What US clinics must do when an AI agent answers the phone.

We found no final federal rule requiring a clinic to tell a caller they are speaking with an AI, though a 2024 FCC proposal's status is unresolved; Utah, Texas, California and Maine have duties that can reach a clinic, and Colorado's starts in 2027. The FCC treats an AI voice as a recorded voice, so reminder and recall calls follow the consent rules. Eight states need every party's consent to record a call, and each state's page says how that consent is given. Where a clinic is a HIPAA covered entity, an AI vendor that handles protected health information on its behalf is a business associate.

Request a tailored demo Find your state

What to do

01Open every call with a recording notice and the reason, then read your state's page for whether its law needs more than that.
02Say the caller is speaking with the practice's AI agent where a state requires it (Utah, Texas, Maine, California's clinical communications) and wherever the practice chooses to.
03Keep the AI vendor under a business associate agreement, and keep reminder calls and texts inside the healthcare conditions: the patient's own number, one a day, three a week, opt-out honoured at once.

The rules that apply everywhere in United States

This is a guide for clinic owners, not legal advice. Every line points to the law or the regulator's own page, checked on 2026-10-21. Where we could not confirm something, the page says so.

Can the agent record the call, and what must the caller be told?

Partly

Federal law lets a party to a call record it, so the state rule decides. Eight states need every party's consent for a business call; Illinois and Massachusetts reach only secret recordings; Delaware, Michigan and Nevada are contested or unverified; Oregon is not all-party for a call. How consent is given differs by state, and only some states' sources say an opening notice is enough. Each state page gives its statute and its consent route.

Must the caller be told they are speaking with an AI?

Not confirmed

We found no final federal rule requiring a business to tell a caller they are speaking with an AI, but the status is unresolved. The FCC proposed one in 2024 for AI-generated calls; the Federal Register through 2026-10-20 shows no final rule on that docket, and a reported 2026-09-30 FCC vote could not be confirmed or ruled out from primary sources. Some states have their own duties; see Utah, Texas, California, Maine and Colorado.

Federal Register: FCC notice of proposed rulemaking on AI-generated calls (FCC 24-84, docket 23-362) (2024-09-10)

Which health privacy law applies, and where does the AI vendor sit?

Yes

Where a clinic is a HIPAA covered entity, a vendor that creates, receives, maintains or transmits protected health information on its behalf is a business associate and needs an agreement. HHS guidance treats a cloud provider that holds encrypted health information for a covered entity as a business associate even without the key. Patient details an AI agent takes on a call can be protected health information; whether they are, and whether the clinic is covered, are conditions the clinic has to check.

eCFR: 45 CFR 160.103, definition of business associate (current to 2026-10-16)“creates, receives, maintains, or transmits protected health information”
US Department of Health and Human Services: Guidance on HIPAA and Cloud Computing (content last reviewed 2022-12-23; read from a 2025-12-31 archive copy)“a CSP that maintains encrypted ePHI ... is a business associate, even if it does not hold a decryption key and therefore cannot view the information.”

What applies to reminder, recall and follow-up calls and texts?

Yes

The FCC has ruled that an AI-generated voice is an artificial voice under the Telephone Consumer Protection Act, so AI reminder and recall calls follow the consent rules for recorded calls. Healthcare messages have their own gate and eight conditions: the call must not be charged to the called person or counted against their plan limits; it is sent only to the number the patient gave, states the provider's name and contact details, serves one of the purposes the rule lists (wellness checkups is one; the list is specific), carries no marketing or billing content and complies with HIPAA, is generally a minute or 160 characters or less, is limited to one a day and three a week, and opt-out requests are honoured immediately.

Federal Communications Commission: Declaratory Ruling FCC 24-17 (AI-generated voices under the TCPA) (adopted 2024-02-02, released 2024-02-08)“TCPA's restrictions on the use of 'artificial or prerecorded voice' encompass current AI technologies that generate human voices.”
eCFR: 47 CFR 64.1200(a)(9)(iv), healthcare message conditions (current to 2026-10-16)“sent only to the wireless telephone number provided by the patient”
eCFR: 47 CFR 64.1200(a)(9)(iv), healthcare message conditions (current to 2026-10-16)“only one message ... per day ... up to a maximum of three ... per week”

Has the dental regulator said anything?

The American Dental Association's AI standards (1106 and 1109) cover clinical image analysis and diagnostics, not AI agents on the phone. No ADA statement on AI agents answering the phone was found.

American Dental Association: Artificial and augmented intelligence standards (ADA 1106 and 1109)

Has the medical regulator said anything?

Partly

The Federation of State Medical Boards adopted a statement in April 2024 that the physician is ultimately responsible for the use of AI and accountable for any harms. It is guidance to state boards, not a rule.

Federation of State Medical Boards: Navigating the Responsible and Ethical Incorporation of Artificial Intelligence into Clinical Practice (adopted by the FSMB House of Delegates, April 2024; read from a copy hosted by the New York State Education Department)“the physician is ultimately responsible for the use of AI and should be held accountable for any harms that occur.”

Accessibility and language duties on the phone line

Yes

The ADA requires a public accommodation to provide effective real-time communication, including text telephones and FCC-approved relay systems. A clinic phone line answered by an AI agent must still work for a relay caller.

eCFR: 28 CFR 36.303(d)(1), effective communication (current to 2026-10-16)“effective real-time communication ... including text telephones (TTYs) and all forms of FCC-approved telecommunications relay systems, including Internet-based relay systems.”

By state

Each state has its own page with the law, the sections and what we could not confirm.

State	Recording notice	AI disclosure	Health privacy law	Dental regulator statement
Alabama	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Alaska	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Arizona	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Arkansas	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
California	Yes	Partly	Confidentiality of Medical Information Actclinic is the provider of health care	No
Colorado	Partly	Partly	Colorado Privacy Act (exempts HIPAA data only)clinic is the covered entity	No
Connecticut	Yes	No	Connecticut privacy law, sections 42-515 to 42-525 (exempts HIPAA covered entities)clinic is the covered entity	No
Delaware	Not confirmed	No	Delaware Personal Data Privacy Act (exempts HIPAA data only)clinic is the covered entity	No
District of Columbia	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Florida	Yes	No	Florida Digital Bill of Rights (exempts HIPAA covered entities)clinic is the covered entity	No
Georgia	Partly	Not confirmed	HIPAA (federal) onlyclinic is the covered entity	No
Hawaii	Partly	Not confirmed	HIPAA (federal) onlyclinic is the covered entity	No
Idaho	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Illinois	Yes	No	Biometric Information Privacy Act (740 ILCS 14)clinic is the covered entity	No
Indiana	Partly	No	Indiana Consumer Data Protection Act (exempts HIPAA covered entities)clinic is the covered entity	No
Iowa	Partly	No	Iowa Code chapter 715D (exempts HIPAA-regulated persons)clinic is the covered entity	No
Kansas	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Kentucky	Partly	No	Kentucky consumer data privacy act, HB 15 of 2024 (exempts HIPAA covered entities)clinic is the covered entity	No
Louisiana	Partly	Partly	HIPAA (federal) onlyclinic is the covered entity	No
Maine	Partly	Yes	HIPAA (federal) onlyclinic is the covered entity	No
Maryland	Yes	No	Maryland Online Data Privacy Act (exempts HIPAA data only)clinic is the covered entity	No
Massachusetts	Yes	No	HIPAA (federal) onlyclinic is the covered entity	No
Michigan	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Minnesota	Partly	No	Minnesota Statutes 325M.10 to 325M.21 (exempts HIPAA data only)clinic is the covered entity	No
Mississippi	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Missouri	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Montana	Yes	No	Montana Consumer Data Privacy Act (exempts HIPAA covered entities)clinic is the covered entity	No
Nebraska	Partly	No	Nebraska Data Privacy Act (exempts HIPAA data only)clinic is the covered entity	No
Nevada	Not confirmed	No	Nevada consumer health data law, NRS 603A.400 to 603A.550 (exempts HIPAA-regulated persons)clinic is the covered entity	No
New Hampshire	Yes	No	New Hampshire RSA 507-H (exempts HIPAA covered entities)clinic is the covered entity	No
New Jersey	Partly	No	New Jersey data privacy law, P.L. 2023, c. 266 (exempts HIPAA data only)clinic is the covered entity	No
New Mexico	Not confirmed	No	HIPAA (federal) onlyclinic is the covered entity	Not confirmed
New York	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
North Carolina	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
North Dakota	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Ohio	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Oklahoma	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Oregon	Partly	No	Oregon Consumer Privacy Act (exempts HIPAA data only)clinic is the covered entity	Not confirmed
Pennsylvania	Yes	No	HIPAA (federal) onlyclinic is the covered entity	No
Rhode Island	Partly	Partly	Rhode Island Data Transparency and Privacy Protection Act (exempts HIPAA covered entities)clinic is the covered entity	No
South Carolina	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
South Dakota	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Tennessee	Partly	No	Tennessee Information Protection Act (exempts HIPAA covered entities)clinic is the covered entity	No
Texas	Partly	Yes	Texas Health and Safety Code chapter 181 and the Texas Data Privacy and Security Actclinic is the covered entity	No
Utah	Partly	Yes	Utah Consumer Privacy Act (exempts covered entities and business associates)clinic is the covered entity	No
Vermont	Not confirmed	No	HIPAA (federal) onlyclinic is the covered entity	No
Virginia	Partly	No	Virginia Consumer Data Protection Act (exempts HIPAA covered entities)clinic is the covered entity	No
Washington	Yes	No	My Health My Data Act (exempts HIPAA covered entities and business associates)clinic is the covered entity	No
West Virginia	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Wisconsin	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Wyoming	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No

What we could not confirm

Whether the FCC's 2024 AI-disclosure proposal has been adopted; a 2026-09-30 vote was reported by a secondary source and could not be confirmed from the FCC's own pages.
The FTC's impersonation rule (16 CFR Part 461) covers posing as a government or business; whether it reaches an AI agent posing as a clinician was not supported by the rule text, and whether a later individual-impersonation rule was finalized was not checked.
The contents of ADA standard 1109 are paywalled and were not read; its titles come from the ADA's public page.

See how Aida says it, on your line.

Aida opens every call with the recording notice your province or state needs, and says it is the practice's AI agent wherever you want it to. Request a demo with your clinic's rules in mind.

Notice

in the opening line

Approved

answers only

Staff

keeps control

Request a tailored demo Review Aida

What US clinics must do when an AI agent answers the phone.

The rules that apply everywhere in United States

This is a guide for clinic owners, not legal advice. Every line points to the law or the regulator's own page, checked on 2026-10-21. Where we could not confirm something, the page says so.

Can the agent record the call, and what must the caller be told?

Partly

Must the caller be told they are speaking with an AI?

Not confirmed

Federal Register: FCC notice of proposed rulemaking on AI-generated calls (FCC 24-84, docket 23-362) (2024-09-10)

Which health privacy law applies, and where does the AI vendor sit?

Yes

eCFR: 45 CFR 160.103, definition of business associate (current to 2026-10-16)“creates, receives, maintains, or transmits protected health information”
US Department of Health and Human Services: Guidance on HIPAA and Cloud Computing (content last reviewed 2022-12-23; read from a 2025-12-31 archive copy)“a CSP that maintains encrypted ePHI ... is a business associate, even if it does not hold a decryption key and therefore cannot view the information.”

What applies to reminder, recall and follow-up calls and texts?

Yes

Federal Communications Commission: Declaratory Ruling FCC 24-17 (AI-generated voices under the TCPA) (adopted 2024-02-02, released 2024-02-08)“TCPA's restrictions on the use of 'artificial or prerecorded voice' encompass current AI technologies that generate human voices.”
eCFR: 47 CFR 64.1200(a)(9)(iv), healthcare message conditions (current to 2026-10-16)“sent only to the wireless telephone number provided by the patient”
eCFR: 47 CFR 64.1200(a)(9)(iv), healthcare message conditions (current to 2026-10-16)“only one message ... per day ... up to a maximum of three ... per week”

Has the dental regulator said anything?

The American Dental Association's AI standards (1106 and 1109) cover clinical image analysis and diagnostics, not AI agents on the phone. No ADA statement on AI agents answering the phone was found.

American Dental Association: Artificial and augmented intelligence standards (ADA 1106 and 1109)

Has the medical regulator said anything?

Partly

Federation of State Medical Boards: Navigating the Responsible and Ethical Incorporation of Artificial Intelligence into Clinical Practice (adopted by the FSMB House of Delegates, April 2024; read from a copy hosted by the New York State Education Department)“the physician is ultimately responsible for the use of AI and should be held accountable for any harms that occur.”

Accessibility and language duties on the phone line

Yes

eCFR: 28 CFR 36.303(d)(1), effective communication (current to 2026-10-16)“effective real-time communication ... including text telephones (TTYs) and all forms of FCC-approved telecommunications relay systems, including Internet-based relay systems.”

By state

Each state has its own page with the law, the sections and what we could not confirm.

State	Recording notice	AI disclosure	Health privacy law	Dental regulator statement
Alabama	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Alaska	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Arizona	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Arkansas	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
California	Yes	Partly	Confidentiality of Medical Information Actclinic is the provider of health care	No
Colorado	Partly	Partly	Colorado Privacy Act (exempts HIPAA data only)clinic is the covered entity	No
Connecticut	Yes	No	Connecticut privacy law, sections 42-515 to 42-525 (exempts HIPAA covered entities)clinic is the covered entity	No
Delaware	Not confirmed	No	Delaware Personal Data Privacy Act (exempts HIPAA data only)clinic is the covered entity	No
District of Columbia	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Florida	Yes	No	Florida Digital Bill of Rights (exempts HIPAA covered entities)clinic is the covered entity	No
Georgia	Partly	Not confirmed	HIPAA (federal) onlyclinic is the covered entity	No
Hawaii	Partly	Not confirmed	HIPAA (federal) onlyclinic is the covered entity	No
Idaho	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Illinois	Yes	No	Biometric Information Privacy Act (740 ILCS 14)clinic is the covered entity	No
Indiana	Partly	No	Indiana Consumer Data Protection Act (exempts HIPAA covered entities)clinic is the covered entity	No
Iowa	Partly	No	Iowa Code chapter 715D (exempts HIPAA-regulated persons)clinic is the covered entity	No
Kansas	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Kentucky	Partly	No	Kentucky consumer data privacy act, HB 15 of 2024 (exempts HIPAA covered entities)clinic is the covered entity	No
Louisiana	Partly	Partly	HIPAA (federal) onlyclinic is the covered entity	No
Maine	Partly	Yes	HIPAA (federal) onlyclinic is the covered entity	No
Maryland	Yes	No	Maryland Online Data Privacy Act (exempts HIPAA data only)clinic is the covered entity	No
Massachusetts	Yes	No	HIPAA (federal) onlyclinic is the covered entity	No
Michigan	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Minnesota	Partly	No	Minnesota Statutes 325M.10 to 325M.21 (exempts HIPAA data only)clinic is the covered entity	No
Mississippi	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Missouri	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Montana	Yes	No	Montana Consumer Data Privacy Act (exempts HIPAA covered entities)clinic is the covered entity	No
Nebraska	Partly	No	Nebraska Data Privacy Act (exempts HIPAA data only)clinic is the covered entity	No
Nevada	Not confirmed	No	Nevada consumer health data law, NRS 603A.400 to 603A.550 (exempts HIPAA-regulated persons)clinic is the covered entity	No
New Hampshire	Yes	No	New Hampshire RSA 507-H (exempts HIPAA covered entities)clinic is the covered entity	No
New Jersey	Partly	No	New Jersey data privacy law, P.L. 2023, c. 266 (exempts HIPAA data only)clinic is the covered entity	No
New Mexico	Not confirmed	No	HIPAA (federal) onlyclinic is the covered entity	Not confirmed
New York	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
North Carolina	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
North Dakota	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Ohio	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Oklahoma	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Oregon	Partly	No	Oregon Consumer Privacy Act (exempts HIPAA data only)clinic is the covered entity	Not confirmed
Pennsylvania	Yes	No	HIPAA (federal) onlyclinic is the covered entity	No
Rhode Island	Partly	Partly	Rhode Island Data Transparency and Privacy Protection Act (exempts HIPAA covered entities)clinic is the covered entity	No
South Carolina	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
South Dakota	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Tennessee	Partly	No	Tennessee Information Protection Act (exempts HIPAA covered entities)clinic is the covered entity	No
Texas	Partly	Yes	Texas Health and Safety Code chapter 181 and the Texas Data Privacy and Security Actclinic is the covered entity	No
Utah	Partly	Yes	Utah Consumer Privacy Act (exempts covered entities and business associates)clinic is the covered entity	No
Vermont	Not confirmed	No	HIPAA (federal) onlyclinic is the covered entity	No
Virginia	Partly	No	Virginia Consumer Data Protection Act (exempts HIPAA covered entities)clinic is the covered entity	No
Washington	Yes	No	My Health My Data Act (exempts HIPAA covered entities and business associates)clinic is the covered entity	No
West Virginia	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Wisconsin	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No
Wyoming	Partly	No	HIPAA (federal) onlyclinic is the covered entity	No

What we could not confirm

Whether the FCC's 2024 AI-disclosure proposal has been adopted; a 2026-09-30 vote was reported by a secondary source and could not be confirmed from the FCC's own pages.

The FTC's impersonation rule (16 CFR Part 461) covers posing as a government or business; whether it reaches an AI agent posing as a clinician was not supported by the rule text, and whether a later individual-impersonation rule was finalized was not checked.

The contents of ADA standard 1109 are paywalled and were not read; its titles come from the ADA's public page.

Inbound

Outbound

Dental and Specialty Clinics

I need more customers

I need less manual work

I need something built

I run a clinic

I run a different kind of business

Explore Aida

Inbound

Outbound

Dental and Specialty Clinics

What do you need?

I run a clinic

I run a different kind of business

Inbound

Outbound

Dental and Specialty Clinics

I need more customers

I need less manual work

I need something built

I run a clinic

I run a different kind of business

Explore Aida

Inbound

Outbound

Dental and Specialty Clinics

What do you need?

I run a clinic

I run a different kind of business

What US clinics must do when an AI agent answers the phone.

The rules that apply everywhere in United States

Can the agent record the call, and what must the caller be told?

Must the caller be told they are speaking with an AI?

Which health privacy law applies, and where does the AI vendor sit?

What applies to reminder, recall and follow-up calls and texts?

Has the dental regulator said anything?

Has the medical regulator said anything?

Accessibility and language duties on the phone line

By state

What we could not confirm

See how Aida says it, on your line.

What US clinics must do when an AI agent answers the phone.

The rules that apply everywhere in United States

Can the agent record the call, and what must the caller be told?

Must the caller be told they are speaking with an AI?

Which health privacy law applies, and where does the AI vendor sit?

What applies to reminder, recall and follow-up calls and texts?

Has the dental regulator said anything?

Has the medical regulator said anything?

Accessibility and language duties on the phone line

By state

What we could not confirm

See how Aida says it, on your line.