HIPAA Controls for Cerbo AI Practices

Does HIPAA reach a cash practice?

Cash-pay and DPC practices sometimes assume HIPAA is only about insurance. The rule is more specific: a health care provider is a covered entity if it conducts certain standard transactions electronically, such as claims or eligibility checks. A practice that never does may fall outside the definition, while one that bills insurers electronically, directly or through a billing service, generally falls inside it.

Even where HIPAA may not strictly apply, operating to its standards is sensible. Patients expect it, and state privacy laws can apply regardless. Some states protect health information more broadly than HIPAA does, and some impose their own breach notification duties. Your counsel should confirm where your practice stands.

What MedReception AI provides

MedReception AI's HIPAA compliance is verified by Compliancy Group, and a Business Associate Agreement is included with the service. Sign the BAA before patient calls reach Katie, and file it with your other vendor agreements.

Add MedReception AI to your list of business associates and to your next security risk analysis. Both are steps an auditor looks for when a practice adds a vendor that handles patient information. Ask your data handling questions before you sign, and keep the answers with the agreement.

Controls that stay with you

A vendor's compliance does not replace your own. These controls remain your practice's responsibility:

• Deciding which staff can see call summaries, and removing access when people leave
• Securing the computers and browsers where staff use Cerbo and MedReception Autopilot
• Setting the minimum information Katie collects for each call type
• Keeping clinical detail out of text messages
• Training staff on handling summaries that contain patient information

Minimum necessary, by design

The rules you give Katie decide what she collects. Ask only what staff need to act: identity, reason, request and urgency, plus the specific questions your clinicians require for certain services. A scheduling call does not need a full medical history. Revisit the questions whenever a service is added, because intake questions tend to accumulate and are rarely removed.

Because the AI never gives medical advice and never shares clinical information with callers, much of the privacy design on the call itself comes down to collecting no more than necessary, and your rules control that.

Autopilot and the chart

MedReception Autopilot files each call summary to the patient's chart in Cerbo from a staff member's own signed-in browser. The entry is therefore made under a real Cerbo user your practice manages, not an anonymous system account.

Treat Autopilot like any other tool on a workstation with chart access: covered by your access policies, your workstation security and your staff training. When a staff member leaves, removing their Cerbo access and browser profile also ends any filing under their name.