Best AI Answering Service for a Small California Medical Practice

What a small California practice should require before it signs

A small California medical practice evaluating an AI answering service should require five things in writing: a HIPAA business associate agreement, a statement of how call recordings and transcripts are stored and for how long, a greeting that discloses recording and identifies the AI, an escalation path to a human for urgent and clinical calls, and a booking connection to the practice's own scheduling system. Each requirement maps to a California law or to the reason calls are missed.

CMIA (Civil Code 56): the answering service is a contractor handling medical information

California's Confidentiality of Medical Information Act, Civil Code section 56 and following, prohibits a provider of health care or its contractor from disclosing a patient's medical information without authorization, with listed exceptions. Civil Code 56.10(c)(3) permits disclosure to an entity that provides billing, claims management, medical data processing or other administrative services for providers, which is where an answering service sits, and bars that recipient from disclosing the information further. The practical point for a small practice is that the CMIA reaches the vendor as well as the office.

Civil Code 56.36 sets the cost of getting this wrong: nominal damages of 1,000 dollars per patient without proof of harm, plus actual damages, and administrative fines or civil penalties of up to 2,500 dollars per negligent violation and up to 25,000 dollars per knowing and willful one. A recorded call that names a diagnosis or a medication is medical information, so ask where the recording lives and how long it is kept. A BAA covers HIPAA; make the CMIA side explicit in the contract too.

CIPA (Penal Code 632 and 632.7): what recording consent means for an AI receptionist

The California Invasion of Privacy Act, Penal Code section 632, makes it an offense to intentionally record a confidential communication without the consent of all parties, with a fine of up to two thousand five hundred dollars per violation. Section 632.7 applies the same rule to calls involving cellular and cordless phones. An AI receptionist records and transcribes by design, so the practical answer is a notice in the first sentence of the greeting: the call is recorded, and the caller is speaking with an automated assistant.

Play the notice before any hold or transfer, and ask counsel whether a recorded transfer leg to staff needs its own notice. A caller who declines to be recorded needs a path that still helps them, such as a transfer to a person or a callback without recording. Penal Code 637.2 gives a private right of action under this chapter, so a missing notice is a lawsuit risk, not only a fine.

CCPA and CPRA: when they apply to a practice and when medical information is exempt

The California Consumer Privacy Act, as amended by the CPRA, applies to a for-profit business that meets one of three thresholds published by the California Privacy Protection Agency: annual gross revenue of 26.625 million dollars or more (effective January 1, 2025), buying, selling or sharing the personal information of 100,000 or more California residents or households, or deriving 50 percent or more of revenue from selling or sharing personal information. Most small practices meet none of them, and Civil Code 1798.145 exempts medical information governed by the CMIA and protected health information held by a HIPAA covered entity or business associate.

The exemption covers medical information and PHI, not marketing lists, website analytics or data on callers who never became patients, which can fall outside it. A vendor serving many industries may be a CCPA business in its own right, so read how its privacy policy treats your call data.

AB 3030 (2024): generative AI disclosure for patient communications

AB 3030, signed in September 2024 and in force since January 1, 2025, added Health and Safety Code section 1339.75. A health facility, clinic, physician's office or group practice that uses generative AI for written or verbal patient communications pertaining to patient clinical information must include a disclaimer that the communication was generated by AI and clear instructions for reaching a human provider. For audio, the disclaimer is given verbally at the start and the end of the interaction. It does not apply when a licensed or certified provider reviews the communication first, and patient clinical information means information about the patient's health status, not scheduling, billing or other administrative matters.

Booking a visit, confirming an address, taking a refill request and reading back office hours are administrative. Explaining a result or advising on a symptom is clinical, and an AI that does that must carry the disclaimer at the start and the end of the call. The safer design routes those calls to your staff or on-call clinician. The Medical Board of California or the Osteopathic Medical Board has jurisdiction over physicians who violate the section, so ask how the agent handles a clinical question and listen on a test call.

How MedReception AI handles this for California practices

MedReception AI is a physician-built AI answering service for medical and dental practices, with HIPAA compliance verified by Compliancy Group and a business associate agreement included at every price. It acts as your business associate, not a covered entity. Katie answers during the day, Annie covers after hours, Victoria turns voicemail into structured summaries and Sallie handles scheduling, each custom-built around the practice's own rules. Because the greeting is written with you, a recording notice and an AI introduction sit in its first sentence, and clinical questions go to your staff or on-call clinician, not the agent.

Booking is what turns a missed call into a visit instead of a callback. MedReception AI books end to end in English, Spanish and Korean and answers routine calls in 59 languages. It is live with eClinicalWorks, Elation Health, ModMed, Tebra, Office Ally, SimplePractice, Practice Fusion and others. On athenahealth, Katie connects to the athenaOne schedule for live availability and patient lookup while she is on the call, and appointment write-back is rolling out practice by practice. Epic and Veradigm are available through secure workflow automation. Setup is typically one week from signup to launch.

Managed plans are 495 dollars a month for 500 minutes, 995 dollars for 1,000 minutes and 1,495 dollars for 2,000 minutes. Studio, the self-serve version, is 299 dollars a month for 500 minutes and 95 cents per additional minute, with the same BAA. Paul Toomey, MD, Co-Founder and CEO, is a surgeon, which is why the escalation rules treat a post-op fever differently from a parking question.