify in any vendor, and exactly how Marvic AI handles clinic data — stated only in terms you can check against our published Privacy Policy.
What HIPAA requires when an AI answers your phones
When a vendor creates, receives, maintains or transmits PHI on your behalf, that vendor is your business associate. Before PHI flows, HIPAA expects:
- A signed Business Associate Agreement setting out permitted uses, safeguards and breach duties. No BAA, no PHI — that sequencing is not optional.
- Administrative safeguards: a risk analysis, workforce training, and policies for who may access PHI and why.
- Physical safeguards: controls over the facilities and devices where PHI lives.
- Technical safeguards: access controls with unique user identification, audit controls, integrity protections, authentication, and transmission security for PHI in motion.
- The minimum necessary standard: the AI should collect and use only the PHI a booking or an inquiry actually requires.
- Breach notification: a defined path for discovering, reporting and mitigating a breach, inside the timelines HIPAA sets.
The checklist: what to verify in any AI receptionist or voice agent
- Will they sign a BAA? Ask before the demo, not after. Get the answer in writing.
- What PHI does the agent touch? Names, phone numbers, appointment reasons, recordings, transcripts and AI summaries are all PHI when they identify a patient. Map exactly what is collected — minimum necessary starts here.
- Recording and transcripts: who can listen, read and export them? Are recordings on by default, and who controls that setting?
- Access control: is access limited by role to authorized personnel with a legitimate service reason?
- Transmission security: is data encrypted in transit, end to end, including the providers in the chain (telephony, voice AI, cloud hosting)?
- Retention and deletion: how long are recordings and transcripts kept, and how are they deleted or anonymized when no longer required?
- Subprocessors: which companies actually process the calls and messages? A vendor who cannot name them cannot safeguard them.
- Patient rights support: when a patient exercises their rights to access or amend their information, can the vendor support your response?
How Marvic AI handles clinic data — the verifiable facts
Every statement below is drawn from Marvic AI’s published Privacy Policy, so your compliance officer can verify each one in minutes:
- Your practice owns its data. All customer information processed through Marvic AI remains the property of your business; you retain full ownership and control at all times, and information is processed solely to provide the services you requested.
- Never sold or shared for marketing. Marvic AI never sells or rents customer information, never shares it with other businesses, and never uses it for advertising.
- Recording is configurable — and controlled by you. Depending on your account settings, calls may be recorded, transcribed and summarized by AI. Business owners control these settings and are responsible for complying with applicable local recording and consent laws.
- Access is strictly limited. Access is restricted to authorized personnel who require it for technical support, maintenance or service delivery, enforced with access controls, authentication and role-based permissions.
- Encrypted transmission. The platform uses SSL/TLS encrypted communications and encrypted data transmission, secure cloud infrastructure, continuous security monitoring and regular software updates, with payment processing handled securely by authorized providers.
- Retention ends in deletion. When information is no longer required, it is securely deleted or anonymized.
- The chain is named. The categories of service providers information flows through — cloud hosting, communications, calendar, analytics and AI infrastructure providers — are listed in the Privacy Policy, and providers are required to maintain appropriate security and confidentiality standards.
The honest limits — what this page is not
Marvic AI does not claim HIPAA certification, because no such certification exists. This page is information, not a Business Associate Agreement, and reading it creates no compliance relationship. If your practice’s compliance process requires a signed BAA, specific safeguards documentation, or answers about subprocessors before any patient information touches a platform, request them in writing at info@marvic.ai — from us, and from every vendor on your shortlist — before you go live. Your practice remains responsible for its own HIPAA compliance; the right platform makes that duty manageable, and the wrong one makes it invisible until it isn’t.
Built for the whole front desk, not just the phone
Nova, Marvic AI’s AI receptionist, answers every call 24/7 in 52 languages, books into your calendar and never puts a patient on hold — and she is one member of a complete AI team. Speed2Lead calls new patient inquiries back in under 60 seconds, the AI chatbot books from your website, and SEO, AEO, GEO, AI marketing and automation, social media management, content and AI video and the CRM all work alongside her under the same data-ownership and access rules. Clinics can see the full picture on our medical clinics page and dental clinics page, and the service family itself on the AI receptionist page.
Canadian practice instead — or as well? Read the companion guide: PIPEDA-compliant AI tools in Canada — what your business must check.
Put us through your checklist. Hear Nova live at 1-888-488-8132, or send your compliance questions to info@marvic.ai and ask for the answers in writing.
