Every vendor pitching your practice an AI scribe or a diagnostic assist tool right now is going to tell you their product is “compliant.” Almost none of them will tell you what that actually means for your architecture. And that’s the question you need answered before you sign anything, not after.

The industry conversation right now, the one eWeek and others have been having about private AI in the enterprise, boils down to a simple choice with a not-so-simple answer. Do you need a model running inside your own walls, on hardware you control, or can a well-configured cloud deployment meet your obligations under HIPAA? The honest answer is it depends on what data touches the model and how, not on whether the word “private” appears in the vendor’s marketing.

This matters more for a medical, dental, or veterinary practice than almost any other kind of small business. You’re not just protecting customer data. You’re protecting PHI, and the penalties for getting it wrong aren’t hypothetical.

Private AI doesn’t mean what most vendors imply

“Private AI” gets used loosely. Some vendors mean the model runs on servers physically inside your building. Others mean a dedicated cloud instance that no other customer touches. Others mean nothing more than “we have a BAA,” which is a legal agreement, not an architecture.

Here’s the distinction that actually matters for your practice:

True on-premise deployment means the model, the data, and the inference all happen on hardware you own or lease, inside your network. Nothing leaves the building. This is the highest-control option and also the most expensive to buy, maintain, and update. For a single-location practice under $5M in revenue, this is usually overkill.

Private cloud or dedicated instance means your data lives in a segregated environment within a larger cloud provider’s infrastructure, governed by a Business Associate Agreement, with no training on your data and no sharing across tenants. This is where most well-run healthcare AI vendors actually operate, and for most practices in the $1M to $25M range, it’s the right balance of compliance and cost.

Shared multi-tenant cloud means your data might be processed alongside other customers’ data on shared infrastructure, sometimes without a BAA at all if you didn’t ask. This is the category that gets practices in trouble, usually because nobody asked the question at contract time.

None of this is about which option is “better” in the abstract. It’s about matching the deployment model to what the tool actually touches. A scheduling agent that only sees appointment times and phone numbers has a very different risk profile than a scribe tool listening to a full clinical encounter.

The questions to ask your IT vendor before you sign

This is the part most practices skip, and it’s the part that actually protects you. Before any AI scribe, diagnostic tool, or voice agent goes anywhere near patient data, get direct answers to these:

Does the vendor sign a BAA, and does that BAA cover the specific tool you’re buying, not just the parent company. Where is data processed, and does “processed” mean stored, or does it mean the model was trained on it. Is your data used to train or improve the vendor’s model for other customers, or is it walled off. What happens to voice recordings, transcripts, or chat logs after the interaction ends, and for how long. Can you get a written data flow diagram, not a marketing sentence, showing exactly what touches PHI and what doesn’t.

If a vendor can’t answer these in plain language within one conversation, that’s information too. Most legitimate healthcare AI companies have this documentation ready because they get asked constantly. The ones who get vague or redirect to a sales deck are telling you something.

This is exactly the kind of question set we walk practices through as part of an Omni Audit, and it’s worth doing before you evaluate any specific tool, not after you’ve already picked a favorite.

Where this actually shows up in your practice

Compliance architecture matters, but it’s not the only reason practices are looking at AI right now. The real driver is usually simpler: the front desk is drowning, and everyone knows it.

Most practices in this size range are running the phone lines through one or two people who also check patients in, handle billing questions, and manage the schedule. When the phone rings during a busy check-in, it goes to voicemail or it just rings out. Industry ranges we see put abandoned appointment-booking calls at 10% to 20% for practices without dedicated overflow coverage. Every one of those is a patient who might call a competitor instead.

Then there’s the empty chair problem. A no-show or late cancellation on a full schedule doesn’t just lose that one appointment, it usually can’t be backfilled same-day because nobody’s watching the waitlist in real time. Depending on the type of visit, that’s $200 to $1,500 in lost production per missed slot, and it happens multiple times a week even in well-run practices.

And recall lists quietly rot. A patient misses one cleaning or one follow-up, gets a single reminder call that doesn’t land, and drifts off the schedule for a year or longer. Reactivating a list of 100 dormant patients is worth more to most practices than any new-patient marketing spend, but almost nobody has the staff time to work that list consistently by hand.

None of these three problems require a diagnostic AI model or anything touching clinical judgment. They’re operational, and that’s exactly why they’re the right place to start with AI, regardless of which deployment model you eventually choose for clinical tools.

What this looks like end to end

We build these as specific agents with a defined job, not a general-purpose chatbot bolted onto your phone system.

The Front Desk Voice Agent answers the phone, books, reschedules, and confirms appointments, and handles the twenty or so routine questions every practice gets on repeat, things like hours, insurance accepted, prep instructions, and directions. Anything clinical or anything the agent isn’t confident about gets routed straight to a human, with full context so your staff isn’t starting cold. It runs on a deployment model matched to what it actually touches, which for most practices is scheduling data and call metadata, not clinical detail, which keeps the compliance footprint manageable.

The No-Show Agent watches your schedule for appointments that carry a higher risk of no-show based on patient history and timing, and runs a smarter reminder sequence for those specifically instead of treating every appointment the same. When a cancellation does come in, it works your waitlist automatically, texting or calling the next eligible patient rather than leaving that slot open until someone on staff notices.

The Recall and Reactivation Agent does the work nobody has time for. It watches who’s overdue for a cleaning, a follow-up, or an annual exam, reaches out through whatever channel that patient responds to, and rebooks them without a staff member touching a spreadsheet. Over a full year, this is usually where practices find the single biggest recovered-revenue number, because dormant patients are already sold on your practice. They just need a reason and a reminder.

All three run inside a deployment architecture we scope specifically to your practice’s compliance requirements, patient volume, and existing systems, not a one-size answer. If you’re also evaluating a clinical scribe or diagnostic tool separately, the same questions about data flow and BAA coverage apply there too, and we’re happy to be a second set of eyes on that conversation even if we’re not the ones building it.

The dollar reality for a practice your size

That range isn’t a worst-case scenario. It’s the typical spread for a single-location or small multi-location practice running a normal mix of patient volume and staffing. The variance mostly comes down to how much of the phone and recall workload already has some automation versus none at all.

If you want to see where your own practice sits inside that range, the Front Desk Automation Map for Clinics is a practical worksheet for walking through your call volume, no-show rate, and recall backlog and putting real numbers against each one. It’s built to be filled out in about twenty minutes, and most owners are surprised by which line item turns out to be the biggest.

Why an audit before an agent

Buying an AI tool before you understand your own data flow and your own leakage points is how practices end up with software that doesn’t get used, or worse, a compliance gap nobody noticed until an audit. That’s the whole reason the Omni Audit exists as a separate first step rather than a sales call dressed up as a diagnostic.

It runs 60 minutes, on a call, no slide deck. We walk through your current phone and scheduling setup, your recall process, and any AI tools you’re already considering, including the compliance questions above if you’re looking at scribes or clinical tools. You walk away with three things: a clear picture of where your leakage actually sits inside that $70K to $220K range, a short list of what to automate first based on effort versus payoff, and a straight answer on whether private, dedicated, or standard cloud deployment fits what you’re trying to do.

You can read more about how this applies specifically to clinical practices on the AI audit for medical and dental practices page, or browse the broader Omni platform if you want to see how the voice, ops, and advisory pieces fit together before you talk to us. The voice agent and ops automation pages go deeper on how the front desk and recall agents are actually built, if you want the technical detail before the call.

If you’re ready to get real numbers instead of estimates, Book a 60-min Omni Audit and bring whatever AI tools you’re currently evaluating. We’ll look at them alongside your operational numbers, not in isolation.

Don’t let the compliance question stall the easy wins

Here’s the trap we see most often. A practice gets nervous about HIPAA and AI, which is reasonable, and that nervousness stops them from automating anything, including the parts that were never a compliance question in the first place. Scheduling, reminders, and recall outreach carry a much lighter data footprint than a clinical scribe, and they’re where most of the dollar leakage actually lives.

Get the deployment-model question right for anything touching clinical data, absolutely. Ask your IT vendor the direct questions, get it in writing, and don’t sign until you understand exactly what happens to that data. But don’t let that caution delay fixing the phone bottleneck, the empty operatories, and the recall list that’s been sitting untouched since last spring.

For more on how practices in your size range are thinking about this, our resources hub has ongoing coverage of what’s actually working versus what’s just noise in healthcare AI right now, and the broader guides section walks through deployment decisions in more depth if you want to keep researching before you talk to anyone.

When you’re ready to put real numbers against your own practice, Book my Omni Audit and we’ll spend the 60 minutes on your data, not a generic pitch. Or start with See Omni for medical and dental practices if you’d rather browse first and talk later.