BAA before PHI
Get the vendor’s current Business Associate Agreement and data-handling terms before allowing the system to receive protected health information. Marketing language alone is not enough.
Therapy-practice research · verified Sep. 13, 2026
Best AI Receptionists for Therapy Practices & Clinics (2026)
Therapy calls require a stricter buying process than ordinary lead capture. A receptionist may hear sensitive health information, intake details or crisis language. That makes HIPAA/BAA documentation, escalation rules and practice-management integration more important than the cheapest monthly plan.
What to compare
Therapy-practice receptionist requirements
Crisis escalation
Define exactly what the system does with self-harm, danger, abuse, medical emergency or other crisis language. It should not improvise clinical advice.
Scheduling + intake fit
Verify the exact action in SimplePractice, TherapyNotes or your calendar: booking, rescheduling, cancellation, waitlist, insurance questions and clinician routing are different workflows.
Research shortlist
Three categories to evaluate
AgentZap
AgentZap currently markets directly to therapy practices, states that a signed BAA is included, and names SimplePractice and TherapyNotes integration workflows. Its therapy page lists plans from $109/month.
Non-affiliate benchmark. Verify the actual BAA and integration scope before purchase.
Upfirst — verify carefully
Upfirst’s main pricing page currently references BAAs for HIPAA-regulated businesses, but at least one current industry page states Upfirst is not HIPAA compliant. Because the vendor’s public documentation is inconsistent, ReceptionistLab does not recommend using it for PHI unless Upfirst resolves the discrepancy for your account in writing.
Smith.ai
Smith.ai has strong scheduling, intake and human-escalation capabilities, but its current medical/wellness page explicitly says the AI Receptionist is not HIPAA compliant and cannot handle PHI in regulated healthcare environments. That makes it a poor fit for therapy workflows involving PHI.
Deployment checklist
Before routing therapy calls to AI
- Obtain and review the BAA.Confirm it covers the exact product and subprocessors you will use.
- Map crisis language.Write deterministic escalation paths and test them with synthetic calls.
- Limit intake to what is necessary.Do not collect sensitive details simply because the system can.
- Test booking permissions.Make sure callers cannot see other clients or inappropriate clinician availability.
- Define human takeover.Specify when the AI must stop and route the call to trained staff.
- Review retention.Decide whether recordings/transcripts should exist and for how long.
Related research