| Greetmate
Buying a HIPAA-compliant AI receptionist in late 2026 usually starts the same way. You pick a platform, find the compliance badge on the homepage, flip the HIPAA toggle in the settings, and consider it handled.
What the homepage doesn't explain is what that toggle turns on. On the platforms growing fastest right now, HIPAA mode means you bring the pieces: your own AI model account, your own phone carrier account, your own compliance configuration. The vendor supplies the software that connects them. The agreements, the setup, and the upkeep land on you.
Every serious platform can point at a Business Associate Agreement now. So the buying question has moved. It's no longer "is this HIPAA-compliant?" It's "who owns the stack, and who does the work of keeping it compliant?"
This article answers that in plain language: what a practice would actually own on a developer platform, what the costs look like once every provider sends its own invoice, and five healthcare-only options ranked by how much of the burden lands on your team.
Key Takeaways:
Table of Contents
A voice AI receptionist is HIPAA-ready when every layer the call passes through (the phone carrier, the transcription service, the AI model, the voice engine, and the platform itself) is covered by a signed Business Associate Agreement (BAA). If one layer has no BAA, the call path has a gap. No vendor can be "HIPAA certified," because no such certification exists.
A BAA is a contract in which a vendor that touches patient information on your behalf agrees to protect it. A phone call doesn't pass through one vendor. It passes through several, and each one needs to be under contract before the first patient call lands.
The phrase to hold vendors to is "HIPAA-ready, with a BAA available." Treat "HIPAA certified" and "guaranteed compliant" as red flags. Neither exists.
That's the primer. The long version, Best HIPAA-Compliant Voice AI Agents in 2026: What Vendors Won't Tell You, covers vendor contracts, data-retention terms, and what BAAs do and don't cover.
Disclaimer: This article is informational, based on vendor documentation and third-party reporting as of September 2026. It is not legal advice. Have qualified counsel review any BAA or vendor agreement before signing.
The fastest-growing voice AI platforms are built for developers. Vapi and Retell are the two names you'll see most. The model is "bring your own": you bring the accounts, they supply the software that connects them. Here's what that means in practice, in the order you'd run into it.
The AI model account. The voice agent doesn't include the AI model that does the talking. You connect your own account with a provider like OpenAI or Azure, and calls run on your agreement and your billing. Here's the part the homepage skips: no self-serve tier will sign a BAA. OpenAI's API BAA is conditional and only available through a sales process. On Azure, the setting most practices would want is Zero Data Retention, which keeps the provider from storing your call transcripts. Getting it requires an Enterprise Agreement or Microsoft Customer Agreement, plus Microsoft's approval, per Microsoft's own guidance. You can't reach either with a credit card. You reach them with a procurement process.
The phone carrier account. You also bring your own carrier, usually Twilio. Twilio's BAA isn't self-service. You contact sales, the process typically takes one to three weeks, and the agreement covers only a subset of Twilio's products. Twilio's own documentation says it plainly: signing a BAA doesn't by itself make you compliant.
HIPAA as a paid add-on. Then the platform charges for the mode. Vapi's pricing page lists a HIPAA add-on at $2,000 per month, with a Zero Data Retention add-on at $1,000 per month on top. Retell sells HIPAA support as a paid add-on as well. The add-on covers the platform's layer. The model account and the carrier account are still yours to source.
The trade-off nobody prices. HIPAA mode typically disables call logs and transcription review. The record you'd use to check whether the agent handled a call correctly gets switched off. You'd be running an automated receptionist you can't listen back to, and "trust it" isn't a QA policy.
| What the homepage says | What you're actually responsible for |
|---|---|
| "HIPAA-compliant" | Sourcing a BAA-covered AI model agreement yourself; no self-serve tier offers one (Microsoft) |
| "Bring your own carrier" | Opening your own Twilio account, then pursuing its BAA through sales: one to three weeks, partial product coverage (Twilio) |
| "HIPAA mode available" | A paid add-on: $2,000/month on Vapi, plus $1,000/month for Zero Data Retention (Vapi pricing) |
| "$0.05 per minute" | Four to six invoices a month once the model, carrier, and add-ons each bill you (third-party analysis) |
| "Call logs and analytics" | Often switched off in HIPAA mode; you lose the record of what the agent said |
Set the compliance question aside for a moment and ask the operational one: who on your staff owns this?
Not the front desk. They're answering the phones, and that's the job. A practice with 2 to 20 providers and 30 or more calls a day rarely has backend engineering capacity. Most don't have anyone who can negotiate an enterprise API agreement, configure a carrier account, audit six invoices, and test call flows against the odd cases.
So the pattern plays out. The pilot starts. It stalls when the hard parts arrive: the enterprise agreement, the carrier BAA, the add-on fees. Meanwhile, the half-built call flows are already handling real patient calls, because nobody turned them off. And nobody reviews them, because the logs are disabled for compliance and checking them isn't anyone's job.
The platform isn't the failure. The failure is that the work has no owner. We broke down this stall-out pattern, and how deployments get past it, in From Pilot to Production: Why Healthcare Voice AI Deployments Stall.
To be fair to the platforms: Vapi and Retell are good products. The mismatch is the buyer. They were built for teams with engineers.
Reduce front-desk call volume and improve patient communication.
Go live in hours with done-for-you setup.
There's a reason the developer platforms push every piece to the customer, and it's sitting on the pricing page.
Vapi advertises a platform fee of $0.05 per minute. That number looks cheap because it covers only Vapi's slice. The AI model bills you directly. The carrier bills you directly. The compliance add-ons bill you directly. A third-party pricing breakdown put the real all-in cost at $0.13 to $0.33 per minute, spread across four to six separate invoices.
Vapi: headline platform fee vs. reported all-in cost (USD per minute)
If you've been pricing an AI medical answering service, this is the comparison that matters: the headline rate versus the all-in rate, plus monthly add-ons on top. We ran similar math for human answering services in Medical answering service cost in 2026, and the math most quotes hide. The pattern holds across this market. The cheap number is never the whole number.
The structure works for one kind of buyer: a team that can audit six invoices, negotiate enterprise agreements, and still come out ahead. A practice adding another billing statement to the pile isn't that team.
These five are healthcare-only vendors. No generalist voice platforms, no developer APIs; you've just seen what those ask of you. Each entry below is scored the same way: how much of the compliance and infrastructure work lands on your team, and what it costs all-in.
"HIPAA-compliant" here means HIPAA-capable, with a BAA available. Every entry still deserves the five questions at the end of this article. One note on the category: most ranking posts you'll find are published by vendors, and the vendor usually ranks itself first. The caveats below are part of the ranking.
For a different vendor line-up scored on different axes, see our earlier ranking of medical AI receptionists.
Greetmate is healthcare voice and SMS infrastructure with the implementation attached. One vendor runs the whole call stack (the AI model, transcription, the voice, the phone infrastructure) under one agreement. The practice signs one BAA with Greetmate and never sources separate agreements from a model provider or a carrier. Because one vendor runs every layer, one BAA can cover the whole call path. Greetmate is HIPAA-ready, with a BAA available, and that support is part of the base. There's no compliance add-on to buy.
The rollout is done for you. Greetmate scopes the use case, designs the call workflows, connects the EHR (it integrates with dozens of EHRs, and the list keeps growing), and tests everything before go-live. Staff training and early refinement are included, and basic deployments often go live within hours. Staff keep working in the systems they already use.
Visibility stays on. Call reporting and analytics keep running, so leadership can see what came in, what it produced, and where staff action is needed. Calls that need a person route to a person, on routing rules the practice defines; the automation handles the routine. Greetmate was recognized in the 2025 Globee Awards for AI and the 2025 Titan Awards.
Assort Health is a patient-access platform for specialty and multi-specialty groups (orthopedics, cardiology, immunology, and similar). The company says its agents are trained on more than 125 million patient interactions across 20-plus specialties, that they write back to the EHR in real time in Epic, athenahealth, and Oracle Health, and that it expanded into outbound agents in May 2026. [VERIFY: source needed]
This is the enterprise option on the list. The strength is scale and specialty depth. The trade-off is the buying process: no public pricing, a sales cycle, a contract review, and an implementation conversation on an enterprise timeline.
For a large multi-specialty group with procurement support, Assort belongs on the shortlist. For a two-provider clinic, it's likely outside the practical range: the engagement will be sized for a bigger organization.
S10.AI is an AI medical receptionist (the agent is called BRAVO) with ambient documentation for providers alongside it. The compliance posture is the standout. A third-party roundup found that S10 includes the BAA on every plan, signed at account creation, with no upcharge and no sales negotiation, a posture that review called unique among the vendors it covered and a direct answer to the add-on pattern above.
Functionally, it handles scheduling, intake, and insurance verification, and it names specific EHR integrations. The same review places pricing at $99–$159 per provider per month. One caveat to act on: the SOC 2 report isn't publicly linked, so ask for it directly.
Arini is a dental-only AI receptionist for dental groups and DSOs. The focus is real: the workflows, the terminology, and the integrations are all dental, and strong answer rates with scheduling automation inside dental practice-management systems are the headline claims.
The caveat is the mirror of the strength. If you operate outside dentistry, this isn't your vendor. If you are a dental group, confirm compatibility with your exact practice-management system early: dental runs on a wide mix of systems, and the public integrations documentation has been hard to verify.
Rivvi is the newest name here. Its product page offers a free self-serve tier with a signed BAA and a branded phone number included, positioned squarely against the developer APIs described earlier and aimed at small practices priced out of managed options.
That's a real answer to a real problem, and a BAA included on a free tier is the direction this market needed to move. The honest caveat: the track record is thin, and there isn't much independent reporting yet on how it performs at volume.
| Vendor | What you'd own | BAA and compliance terms | Typical cost | Best fit |
|---|---|---|---|---|
| Greetmate | Workflow decisions and sign-off; the vendor owns the rest | One BAA covers the stack; HIPAA-ready, with a BAA available; in the base | $999–$2,500/mo + $0.18/min over an allowance | Practices and multi-location groups |
| Assort Health | The enterprise negotiation | Enterprise terms via sales | No public pricing | Large multi-specialty groups |
| S10.AI | Setup and configuration | BAA on every plan, signed at signup | ~$99–$159 per provider/mo | Practices wanting fast, BAA-included software |
| Arini | Practice-management compatibility checks | Confirm with the vendor | Quote-based | Dental groups and DSOs |
| Rivvi | The evaluation risk of a new entrant | BAA included, even on the free tier | Free to start; paid usage TBD | Small practices on tight budgets |
Every vendor above keeps the heavy pieces off your plate. What differs is how much is left over, and what the removal costs.
In fairness, the developer platforms are good products for the right buyer.
Engineering-led digital health companies building their own products. RCM platform builders embedding voice into their software. Managed service providers with the technical staff to run a multi-vendor stack and the customer base to spread it across. For those buyers, bring-your-own APIs mean control and margin, and the enterprise agreements are a cost of doing business they're staffed for.
A small or mid-size practice isn't that buyer. No backend engineering. No procurement team for enterprise API agreements. Nobody whose week has room to reconcile six invoices and chase a carrier BAA.
The one-sentence test: if nobody on your team can explain what a Zero Data Retention endpoint is (the configuration that keeps an AI provider from storing your call transcripts), the homepage wasn't written for you.
The alternative is simple to describe. One vendor owns the whole stack. One BAA covers the call path. A working system is handed over after it's been built and tested, and implementation is part of the purchase. Your team doesn't inherit a build project.
After go-live, leadership keeps visibility: what came in, what it produced, and where staff need to act. Reporting stays on. When something breaks, there's one vendor to call, the one that built it.
Before signing with anyone, on any route, run these questions:
For the full map of how practices buy this (build it yourself, buy software and build on it, or buy a managed implementation), read Voice AI for healthcare: 3 buying routes, compared. For the compliance detail, the April deep dive on HIPAA-compliant voice AI agents covers vendor contracts and retention terms.
If the managed route fits your practice, book a demo and bring those five questions with you.
No. A call passes through several providers, and every layer that touches patient information needs a BAA. Most platforms leave at least one layer for you to source. Hold vendors to "HIPAA-ready, with a BAA available," and treat "HIPAA certified" as a red flag: that certification doesn't exist.
Technically, yes. Practically, no. The path runs through enterprise API agreements, a carrier BAA that takes weeks, paid HIPAA add-ons, and someone on staff who maintains all of it. Practices that try usually end up with a stalled pilot and half-built call flows handling real calls.
Across this list: a free tier (Rivvi), roughly $99–$159 per provider per month (S10.AI), and $999–$2,500 per month for a managed deployment (Greetmate). On a developer platform, the all-in rate runs $0.13–$0.33 per minute once every provider bills you, with HIPAA add-ons on top.
On a bring-your-own platform, you do, and there are several: the platform's, the AI model provider's, the carrier's. On a managed route, one BAA with the vendor covers the whole stack, because the vendor runs every layer.
The five questions above: stack ownership, BAA scope, whether HIPAA mode disables logging, what implementation includes, and all-in cost at your call volume.
Bought well, no. The phone is the bottleneck; the front desk isn't. These systems take routine call volume off your team so they can do the work that needs a person. Any vendor selling this as headcount replacement is overselling what the technology does.
Compliance stopped being the differentiator this year. Every homepage has the badge. Every sales deck has the BAA.
What separates vendors now is who does the work: who sources the agreements, who builds and tests the workflows, who keeps the reporting on when HIPAA mode is enabled, and who answers when something breaks. For an administrator at a practice with no engineering team, that question decides the purchase more than any feature list.
The developer route is honest about what it costs, in invoices and in work, if you're staffed for it. If you're not, the practice-ready route exists: one vendor, one BAA, a working system handed over, and reporting you can act on.
See what that looks like at your call volume: book a demo.
Handle patient calls around the clock — including after-hours and overflow — so your front desk can focus on in-office care.
Automate appointment scheduling, patient follow-ups, and reactivation outreach through workflow-driven voice communication.
Connect with your existing EHR, scheduling tools, and operational systems for seamless, end-to-end patient communication.
See Greetmate in Action.
Healthcare voice AI infrastructure — live in hours.
Find helpful articles in our blog that are all about business, customer service and AI technology.
A self-serve builder, an enterprise contact-center proposal, and a managed platform are three different kinds of purchase. Here is how they line up on who designs the workflow, who connects the EHR, who tests the edge cases, and who owns it in month four.
Weekly-visit specialties churn appointments daily, and answering the phone is only half of what recovers a cancelled slot. Here is how to design coverage for reschedules, new-patient calls, insurance questions and the calls that need a person on the line, plus what should never be automated.
