HIPAA compliant AI receptionist: which vendors say they sign a BAA

What a BAA is, and what it does not do

Under the HIPAA rules, a business associate is a person who is not part of a covered entity's workforce and who creates, receives, maintains or transmits protected health information (PHI) for it, or provides certain services to it that involve PHI (45 CFR 160.103). A vendor that answers a clinic's calls, records them and stores transcripts can fall into that category, because a recording of a patient giving a date of birth and a reason for the visit is likely to be PHI.

When that is the case, a covered entity may let the business associate handle PHI only after getting satisfactory assurances that it will be safeguarded, and those assurances are documented in a written contract (45 CFR 164.502(e)). That contract is the BAA.

A signed BAA is a legal precondition, not a compliance programme. It does not make your call scripts, staff training, access controls, recording retention or breach procedures compliant. It also covers only the services named in it, so a BAA for a vendor's phone product may not extend to a newer AI feature. We are not lawyers; take the specifics to your compliance officer or healthcare counsel.

What each vendor's own pages say about HIPAA and a BAA

We opened each vendor's own pricing, security or home page on 2026-10-15 and recorded what it says. 'Not mentioned' means the page we opened did not say, not that the vendor does not offer one; their sales teams may say something different. Verify every row with the vendor before relying on it.

What the pattern tells you

Where a BAA is mentioned, it tends to sit above the entry plans: an enterprise tier at Bland, a custom plan at Upfirst, and a paid add-on at Vapi. That matters if you are a one-location practice, because the plan you can afford may not be the plan that comes with the agreement.

Two price points are stated outright, shown below as of October 2026. They are not like for like: the GoHighLevel add-on sits on top of a platform subscription, and Vapi's sits on top of usage fees.

Pre-purchase checklist for a practice

1. 1

   Decide whether calls will contain PHI

   If callers will give names with symptoms, dates of birth, insurance or appointment reasons, assume yes and plan for a BAA.

2. 2

   Ask for the BAA itself, in writing

   A 'HIPAA compliant' badge is not the agreement. Ask for the template and have your counsel or compliance officer read it.

3. 3

   Confirm which plan and which services it covers

   Check that the exact product you are buying, including recordings, transcripts, SMS and any AI features, is within the agreement's scope.

4. 4

   Ask about subcontractors

   Voice, transcription and language-model providers may handle the call. The vendor should say which are bound by equivalent terms.

5. 5

   Ask about storage, retention and model training

   Where recordings and transcripts live, how long they are kept, how they are deleted, and whether they are used to train models.

6. 6

   Ask about breach notification

   How quickly the vendor will tell you, and what it will tell you, if PHI is exposed.

7. 7

   Price the total, not the headline plan

   Add the BAA tier or add-on, telephony, extra minutes and any setup fee, then compare against your call volume.

8. 8

   Run a test call with fake data only

   Before real patients, check how the agent handles an emergency, a request for a person and a caller asking for medical advice.

Where Lead Friendly stands

Lead Friendly is an AI phone agent with a built-in CRM, month to month, and every AI call opens with a disclosure that the caller is speaking with an AI voice. It is not HIPAA-eligible and we do not sign a Business Associate Agreement. A medical practice that needs a BAA should choose a vendor that signs one, after checking the agreement itself. The table shows what each vendor's own pages say, not an endorsement.

For businesses that do not handle PHI, including many wellness and appearance-focused practices that only book appointments, Lead Friendly may fit, but confirm with your own counsel that you handle no protected health information; keep clinical detail out of calls, texts and notes. Prices and trial terms are on the pricing page.