AI Chatbot for Clinics and Dentists: Front Desk, Booking and HIPAA

At 10 p.m. three messages arrive in a dental practice's website chat: "Do you take my insurance?", "Are you open on Saturday?" and "My crown came off and it hurts, is that an emergency?" The first two are front-desk questions the practice's website can answer. The third is clinical. A well-built chatbot answers the first two at once and handles the third without advice: it gives the emergency number and the out-of-hours line, and passes the conversation to staff.

The guide is written for owners and managers of dental offices, medical and physiotherapy clinics, med spas and therapy practices; phone answering is a separate product, covered in the AI receptionist guide. The HIPAA, UK GDPR and Washington state sources below were read on 19 October 2026, and none of it is legal advice. PepoChat is our product and the worked example. Its website and docs do not offer a HIPAA business associate agreement, and the sections below say plainly where that limits what you should let it do.

What should a clinic chatbot do, and what must it never do?

A clinic chatbot should answer practical questions from information your practice publishes, book visits or link to your booking page, and hand every clinical question to a person. It must never collect symptoms, diagnoses or other health information, give medical advice or judge urgency.

An AI support agent is a chatbot that answers from your own knowledge base, takes actions such as booking an appointment, and hands the conversation to a person when it cannot help. For a practice, the knowledge base is the public website plus a few documents such as an insurance list.

Every item in the right-hand column either needs clinical judgement or would put health information into a tool that may not be allowed to hold it. The law firm chatbot guide draws the same kind of line around legal advice.

What do patients ask a practice website?

Patients mostly ask about access, money and logistics, which a chatbot answers well from pages you already have. The table marks who should answer each of 25 questions a front desk hears every week; the examples lean dental.

The chatbot can finish 15 of the 25 questions and start three more; seven belong to staff from the first message. For those seven, the chatbot's job is a quick handoff: "I can't advise on that here. Call the practice on 555-0142 during opening hours, or I can pass your question to the team."

Can a clinic use an AI chatbot without violating HIPAA?

Yes, if the chatbot never handles protected health information. A US practice covered by HIPAA needs a business associate agreement with any vendor that creates, receives, maintains or transmits patients' health information for it, and a chatbot that takes symptoms or books appointments for the practice is such a vendor.

A covered entity is a health plan, a clearinghouse or a health care provider that transmits health information electronically in a covered transaction, so a practice that sends insurance claims electronically is covered, while a cash-only med spa may not be. Protected health information (PHI) is information that identifies a person and relates to their health, their care or payment for it, held by a covered entity or its vendors. A business associate agreement (BAA) is the contract in which a vendor that handles PHI for a covered entity promises to safeguard it.

HHS spells out the chatbot case. Its business associates page, last reviewed on 30 July 2026, lists as an example a third-party AI chatbot on a provider's patient portal that handles PHI for "symptom assessment, medical reminders, and appointment scheduling". HHS's guidance on online tracking technologies adds that a public page about a location or visiting hours often gives a vendor no access to PHI, while an email address or a reason for seeking care, typed while booking an appointment or entering symptoms, counts as PHI. HHS notes that a court vacated part of that guidance on 20 June 2024, the part about linking an IP address to a visit to a public page on health conditions or providers.

PepoChat's site and docs do not offer a HIPAA business associate agreement, so the chatbot must not collect symptoms, diagnoses or other health information. HHS's examples put booking on the business associate side too, because a booking ties a named person to their care, so a covered US practice should let the chatbot answer practice questions and link to the scheduler or patient portal it already uses under a BAA. PepoChat's privacy notes list where messages go (PepoChat's servers, OpenAI models for replies, Resend for email), and PepoChat does not currently claim a hosting region, a signed data processing agreement template, or SOC 2 or ISO certification.

Chats in PepoChat start anonymous and the widget sets no cookies on your site, so what matters is what people type. Lead capture, which you can leave off, and the after-hours handoff both ask for an email address; decide with your privacy officer whether that is acceptable in a tool without a BAA.

Rules as read on 19 October 2026.

Which other health data laws apply?

Washington's attorney general calls the state's My Health My Data Act the first privacy law in the US to protect personal health data outside HIPAA. The act targets consumer health data collected or shared without consent, has bound small businesses since 30 June 2024, and is enforced by the attorney general and through private lawsuits. Med spas and wellness studios outside HIPAA should check for laws like it.

In the UK and the EU, health data is a special category under Article 9 of the GDPR, and processing it is prohibited unless a condition applies, such as explicit consent or the provision of health care. The ICO's special category data guidance treats appointment details as health data when they reveal something about a person's health: a single GP check-up may not, while a series of physiotherapy sessions can. The ICO says that guidance is under review after the Data (Use and Access) Act, and the GDPR guide for chatbots covers the general duties.

What should the chatbot say when a patient describes symptoms?

The chatbot should decline to assess symptoms, give the emergency number, offer a person and stop: no follow-up questions, no repeating the details back, no reassurance. Put the rule in the greeting, which sets expectations, and in the hard rules, which enforce them.

In PepoChat the greeting is the first message of every new conversation, the natural place for an explicit "no medical advice; emergencies call your local emergency number" line:

Hi, I'm Northside Dental's AI assistant. I can help with opening hours, insurance plans, prices and appointments. I can't give medical advice, so please don't share health details here. If this is an emergency, call 911 or your local emergency number.

PepoChat's agent instructions have two fields: "How to sound and behave", up to 4,000 characters, and "Never do this", up to 2,000. The agent declines anything on the second list and offers what it can help with instead, while its base rules still apply: search the knowledge base first, never invent an answer, offer a person. A "Never do this" block for a practice, at 895 characters:

Never give medical, dental or mental health advice, a diagnosis, or an opinion on symptoms, test results, medicines or treatment choices.
Never ask about symptoms, conditions, medicines, allergies, pregnancy or medical history. If a visitor shares them, do not repeat or comment on them; say this chat can't handle health details and give the practice phone number.
Never judge how urgent something is. Say: "If this is an emergency, call 911 or your local emergency number," then offer to connect them with the practice.
Never ask for a date of birth, an insurance member ID, a Social Security number or card details.
Never confirm whether someone is or was a patient, or discuss their appointments, records or bills.
Never estimate what insurance will pay or what a patient will owe. Quote only prices on our fees page.
Never say or imply that you are a person, a nurse, a dentist or a doctor.

Outside the US, swap 911 for your country's number, such as 999 in the UK or 112 in the EU, and keep the sentence in quotation marks so the chatbot does not soften it.

Patients will still type health details. Whatever a visitor types is stored with the conversation and sent to the model that writes the reply, and the escalation email to your team quotes the last three messages. Set data retention to delete resolved conversations after 30 days, and treat the inbox's CSV export, which holds full transcripts, as confidential.

Say that the chatbot is an AI in its name and its first message. Several US states regulate AI in health care, Texas and California among them, and the AI disclosure laws guide covers their rules.

Should the chatbot answer insurance and price questions?

Yes, the general ones: which plans you accept, whether you are in network, whether you file claims and what self-pay patients pay. What a plan pays for one patient's crown needs the member number and a benefits check by your staff.

Publish a page with a table of accepted plans: the plan name, your network status and a note such as "we file the claim". PepoChat's crawler converts a page's main content to text, so a plain table imports as a table, while a row of insurer logos gives the chatbot only whatever alt text the images carry. Press Sync website pages after changing the list; website sources otherwise refresh weekly.

List self-pay prices the same way and add PepoChat's suggested guardrail, "Never quote prices that are not in the knowledge base". Fill the gaps with Q&A pairs phrased the way patients ask, such as "Do you take my insurance?" answered with a link to the list. Q&A pairs do not count as knowledge sources, and a Free workspace holds 100 of them.

Can the chatbot book appointments into your calendar?

Yes, where your privacy rules allow it: the chatbot shows real openings in the patient's own time zone, books the chosen slot, and the scheduling system confirms it. PepoChat's built-in booking connects only to a PepoSmart scheduling calendar, using an API key.

1. You switch on up to 12 meeting types, each with a "when to offer this" note such as "New patient visit: offer to adults who are not yet patients".
2. When a visitor asks for an appointment, the agent checks openings up to 14 days ahead and offers a handful in the visitor's local time.
3. For a type with several locations, the agent asks which one; if staff call the patient, it asks for a phone number.
4. The agent asks for a name and email, unless the visitor is a verified visitor who confirmed an email in the chat with a one-time code.
5. PepoSmart re-checks the slot so nobody is double-booked, assigns a host (round-robin works) and sends the confirmation and reminders.

Three details matter for a practice. Paid event types are never offered, so a consultation that needs a deposit stays with the front desk or becomes a free type. The booking carries the visitor's name, email and time zone, plus a phone number or location when the type needs one, and has no free-text reason field. And the agent cannot cancel or move an appointment, so reschedules go to staff.

Name meeting types neutrally. Under the ICO's reading an appointment is health data when it reveals something about the patient's health, so "Initial assessment" is a safer label than "Root canal consultation". The appointment booking guide covers time zones and hosts, and the booking docs list each step.

Does the chatbot work after hours?

Yes. The chatbot answers practice questions at any hour and, when someone needs a person, says honestly when or how the team will reply. PepoChat's Team availability setting has three options:

• My team answers in the chat, the default: the agent says a teammate will pick up shortly.
• My team answers during business hours, which suits most practices: outside your hours the agent gives your away message, asks once for an email address before it hands over, and the widget shows "team offline".
• No one answers live chat, we follow up by email, for a solo practitioner: the agent never promises a person, asks once for an email address and hands over.

The away message takes up to 300 characters, enough for: "Reception is closed until 8:00 tomorrow. For appointments, call 555-0142 or book online. We can't give medical advice in this chat. If this is an emergency, call 911 or your local emergency number." The offline message examples include more versions for clinics.

Two handoff facts matter. By default every workspace member gets an email headed "A visitor needs a person" that quotes the last three messages, so anything a patient typed can reach your team's mailboxes. And replies typed in the team inbox are not emailed to the visitor, so the next-morning follow-up goes by email or phone; the human handoff docs and the guide to 24/7 support without a night shift cover the routine.

How do you set up a clinic chatbot in an afternoon?

Plan three to four hours, mostly writing pages, not configuring software. In PepoChat:

1. Tidy the pages. Cover hours and holidays, locations and parking, services, accepted insurance as a table, self-pay prices, a new-patient checklist, the preparation and aftercare sheets you hand out, your cancellation policy and an emergency page.
2. Import the website. In Knowledge Base → Add New, start a crawl: up to 200 pages, 3 levels deep, counted as one knowledge source. Exclude blog articles about symptoms and conditions, which invite clinical answers.
3. Add 20 Q&A pairs under Knowledge Base → Add New → Text & Q&A, phrased the way patients ask.
4. Write the instructions and greeting under Widget Customization: an assistant name with "AI assistant" in it (up to 40 characters), the greeting and the "Never do this" block.
5. Set Team availability to business hours with an away message, and Data retention on the Team page to 30 days.
6. Connect booking or link to it. Paste your PepoSmart API key under Appointments and switch on one neutral meeting type, or add a Q&A pair with your online booking link.
7. Install and test. Paste the script tag into your site's template, add your domain under Allowed domains, and open Test the agent. Test chats are free and stay out of analytics, but bookings run for real.

Rerun the seven test questions whenever you add a knowledge source or change the instructions.

How does a chatbot differ for dental, physio, med spa and therapy practices?

The rules hold everywhere; what changes is the question mix and how much a booking reveals.

Dental practices

Dental websites get the most insurance, price and emergency questions: a broken tooth, a lost crown, swelling. Publish an emergency page that says what counts as urgent and which number to call out of hours, and let the chatbot quote it without judging a case. Where HIPAA does not apply, a new patient exam is the natural first booking type; a US office that bills insurers electronically, with no BAA from its chat vendor, links to its own scheduler instead.

Physiotherapy and chiropractic clinics

Physio visitors ask about referrals, what to wear, session length and accident or work-injury claims; how many sessions someone needs is a clinical question. Because the ICO's own example of health data is a series of physiotherapy sessions, offer at most one neutral "Initial assessment" type and keep follow-up scheduling with staff.

Med spas and aesthetic clinics

Med spa visitors ask about prices, downtime, consultations and deposits, so publish prices per treatment or per unit. PepoChat's agent will not offer a consultation type that takes payment, so use a free consultation type or a handoff. Suitability questions about pregnancy, medicines or skin conditions are clinical, and a cash-only med spa outside HIPAA may still fall under a state law such as Washington's.

Mental health and therapy practices

Therapy practices need the narrowest chatbot: fees, insurance, telehealth or in person, what a first session is like and how to start. A booking at a therapy practice reveals something about mental health on its own, so keep the chat anonymous, skip booking and lead capture, and link to your intake form. Put a crisis line in the greeting: in the US, the 988 Lifeline takes calls, texts and chats around the clock; elsewhere, give your national crisis line.

What to do next

Start with the 25-question table: mark what your website already answers, write the missing pages, and decide with your privacy officer between information only and information plus booking. Then set the greeting, the "Never do this" block, business hours and a 30-day retention period, and run the test questions.

You can create a free PepoChat workspace and test all of it before a patient sees it; every feature except new-lead emails to the team is on the free plan, with 200 AI replies a month, and the pricing page lists the paid plans. PepoChat's use cases cover other businesses that book appointments.