AI Receptionist Privacy and HIPAA: What Service Trades Actually Need to Know
HHS says HIPAA applies to covered entities and their business associates, and most trade businesses are neither. Here is what does apply when an AI answers your phones, with links to each statute and regulator page.
HIPAA almost certainly does not apply to your locksmith, plumbing, HVAC or towing business. The U.S. Department of Health and Human Services says the HIPAA Rules apply to health plans, health care clearinghouses, certain health care providers and the business associates that handle health information for them, and a trade business is usually none of those. What does apply when an AI answers your phone is more ordinary: call-recording consent laws, the FTC's expectations for customer data, breach-notification laws, card-security rules and, for outbound calls, the TCPA. This guide covers each one with a link to the statute or regulator; it is not legal advice, so check your state and talk to a lawyer about your own situation.
Key takeaways
- HHS is direct: "If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules" (HHS).
- HHS even names an electrician as an example of a contractor that needs no business associate agreement when its access to patient information would be only incidental (HHS).
- The rule most likely to apply to your AI receptionist is recording consent. Federal law allows one-party consent, but states such as Washington and Florida require every party's consent, and Illinois bars recording private conversations surreptitiously without it, so announce the recording at the start of every call.
- The FTC's five principles for customer data fit an AI receptionist well: take stock, scale down, lock it, pitch it and plan ahead (FTC).
- All 50 states have breach-notification laws, according to the National Conference of State Legislatures, so your vendor contract should say how fast you'll hear about a breach.
- Outbound AI calls are different from inbound ones: the FCC confirmed in 2024 that AI-generated voices count as "artificial" voices under the TCPA (FCC 24-17).
Does HIPAA apply to a locksmith, plumber or HVAC company?
Almost never. HIPAA's rules apply to "covered entities" and their "business associates." HHS's page on covered entities and business associates says a covered entity is a health care provider, a health plan or a health care clearinghouse, and that providers such as doctors, clinics, dentists and pharmacies are covered only if they transmit information electronically in connection with a transaction for which HHS has adopted a standard, such as a claim to an insurer. The same page states the other side plainly:
"If an entity does not meet the definition of a covered entity or business associate, it does not have to comply with the HIPAA Rules."
A locksmith, plumber, electrician, HVAC contractor, roofer, towing company, garage door company, pest control firm, pool service or handyman is not a health plan, a clearinghouse or a health care provider. So when a caller mentions a health detail ("my father has dementia and keeps wandering out, can you put a lock up high?"), HIPAA doesn't turn that call into a regulated medical record. That detail is still sensitive, and the FTC principles below are the right way to handle it: write down only what the job needs, and limit who can hear the recording.
Be wary of vendors who sell "HIPAA-compliant" as if every business needed it. For a trade shop, the useful questions are about recording notices, data retention, security and breach notice, which this guide covers below.
When could a trade business become a business associate?
Only when your work for a health care organization involves its patients' protected health information. HHS's business associate guidance defines a business associate, generally, as someone who performs functions or services for a covered entity that involve creating, receiving, maintaining or transmitting that information. Its own examples make the line clear.
Usually not a business associate. HHS says no business associate agreement is required with a person whose services don't involve the use or disclosure of protected health information, "provided that access to PHI by such persons would be only incidental, if at all, and that reasonable safeguards are in place," and it gives "janitorial service, electrician" as examples. Rekeying a clinic, fixing a dental office's water heater or servicing a hospital's rooftop units generally falls on this side of the line.
Possibly a business associate. HHS lists a "technician who services a covered entity's electronic device that stores individuals' PHI (e.g., copier, medical device) where the contracted service involves the disclosure of the PHI to the technician." If a job puts patient records in your hands, as opposed to near you, the facility may ask you to sign a business associate agreement. Read it before you sign, because it can commit you to specific safeguards.
If a clinic asks you to sign one anyway, ask what patient information you'll actually handle. Many requests come from a procurement checklist rather than a real need, but that is their call and their lawyer's, not yours to guess.
What if your AI receptionist takes calls for a medical practice?
Then HIPAA is very much in play, for the practice and for the vendor. HHS's examples of business associates include a "third-party vendor Artificial Intelligence (AI) chatbot on a provider's patient portal that provides services involving the patient's PHI such as symptom assessment, medical reminders, and appointment scheduling," and a cloud service provider that creates, receives, maintains or transmits electronic patient information (HHS). The same page says a business associate must have an agreement with its own subcontractors before disclosing patient information to them, and that those downstream subcontractors are also business associates.
In practice, a medical or dental office that wants an AI receptionist should get a signed business associate agreement from the vendor, and ask which subcontractors (the phone carrier, the speech-recognition service, the AI model provider) handle call audio. TheKeyBot is built for locksmiths, other service trades and car dealerships, and our site pages don't describe HIPAA or business associate agreements, so we're not the right fit for patient calls.
Which privacy rules do apply to an AI receptionist in the trades?
Here is the short list, with where each rule comes from. Your state may add more.
| Rule | When it applies | What to do | Where it comes from |
|---|---|---|---|
| Call-recording consent | Whenever calls are recorded | Announce the recording at the start of every call | 18 U.S.C. § 2511 and state statutes |
| FTC data-security expectations | Whenever you keep customer data | Keep only what you need, protect it, dispose of it | FTC guide for business |
| Breach notification | If personal information is exposed | Have a response plan; require prompt notice from vendors | NCSL summary of state laws |
| Card security (PCI DSS) | If you take card payments | Use payment links; keep card numbers off recordings | PCI Security Standards Council |
| TCPA | If the AI places outbound calls or texts | Get prior express consent; honor opt-outs and calling hours | FCC 24-17, 47 CFR 64.1200 |
| FTC Safeguards Rule | Financial institutions, which can include some dealerships that lease or finance | A written security program | FTC, 16 CFR 314.2 |
| State comprehensive privacy laws | Larger businesses, depending on state thresholds | Check whether you cross the threshold | For example, California's CCPA |
On that last row: California's Attorney General says the CCPA applies to for-profit businesses that do business in California and have gross annual revenue of over $25 million, buy, sell or share the personal information of 100,000 or more California residents or households, or earn 50% or more of their revenue from selling it. Most small trade shops fall below all three, but check your own state's law.
How should an AI receptionist announce call recording?
Recording law is where most trade businesses have real exposure, because AI receptionists usually record. Federal law permits recording where "one of the parties to the communication has given prior consent" (18 U.S.C. § 2511(2)(d)), but several states ask for more:
- Washington requires the consent of all participants to record a private telephone communication, and says consent is obtained when one party announces the recording "in any reasonably effective manner," provided the announcement is itself recorded (RCW 9.73.030).
- Florida makes interception lawful when "all of the parties to the communication have given prior consent" (Fla. Stat. § 934.03).
- Illinois prohibits recording a private conversation "in a surreptitious manner" without "the consent of all other parties" (720 ILCS 5/14-2).
- California's Legislative Counsel, summarizing Penal Code section 632 in a 2016 bill, described it as making it a crime to record a confidential communication "without the consent of all parties to the confidential communication."
Your callers don't always sit in your state, and a caller in one state reaching a shop in another can bring more than one law into play. The practical answer is the same everywhere: say it at the start of every call, in every language you answer in. Something like this works:
"Thanks for calling [your shop name]. This call is recorded, and you're speaking with our automated assistant. How can I help?"
Keep the notice short, put it before any question, and make sure it plays on transferred and after-hours calls too. Rosie's terms, for example, describe vendor-provided template notices so callers can consent by continuing the call. Our call-recording consent guide goes deeper. Again, this is not legal advice; check your state's statute or ask a lawyer.
What should you ask your AI vendor about your callers' data?
The FTC's guide, Protecting Personal Information, boils data security down to five principles. They translate directly into vendor questions:
| FTC principle | What it means for call data | Ask your vendor |
|---|---|---|
| Take stock | Know what personal information you have | What do you record, transcribe and summarize on every call? |
| Scale down | Keep only what you need for your business | Can I set how long recordings and transcripts are kept? |
| Lock it | Protect the information you keep | Who can listen? Is it encrypted? Can I see a SOC 2 report? |
| Pitch it | Properly dispose of what you no longer need | Do you delete everything on request and when I cancel? |
| Plan ahead | Create a plan to respond to security incidents | How fast will you tell me about a breach, in writing? |
Two more questions belong on the list:
- Is my callers' data used to train AI models? In February 2024 the FTC warned that "it may be unfair or deceptive for a company to adopt more permissive data practices," such as using data for AI training, if consumers are told only through a surreptitious, retroactive change to the terms (FTC). Get the answer in the contract.
- Which other companies hear the audio? A phone call to an AI may pass through a phone carrier, a speech-recognition service and an AI model provider. The FTC's guide tells businesses to put security expectations in writing in contracts with service providers and verify compliance.
Our AI receptionist buyer's checklist puts these next to the billing and contract questions, and our guide to call recording and quality review covers how to use the recordings you keep.
What happens if there's a breach?
According to the National Conference of State Legislatures, in a summary updated in January 2022, all 50 states, the District of Columbia, Guam, Puerto Rico and the Virgin Islands have laws requiring private businesses to notify individuals of security breaches involving personal information. The details (what counts as personal information, deadlines, who else must be told) vary by state.
Your customers' data is your responsibility even when it sits on a vendor's servers, so ask for two things in writing: how quickly the vendor will notify you of a security incident, and what help it gives with customer notices. The FTC's guide puts it simply: insist that your service providers notify you of any security incidents they experience.
Do dealerships have extra rules?
Some do. The FTC's Safeguards Rule "applies to financial institutions subject to the FTC's jurisdiction," the FTC lists finance companies among its examples, and the rule's own definitions include "an automobile dealership that, as a usual part of its business, leases automobiles on a nonoperating basis for longer than 90 days" (16 CFR 314.2). The FTC also requires covered institutions to notify the FTC of a security breach involving at least 500 consumers' unencrypted information as soon as possible and no later than 30 days after discovery. A buy-here-pay-here or leasing dealer whose AI receptionist takes payoff or payment calls should ask counsel whether the rule covers it and make sure the vendor fits the dealership's written security program. Our guide to BHPH payoff calls covers what an AI should and shouldn't say on those calls.
What about card payments and outbound calls?
Card payments. If callers read card numbers aloud, those numbers end up in recordings and transcripts. The PCI Security Standards Council's telephone payment guidance says that if the card security code "is received and recorded, the entity MUST render all data unrecoverable upon completion of the authorization process." The simplest fix is a payment link sent by text, so the card never touches the call. Our guide to taking deposits by phone covers the wording.
Outbound calls and texts. Inbound answering and outbound calling sit under different rules. In its February 2024 declaratory ruling, the FCC confirmed that "the TCPA's restrictions on the use of 'artificial or prerecorded voice' encompass current AI technologies that generate human voices," so those calls need the prior express consent of the called party unless an emergency purpose or exemption applies (FCC 24-17). Separately, the FCC's rules bar telephone solicitations to residential subscribers before 8 a.m. or after 9 p.m. at the called party's location (47 CFR 64.1200). If your AI makes follow-up or reminder calls, get consent in writing, honor opt-outs at once and ask a lawyer to review the setup.
What does TheKeyBot record?
Disclosure: TheKeyBot, which publishes this guide, makes an AI receptionist. Our pages say calls are recorded: the Lite page describes a dashboard where you can play back any call and read the full transcript and AI summary, and the AI call handling page lists call recording for quality assurance. That means the recording notice above applies to our customers too. Lite costs $149 a month, answers 24/7 in English and Spanish and sends each message to your phone; Core starts at $500 a month. Ask us, as you would any vendor, for written answers to the data questions in this guide before you sign.
What should you do this week?
- Call your own line and listen for a recording notice in the first few seconds, in every language you answer in.
- List where call data goes: recordings, transcripts, texts, emails, your CRM, your vendor and its subcontractors.
- Set a retention period for recordings and transcripts, and ask your vendor to apply it.
- Send your vendor the data questions in the table above and file the written answers.
- Write a one-page breach plan: who you call, how you reach customers and who checks your state's notice deadline.
- If you work for clinics or hospitals, ask whether they expect a business associate agreement, and read any you're asked to sign.
Frequently Asked Questions
Does HIPAA apply to my AI receptionist if I'm a plumber or locksmith?
Almost certainly not. HHS says HIPAA applies to covered entities (health plans, health care clearinghouses and certain health care providers) and their business associates, and an entity that is neither does not have to comply with the HIPAA Rules.
Do I need a business associate agreement to work at a hospital or clinic?
Usually not. HHS says no agreement is required with contractors such as an electrician whose services don't involve patient information and whose access to it would be only incidental, with reasonable safeguards in place. If the job puts patient records or devices that store them in your hands, the facility may ask for one.
Do I have to tell callers the AI is recording?
In many states, yes, and it's the safe practice everywhere. Federal law allows one-party consent, but states including Washington and Florida require all parties' consent, so put a short recording notice at the start of every call. This is not legal advice; check your state's statute.
What should my AI receptionist vendor do with my customers' data?
Keep only what the job needs, protect it, delete it when you ask or leave, and tell you promptly about any breach. Get those commitments, and whether your data trains AI models, in writing.
Does the TCPA apply to an AI receptionist?
It matters most for outbound calls and texts. The FCC confirmed in 2024 that AI-generated voices count as artificial voices under the TCPA, so outbound AI calls generally need the called party's prior express consent.
Is this legal advice?
No. It's a plain-English summary with links to the statutes and regulator pages behind each point. Check your own state's laws and talk to a lawyer about your situation.
Sources
- U.S. Department of Health and Human Services, "Covered Entities and Business Associates": https://www.hhs.gov/hipaa/for-professionals/covered-entities/index.html
- U.S. Department of Health and Human Services, "Business Associates" (reviewed July 30, 2026): https://www.hhs.gov/hipaa/for-professionals/privacy/guidance/business-associates/index.html
- 18 U.S. Code § 2511, Cornell Legal Information Institute: https://www.law.cornell.edu/uscode/text/18/2511
- Revised Code of Washington 9.73.030: https://app.leg.wa.gov/RCW/default.aspx?cite=9.73.030
- Florida Statutes § 934.03: https://www.flsenate.gov/Laws/Statutes/2025/934.03
- Illinois Compiled Statutes, 720 ILCS 5/14-2: https://www.ilga.gov/Documents/legislation/ilcs/documents/072000050K14-2.htm
- California Legislature, AB 1671 (2015-16), Legislative Counsel's Digest, as amended August 30, 2016: https://www.leginfo.ca.gov/pub/15-16/bill/asm/ab_1651-1700/ab_1671_bill_20160830_amended_sen_v92.htm
- Rosie, terms of service: https://heyrosie.com/legal/terms
- Federal Trade Commission, "Protecting Personal Information: A Guide for Business": https://www.ftc.gov/business-guidance/resources/protecting-personal-information-guide-business
- Federal Trade Commission, "AI (and other) Companies: Quietly Changing Your Terms of Service Could Be Unfair or Deceptive" (February 13, 2024): https://www.ftc.gov/policy/advocacy-research/tech-at-ftc/2024/02/ai-other-companies-quietly-changing-your-terms-service-could-be-unfair-or-deceptive
- Federal Trade Commission, "FTC Safeguards Rule: What Your Business Needs to Know": https://www.ftc.gov/business-guidance/resources/ftc-safeguards-rule-what-your-business-needs-know
- 16 CFR 314.2, Cornell Legal Information Institute: https://www.law.cornell.edu/cfr/text/16/314.2
- National Conference of State Legislatures, "Security Breach Notification Laws": https://www.ncsl.org/technology-and-communication/security-breach-notification-laws
- California Attorney General, "California Consumer Privacy Act (CCPA)": https://oag.ca.gov/privacy/ccpa
- PCI Security Standards Council, "Protecting Telephone-Based Payment Card Data" (November 2018): https://listings.pcisecuritystandards.org/documents/Protecting_Telephone_Based_Payment_Card_Data_v3-0_nov_2018.pdf
- Federal Communications Commission, Declaratory Ruling FCC 24-17 (released February 8, 2024): https://docs.fcc.gov/public/attachments/FCC-24-17A1.pdf
- 47 CFR 64.1200, Cornell Legal Information Institute: https://www.law.cornell.edu/cfr/text/47/64.1200
- TheKeyBot, KeyBot Lite: https://www.thekeybot.com/lite
- TheKeyBot, AI Call Handling: https://www.thekeybot.com/features/ai-call-handling
About the Author
TheKeyBot Team is dedicated to helping locksmiths grow their businesses through AI automation and smart technology. With years of experience in the locksmith industry, our team provides actionable insights and proven strategies.
