.png)
Quick answer: An AI receptionist needs a Business Associate Agreement (BAA) whenever it handles protected health information for a HIPAA covered entity, and med spa calls usually include it: a caller's name tied to a treatment. CallPad offers a BAA. Whether your med spa is a covered entity is a question for your counsel.
Here's why it matters. The phone at the front desk rings while your injector is mid-treatment and your one front-desk person is two rooms away, walking a new client through a consent form. By the time anyone gets to it, the caller is gone. The obvious fix is to let software pick up. The reason a lot of med spa owners hesitate is the very next thought: this is health information, and I can't just hand it to any tool.
No AI receptionist is HIPAA compliant on its own, and there's no official HIPAA certification for software. The best fit for a med spa is one that signs a BAA in writing before it handles patient calls, books consults into your booking system with the right provider, passes clinical questions to your staff, keeps treatment details out of texts and voicemails, and lets you review every call. CallPad offers a BAA.
Many owners assume the answer is automatically yes because there are needles and prescriptions in the building. The real test is narrower. Health care providers are covered entities "only if they transmit any information in an electronic form in connection with a transaction for which HHS has adopted a standard" (HHS, Covered Entities and Business Associates). Those standard transactions include things like filing a claim or checking a patient's benefit eligibility. HHS also offers a question-and-answer decision tool on the same page to help you work out where you stand.
Being cash-pay doesn't settle the question on its own. What matters is whether your practice, or anyone acting for it, carries out any of those standard electronic transactions. If your practice ever bills a health plan or checks a patient's coverage electronically, for example, that can bring you in. That's why the answer comes from the HHS test and your counsel, not from how your clients pay.
HHS defines a business associate as a person or entity that "performs functions or activities on behalf of, or provides certain services to, a covered entity that involve access by the business associate to protected health information" (HHS, Business Associate Contracts).
An AI receptionist answering your phone hears names, phone numbers, treatments and reasons for booking, and it writes appointments into your calendar. For a covered entity, that is the work of a business associate. HHS is clear about what follows: a covered entity that engages a business associate "must have a written business associate contract or other arrangement" with it (HHS).
Yes. CallPad offers a BAA. Book a demo and ask about our BAA.
Here's what CallPad does on your calls:
Our security overview explains how we protect data: data in transit is encrypted using HTTPS/TLS, access is controlled through role-based authentication and logging, and monitoring and alerts are in place for suspicious activity. For the full picture of how CallPad works for med spas, see our AI receptionist for med spas page.
Most of the exposure isn't in your software. It's in the conversation. A caller leaves a name, a number and a reason for calling, and that reason is often a procedure: a filler consult, a laser package, a follow-up after a chemical peel. Tie a name to a treatment, and you have protected health information.
That's why the minimum necessary idea matters on the phone. HHS says providers may leave messages for patients on answering machines, but should "take care to limit the amount of information disclosed". For example, a provider "might want to consider leaving only its name and number and other information necessary to confirm an appointment, or ask the individual to call back" (HHS FAQ on leaving messages). Any tool that answers or calls on your behalf should respect the same limits a trained front-desk person would. The same goes for texts: CallPad keeps treatment details out of reminder and confirmation texts.
No. Even outside HIPAA, health information isn't a free-for-all.
The practical takeaway: treat every booking call as if it carries health information, because it usually does. Running a clinic in the UK? See what UK clinics should check about call and health data under UK GDPR.
Before you switch on any phone tool, ask:
The privacy question gets the attention, but the bigger day-to-day leak is usually the phone going unanswered. Only 42% of consumers say they leave a voicemail when a business doesn't answer, and 21% say they immediately call another business (CallRail, 2025). For salons and spas, Zenoti, a booking platform vendor, reports that only 24% of callers who reach voicemail leave a message (Zenoti, 2025).
People also expect a quick answer. Almost two-thirds of buyers expect a reply within 10 minutes, whether they're asking about sales or service (HubSpot Research, 2018). For more on how those calls behave, read why clients won't leave a voicemail.
An AI receptionist can be used in a HIPAA-compliant way, but no software is compliant on its own, and the burden is on you to confirm the setup rather than assume it. Work out whether your med spa is a covered entity, remember that the FTC and your state may have a say even if it isn't, and treat every booking call as if it carries health information. Then hold any phone vendor to the standard you'd set for a new hire at the front desk: a signed BAA, real safeguards, and the discipline to say only what's needed.
CallPad is an AI receptionist for med spas, salons, spas and clinics in the US, UK, Australia and Canada. CallPad offers a BAA. It answers every call 24/7, handles several calls at once and screens out spam calls. It answers questions from your own information, including your prices, and speaks several languages, and books, moves and cancels consults and treatments in real time on supported booking systems, including multi-service bookings. It can take a deposit or payment on the call or sell a gift card. It replies to texts and can book by text, sends missed-call text-backs, and texts patients on your waitlist when a slot opens. For clinical questions, it transfers the call to your team or takes a message. Talk to CallPad about your med spa.
If it handles protected health information for a covered entity or a business associate, yes. HHS requires a written business associate contract or other arrangement.
Yes. CallPad offers a BAA. Ask our team for it when you book a demo.
Not automatically. It depends on whether you transmit any of the standard electronic transactions HHS has adopted, so ask your counsel. State law and the FTC may apply anyway.
No software is "HIPAA certified", because no such certification exists. Compliance depends on a signed BAA plus how you and the vendor handle protected health information.
Yes, if the message is kept minimal. HHS suggests leaving only the practice name, number and information needed to confirm an appointment, or asking the patient to call back.
No. Your instructions tell CallPad to pass clinical questions, such as candidacy, dosing, reactions and aftercare, to your staff. CallPad can transfer the call to a team member or take a message.
CallPad books in real time with Zenoti, Mindbody, Booker, Square, GlossGenius, Setmore, Cliniko and Google Calendar. On Vagaro, it answers calls and captures booking requests. No CallPad Vagaro integration yet; contact us and join the waitlist. Using another system? Ask us.
If it handles protected health information for your covered entity, it can be a business associate too, so ask whether it's under a BAA with you. Some booking platforms say they will set one up on request; Cliniko, for example, says so on its security page.
Yes. CallPad keeps treatment details out of reminder and confirmation texts.
Yes. CallPad can take a deposit on the call, either by texting a payment link or using a card on file in your booking system.
Ready to stop missing consult calls? Book a demo and ask about our BAA, or hear CallPad answer a consult call.
We use cookies for analytics and ads. Accept or reject non-essential cookies. Privacy policy
