BAA before PHI
Get the vendor’s current Business Associate Agreement and data-handling terms before allowing the system to receive protected health information. Marketing language alone is not enough.
Therapy-practice research · verified Sep. 13, 2026
Best AI Receptionists for Therapy Practices & Clinics (2026)
Therapy calls require a stricter buying process than ordinary lead capture. A receptionist may hear sensitive health information, intake details or crisis language. That makes HIPAA/BAA documentation, escalation rules and practice-management integration more important than the cheapest monthly plan.
What to compare
Therapy-practice receptionist requirements
Crisis escalation
Define exactly what the system does with self-harm, danger, abuse, medical emergency or other crisis language. It should not improvise clinical advice.
Scheduling + intake fit
Verify the exact action in SimplePractice, TherapyNotes or your calendar: booking, rescheduling, cancellation, waitlist, insurance questions and clinician routing are different workflows.
Research shortlist
Three categories to evaluate
AgentZap
AgentZap currently markets directly to therapy practices, states that a signed BAA is included, and names SimplePractice and TherapyNotes integration workflows. Its therapy page lists plans from $109/month.
Non-affiliate benchmark. Verify the actual BAA and integration scope before purchase.
Upfirst — verify carefully
Upfirst’s main pricing page currently references BAAs for HIPAA-regulated businesses, but at least one current industry page states Upfirst is not HIPAA compliant. Because the vendor’s public documentation is inconsistent, ReceptionistLab does not recommend using it for PHI unless Upfirst resolves the discrepancy for your account in writing.
Smith.ai
Smith.ai has strong scheduling, intake and human-escalation capabilities, but its current medical/wellness page explicitly says the AI Receptionist is not HIPAA compliant and cannot handle PHI in regulated healthcare environments. That makes it a poor fit for therapy workflows involving PHI.
Deployment checklist
Before routing therapy calls to AI
- Obtain and review the BAA.Confirm it covers the exact product and subprocessors you will use.
- Map crisis language.Write deterministic escalation paths and test them with synthetic calls.
- Limit intake to what is necessary.Do not collect sensitive details simply because the system can.
- Test booking permissions.Make sure callers cannot see other clients or inappropriate clinician availability.
- Define human takeover.Specify when the AI must stop and route the call to trained staff.
- Review retention.Decide whether recordings/transcripts should exist and for how long.
Related research
Continue researching receptionist fit
Therapy-practice safeguards
AI receptionist for therapists: set privacy and escalation boundaries first
Therapy-practice calls can involve sensitive information and crisis language. Treat compliance, practice-management workflow and escalation as gates before comparing convenience or price.
Verify BAA and PHI handling
Confirm the exact service and contract support the information your workflow may collect before routing real patient calls.
Test your actual calendar path
Verify new-patient booking, rescheduling, cancellations and any practice-management integration with test calls.
Create a crisis-language handoff
Define what the receptionist should do when callers use crisis or emergency language; it should not improvise clinical advice.
Therapy-practice pass/fail
AI receptionist for therapy clinics: do these tests before a real patient calls
For practices, the right evaluation sequence is written data-handling terms, scripted escalation and permitted booking. Price should be considered only after the product qualifies for the actual healthcare workflow.
Agreement and recording boundaries
Request a signed or signable BAA where required, list of subprocessors, transcription retention, recording controls and supported product tier. Do not enter PHI in a trial before these questions are resolved.
Crisis and human escalation
Run synthetic scenarios with urgent and ambiguous language. Require a practice-approved response, clear human escalation and no diagnosis, promised appointment or improvised safety advice.
Calendar permissions and intake
Use dummy client records to test new patient booking, cancellations, clinician assignment, time zones and reminder behavior. Do not infer a practice-system integration from a generic calendar logo.
HIPAA compliance is fact-specific. An advertised BAA alone is not sufficient to establish your practice is compliant; involve your privacy adviser before deploying with PHI.
Check original sourcesHHS BAA guidance →