How many patient calls is your practice missing?
Most dental practices miss 30-40% of inbound calls. See how AI reception can capture every call 24/7.
Before I connect AI to a practice management system, I want to know what happens to the patient information it can access.
That can include far more than a name and phone number: appointments, insurance details, balances, recordings, messages, and information from the chart. I'd want the vendor to walk me through where it all goes.
Privacy was one of my first concerns when I began testing dental AI. Being able to answer more calls wouldn't persuade me to move forward without understanding how patient and practice data are handled.
This article provides general educational information and is not legal advice. Practices should review their specific implementation with qualified privacy and legal professionals.
HIPAA compliance is a shared responsibility
No software purchase makes the dental practice compliant by itself. The vendor may provide compliant infrastructure and contractual safeguards, while the practice remains responsible for its own risk analysis, workforce access, policies, training, and use of the system.
HHS explains that a cloud service provider creating, receiving, maintaining, or transmitting electronic protected health information on behalf of a covered entity is generally a business associate. An appropriate Business Associate Agreement is required when that relationship applies, along with the other relevant HIPAA requirements.
Start with the Business Associate Agreement
The BAA should define the vendor's permitted uses and disclosures of protected health information, required safeguards, breach responsibilities, subcontractor obligations, and what happens to the information when the relationship ends. The practice should understand which legal entities and services the agreement covers.
A BAA is one part of the review. The US Department of Health and Human Services also directs covered entities to understand the cloud environment and conduct appropriate risk analysis and risk management.
Map the patient information before approving access
I'd ask the vendor to walk through a call from beginning to end: what it retrieves from the PMS, whether it records or transcribes the conversation, where that information is stored, and what it sends back. Texts and attachments need the same attention.
Then I'd ask who can access those records, how long they're kept, what happens to them when the contract ends, and whether they're used to train AI models. I'd want answers specific to our setup.
Minimum necessary access applies to integrations
An AI workflow should receive the information needed for its approved job. A recall workflow may need the due date, patient contact information, appointment status, and scheduling availability. It does not automatically need unrestricted access to every clinical note.
Read and write permissions also deserve separate review. An integration that reads the schedule presents a different risk from one that can create appointments, update patient details, or post payments.
AI creates additional questions
I'd also test what the agent says and does with the information it can see. A secure connection alone doesn't tell me whether it will handle a shared phone number or a request for chart details properly.
- Which sources may the AI use when answering a patient?
- Can it reveal patient information before identity is verified?
- Can staff see the complete conversation and AI response?
- What happens when multiple patients share a phone number?
- How do urgent or sensitive conversations reach a person?
- Can a user correct or remove inaccurate source material?
- Are configuration changes logged and reviewable?
Before signing, I'd want to see how the agent handles a question about a patient's documented treatment plan after verifying identity and access. Can it explain what is recorded without making a new diagnosis or treatment decision? That distinction matters to me as much as whether it can retrieve the chart.
What TensorLinks currently publishes
TensorLinks states that eligible customers can receive a BAA before protected health information is processed. Its security page also describes role-based access controls, audit logging, encryption at rest and in transit, least-privilege PMS integration, isolated tenant data, multi-factor authentication, monitoring, risk assessments, and security documentation available for review.
I'd use that published information to start the discussion, then ask for the documents and contract that apply to our account.
Do not forget phone and recording requirements
HIPAA is not the only rule that may apply. Automated calls and texts can raise federal and state communication requirements. Call recording and AI disclosure rules can also vary by state. The practice should review the intended communication type, consent process, patient notice, and recording configuration with counsel.
A simple review process for a dental practice
- Identify each workflow and the patient data it requires
- Review the BAA, privacy terms, and security documentation
- Confirm the PMS permissions for each workflow
- Test identity verification and shared contact information
- Review recordings, transcripts, and staff alerts
- Train staff on appropriate use and escalation
- Reassess the system after material product or workflow changes
What I'd need before moving forward
I don't need to understand every line of code. I do need to understand where our data goes, who can use it, what the contract covers, and what our team will be responsible for.
If those answers are vague, I'd keep asking before connecting the system.
Sources and further reading
