Best HIPAA-compliant chatbots in 2026: 9 options that sign a BAA

What makes a chatbot HIPAA compliant?

A HIPAA-compliant chatbot is a chatbot whose vendor will sign a business associate agreement (BAA) and whose product has the safeguards to protect patient data, used by a provider or health plan that configures it correctly. No software is HIPAA compliant on its own. Compliance belongs to your organization; the vendor's job is to make it possible and to accept its share of the obligations in writing.

Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information (PHI) for you is a business associate. HHS explains this in its business associates guidance and its guidance on cloud computing, which says a cloud provider handling ePHI needs a BAA even if it cannot read the data. The HHS sample BAA provisions show what the contract must cover: permitted uses and disclosures, safeguards, and reporting of improper use or breaches.

Check four things before you put a chatbot in front of patients:

• A signed BAA, on the plan you will actually buy. Most vendors offer it only on a top tier or with a paid compliance add-on.
• Coverage of the AI itself. Some BAAs cover the helpdesk but list AI features, early-access programs or marketplace apps separately. Get the covered-services list in writing.
• Safeguards from the HIPAA Security Rule: encryption, role-based access, audit logs, SSO, data retention and redaction controls.
• Clinical boundaries. A support chatbot should never give medical advice. It should answer administrative questions and hand clinical ones to licensed staff.

How do the best HIPAA-compliant chatbots compare?

Checked October 2026. Confirm current prices and BAA scope on each vendor's site and in your contract.

How did we compare these chatbots?

We only included chatbots that can be used with PHI under a BAA, based on what each vendor publishes on its own website or documentation in October 2026. We then compared them on:

• BAA terms: which plan or add-on you need, and whether the AI features sit inside the covered services.
• What the bot can do: answer questions only, or also take actions such as scheduling, refills or account changes.
• Handoff: how cleanly it passes a patient to a person, with context.
• Channels: web chat, SMS, WhatsApp, email and phone.
• Pricing model and published prices. Where a vendor does not publish prices, we say so.
• Build effort: ready-made product versus a developer platform you assemble yourself.

Aftersales is our product and we list it first. Each entry, ours included, has a clear "watch out for", and we say where a healthcare specialist is the better choice.

The 9 best HIPAA-compliant chatbots in 2026

1. Aftersales: best for patient support teams that want an AI agent and a helpdesk under one BAA

Aftersales is an AI customer service platform. Agent resolves conversations end to end, Inbox gives your team one queue for email, web chat, WhatsApp, SMS, phone and social, and Copilot drafts replies for staff that cite their sources. HIPAA support with a signed BAA is available on the Enterprise plan. See our security page for details.

It suits the administrative side of patient support: billing and payment questions, appointment logistics, portal access, order and subscription questions for telehealth and direct-to-patient brands. You describe each procedure in plain language, and escalation rules hand a conversation to a person when they detect certain keywords, negative sentiment or legal language. Agent should never give medical advice, so clinical questions go to licensed staff with the conversation and what Agent already looked up attached.

Be clear about the limits. Aftersales has no native EHR or practice management integration; those systems connect through the Aftersales API or webhooks, so confirm specific connectors on a call. For a large health system whose main problem is phone volume at a central access center, a voice-first specialist like Hyro is the better fit.

Best for

Telehealth, digital health, dental and specialty practices, and health brands that want AI resolution plus a shared helpdesk across email, chat, SMS, WhatsApp and phone

Pricing

BAA on the Enterprise plan (custom pricing; contact sales). Agent $0.99 per resolution, counted once per conversation; conversations Agent can't help with are free. Free and lower plans exist but do not include the BAA.

Strengths

Agent and helpdesk in one product, plain-language procedures, escalation on sentiment, keywords, tier or legal language, 31 languages, GDPR DPA, US hosting, SSO/SCIM on Scale. Median 71% of conversations resolved by Agent after 90 days.

Watch out for

BAA only on the Enterprise plan (custom pricing). No clinical triage or symptom checking. EHR and scheduling systems connect through the API or webhooks rather than native connectors. Using Aftersales does not by itself make you compliant.

2. Hyro: best for health system call centers and patient access

Hyro builds AI agents only for healthcare. Its agents handle patient calls, web chat and SMS for scheduling, provider search, FAQs and prescription requests. Hyro says it works with more than 45 health systems, and it lists integrations with Salesforce Health Cloud and Five9 for contact centers. It describes its agents as HIPAA-compliant and says it redacts PII and PHI.

If most of your volume is phone calls into a central access center, Hyro is a stronger fit than Aftersales. It was built for that problem and for health-system workflows.

Best for

Hospitals and health systems automating patient access calls, scheduling and provider search

Pricing

Not published. Enterprise quote after a demo.

Strengths

Healthcare-only focus, voice first with chat and SMS, contact-center integrations, PHI redaction

Watch out for

Enterprise sales cycle and pricing. Less suited to a small practice or a digital health brand that needs a full email and chat helpdesk.

3. Microsoft healthcare agent service: best for Azure teams building their own triage bot

Microsoft's healthcare agent service (formerly Azure Health Bot) is a cloud service for building healthcare assistants. It includes a built-in triage and symptom checker based on medical protocols, healthcare-adapted safeguards for generative answers, and the option to ground answers in your own documents and websites. Microsoft's documentation describes it as HIPAA-ready, and the Microsoft BAA covers in-scope Azure services.

Best for

Health organizations with Azure developers who want a configurable healthcare bot with triage built in

Pricing

Free (F0) tier for evaluation and development. Agent (C1) tier billed at $0.01 per action; a classic message uses 1 action and a response grounded in your own sources uses 2.

Strengths

Built-in triage and symptom checker, healthcare safeguards for generative AI, pay-as-you-go pricing

Watch out for

It is a building block, not a finished helpdesk. You need developers to build it, connect channels and design human handoff.

4. Orbita: best for a healthcare digital front door across chat and voice

Orbita is an agentic AI platform built for healthcare. It powers chat and voice agents for digital front door, patient access and scheduling, and care navigation, plus automated patient outreach. Its platform page lists HIPAA, SOC, ISO and GDPR, more than 100 languages, and integrations with EMR, CRM and call center systems.

Best for

Providers and life sciences companies that want a healthcare-specific virtual assistant and outreach

Pricing

Not published. Quote-based.

Strengths

Healthcare-specific design, symptom and condition detection, outreach and scheduling, multilingual

Watch out for

Enterprise-oriented. Pair it with a helpdesk for the conversations it hands off.

5. Kore.ai: best for large payers and providers building many AI agents on one platform

Kore.ai is an enterprise agent platform with healthcare solutions for providers and payers: appointment scheduling, reminders, lab and records access, refills and member services. Kore.ai says it operates within HIPAA, SOC 2 Type II, HITRUST and ISO 27001 frameworks, with PHI masking, role-based access and audit trails.

Best for

Large organizations that want chat, voice and contact-center automation built and governed on one platform

Pricing

Not published. Enterprise quote.

Strengths

Broad platform, healthcare accelerators, PHI masking and audit trails, voice and digital channels

Watch out for

Heavier to implement than a ready-made product. Best with an internal team or partner to build and maintain it.

6. Google Conversational Agents (Dialogflow CX): best for teams already on Google Cloud

Google's Conversational Agents comes in two editions: Flows (Dialogflow CX), for deterministic intent-based agents, and Playbooks, for generative agents. Conversational Agents appears on Google Cloud's list of services covered by its HIPAA BAA. Google advises not to put PHI in the agent definition itself, such as intents, training phrases and entities.

Best for

Engineering teams on Google Cloud building a custom patient chatbot or voice bot

Pricing

Chat: $0.007 per request (Flows) or $0.012 per request (Playbooks). Voice: $0.001 or $0.002 per second.

Strengths

Low per-request cost, deterministic and generative options, covered by Google Cloud BAA

Watch out for

You build the agent, the channels, the handoff and the helpdesk around it. You must also configure the Google Cloud project for PHI.

7. Amazon Lex: best for AWS teams building chatbots with Amazon Connect

Amazon Lex is AWS's service for building chat and voice bots. It is listed as a HIPAA-eligible service, so you can use it with PHI once you have a BAA with AWS. It is a common choice for teams that already run phone support on Amazon Connect, which is also HIPAA eligible.

Best for

AWS-based teams that want a low-cost bot engine for chat or IVR

Pricing

Pay per request: $0.00075 per text request and $0.004 per speech request, with separate streaming rates.

Strengths

Very low unit cost, works with Amazon Connect and other AWS services, covered by AWS BAA

Watch out for

Request pricing is only part of the bill; other AWS services cost extra. Developer effort is needed for content, handoff and reporting.

8. Intercom Fin: best for digital health companies already using Intercom

Intercom combines a helpdesk with Fin, its AI agent. HIPAA support is listed on the Expert plan, and Intercom offers a BAA to customers on a plan with HIPAA support. If your digital health product already runs in-app support on Intercom, moving to Expert is simpler than switching tools.

Best for

SaaS-style digital health products with in-app support already on Intercom

Pricing

Expert: $132 per seat/month billed annually. Fin from $0.99 per outcome. SMS, WhatsApp and phone are pay-as-you-go.

Strengths

Mature in-app messenger, Fin AI agent, SSO and custom roles on Expert

Watch out for

The BAA requires Expert for every seat. Confirm in writing which features, including Fin, the BAA covers. Compare it with our Intercom alternative page.

9. Zendesk: best for large support teams already on Zendesk

Zendesk's Advanced Compliance add-on lets accounts on Suite Professional, Enterprise or Enterprise Plus sign a BAA. Covered services include ticketing, help center, live chat and messaging, analytics and Talk (excluding text). Zendesk also lists AI Agents - Advanced and Forethought AI agents among its HIPAA-enabled add-ons. Early access programs and marketplace apps are not covered.

Best for

Established support teams on Zendesk that need to bring PHI into the helpdesk

Pricing

Suite Professional from $115 per agent/month billed annually, plus the Advanced Compliance add-on (price not published). AI agents billed per automated resolution.

Strengths

Deep helpdesk, clear published list of covered services and HIPAA-enabled add-ons

Watch out for

Costs add up across the plan, the compliance add-on and AI. Text (SMS) is excluded from coverage. See Zendesk pricing or the Zendesk alternative comparison.

How much does a HIPAA-compliant chatbot cost?

For a ready-made product, most of the cost is the plan that unlocks the BAA plus the AI usage. Here is an example using list prices.

Example assumptions: a telehealth support team with 3 staff seats, 2,000 patient conversations a month, and AI resolving 50% of them (1,000 resolutions).

• Aftersales Scale: 3 seats at $109 = $327, plus 1,000 Agent resolutions at $0.99 = $990. About $1,317 a month, billed annually.
• Intercom Expert: 3 seats at $132 = $396, plus 1,000 Fin outcomes at a minimum of $0.99 = $990. At least $1,386 a month, billed annually, before any channel fees.
• Zendesk Suite Professional: 3 agents at $115 = $345, plus the Advanced Compliance add-on and AI agent usage, which Zendesk quotes.

Developer platforms such as Amazon Lex or Google Conversational Agents cost much less per message, but you also pay for engineering time, hosting, a helpdesk for handoffs and ongoing maintenance. Healthcare specialists (Hyro, Orbita, Kore.ai) quote on contract. See Aftersales pricing for every plan.

Which HIPAA chatbot is best for your use case?

• AI agent and helpdesk for patient support under one BAA: Aftersales (Enterprise).
• Health system call center and patient access by phone: Hyro.
• Symptom checker and triage you build yourself on Azure: Microsoft healthcare agent service.
• Digital front door and patient outreach: Orbita.
• Many agents across a large payer or provider: Kore.ai.
• Lowest unit cost with your own engineers: Amazon Lex or Google Conversational Agents.
• Already on Intercom or Zendesk: upgrade to the plan or add-on that includes the BAA before you move.

Working in a specific setting? See how AI support works for telehealth, dental practices and pharmacies, or the healthcare overview. More comparisons are on the blog, including the best customer service chatbots.

How do you set up a chatbot safely for PHI?

Signing the BAA is the start. These steps keep a chatbot within the limits you set.

1. Sign the BAA before any PHI enters the tool, including during the trial. Use test data until then.
2. Get the covered-services list. Turn off any channel, AI feature or app that falls outside it.
3. Turn on access controls: SSO, least-privilege roles, audit logs and a data retention period.
4. Write clinical boundaries into the bot. It answers administrative questions and hands symptoms, medication and diagnosis questions to licensed staff.
5. Verify identity before sharing account details, and share only the minimum needed.
6. Review conversations every week for answers that should have been escalated, and update the procedures.

This is general information, not legal advice. Confirm your obligations with your compliance team.

Frequently asked questions