HIPAA-compliant chatbots and virtual assistants that know when to hand off
Digital Scientists builds HIPAA-compliant chatbots and virtual assistants for patients and staff: FAQs, intake, scheduling, call summaries and policy look-ups. On new builds the model runs in your own AWS account through Amazon Bedrock, under your BAA with AWS, and your data trains nothing for anyone else. Every output is logged, a person reviews anything clinical, and the assistant hands off to your staff when it should. We built HealthContext.AI, which cut note time on NeverAlone calls from 45 minutes to 5. Most clients start with a Blueprint scoped to one assistant.
Updated
Note time per call with HealthContext.AI
NeverAlone telehealth calls a year
Patients across six states on NeverAlone
NeverAlone in production and run by us since
Should a healthcare chatbot face patients or staff first?
Staff first, in most cases. A staff-facing assistant works for people trained to check its answer, so the risk is lower and the payback shows up faster. Patient-facing bots come next, starting with questions that need no patient data.
A HIPAA-compliant chatbot is any chat or voice assistant that handles protected health information (PHI) under the safeguards HIPAA requires: a BAA with every vendor that touches the data, access controls, audit logs and limits on what the model sees. The table splits the common use cases by who uses them, whether they need PHI and who checks the result.
Our delivered work is on the staff side so far. Patient-facing assistants are capability we build on the same rules. This page is part of our healthcare AI development work.
Healthcare chatbot use cases: who uses them, what data they need and our status
| Use case | Who uses it | Needs PHI? | Who checks the result | Our status |
|---|---|---|---|---|
| Call and visit summaries | Care staff and providers | Yes | The clinician reviews and approves | Production. HealthContext.AI inside NeverAlone |
| Assessment summaries before a check-in | Coaches and clinicians | Yes | The coach reads it as a quick reference | Delivered. Fathers' UpLift EHR |
| Guidance look-ups on a manual or policy | MDS coordinators and other staff | No, guidance only | The coordinator decides | Prototype built. Ask RAI, on MDS assessment guidance |
| FAQs, directions and visit prep | Patients and families | No | Your team approves the content it answers from | Capability |
| Intake and pre-visit questions | Patients | Yes | Staff review before anything reaches the chart | Capability |
| Scheduling and rescheduling | Patients | Yes | Staff handle exceptions | Capability |
Production: we run it. Delivered: built and handed to the client. Capability: we build it on the same rules, with no client in production yet.
Which AI models can touch patient data?
Only a model covered by a BAA, running where you control the data. On new builds, that means Amazon Bedrock inside your own AWS account, with Claude where we use a language model, covered by your BAA with AWS.
The model is rarely the compliance problem. Where the data goes, who keeps it and who logs it are. These are the rules every assistant we build follows, on top of our security plan mapped to NIST CSF 2.0. See security and PHI.
A BAA, or no PHI
Any service that sees patient data is covered by a BAA. If it isn't, the assistant doesn't send it PHI. We sign a BAA with every covered entity first.
Your AWS account
On new builds, models run through Amazon Bedrock in your own account. Prompts, answers and transcripts stay in your environment.
Your data trains nothing else
Bedrock doesn't use your prompts or outputs to train its foundation models. Anything we tune on your data is yours and runs only for you.
Every output logged
What the assistant saw, what it answered, the source it used, the model version and what happened next. On every build. That's your audit trail.
Only the fields it needs
A scheduling bot gets open slots and a name, not the chart. Less data in the prompt means less to protect.
No consumer tools
Staff don't paste PHI into a consumer chatbot to get the job done. The assistant we build is the approved place to do it.
What happens when a chatbot gets a question it shouldn't answer?
It hands the conversation to a person, with the context attached. A healthcare chatbot answers what it was approved to answer and routes the rest: anything clinical, anything urgent and anything it isn't sure of.
The handoff is the most important feature, so we design it first. Decide who picks up, during which hours, through which channel and how fast. Then build the bot around that. NeverAlone is the model we know best: a licensed provider answers by video around the clock, so there's always a person behind the screen.
A person reviews anything clinical
The assistant doesn't diagnose, change a medication or give advice outside the content your clinicians approved. Clinical questions go to clinical staff.
Urgent words stop the script
Chest pain, a fall, thoughts of self-harm: the assistant tells the patient to call 911 or 988 and alerts your staff. It doesn't try to triage.
Handoff with context
Staff see the conversation so far, so the patient doesn't start over.
Answers from approved sources
Patient answers come from content your team signed off on, cited back to that source, not from the model's general knowledge.
Tested on real questions
Before launch we run the assistant against questions your staff actually get, including the ones it should refuse.
Watched after launch
We review logged conversations, handoff rates and wrong answers, and fix the cause before the next release.
Have you built AI assistants that work with patient data?
Yes, on the staff side. We built HealthContext.AI, which summarizes NeverAlone telehealth calls, and the AI assessment summaries inside the EHR we built for Fathers' UpLift. Both put AI in front of people who already review the work.
HealthContext.AI captures NeverAlone call audio, transcribes it with OpenAI Whisper, pulls out diagnoses and medications with AWS Comprehend Medical, and drafts a note and call summary with GPT-4 for the provider to review. Note time dropped from 45 minutes to 5. See ambient scribes.
For Fathers' UpLift, the custom EHR compares a client's assessments over time and summarizes what changed, so a coach has a quick reference before each check-in. We also built Ask RAI, a chat assistant that answers MDS coordinators' questions on assessment guidance. On every new build, the model runs in your own AWS account under your BAA.
Note time per call with HealthContext.AI
NeverAlone calls a year
Where NeverAlone runs
Assistants and AI summaries we built
HealthContext.AI
Note time from 45 minutes to 5
Call transcription and summaries we built and run inside NeverAlone, drafted for the provider to review and approve.
See the work
Fathers' UpLift
AI assessment summaries in the EHR
A custom EHR where AI compares a client's assessments over time and summarizes the changes for coaches before each check-in.
See the work
NeverAlone · CommuniCare
100,000+ calls a year
The 24/7 virtual care platform where a licensed provider answers every call: the human handoff any patient-facing assistant needs. 30,000 patients across six states.
See the workTrusted by healthcare leaders.
“Thank you to the Digital Scientists team, this has been a long time coming! We finally have something that will be useful for our team so I want to take this opportunity to thank you for your hard work and your diligence. You took an idea and made it come to life!”
Dr. Charles Clayton Daniels Jr.
CEO & Founder, Fathers' UpLift
“I have worked with many technology teams during my career, and Digital Scientists is one of the best. They take the time to understand the customers' needs, deliver innovative solutions, are always professional, and work with your team as a true partner to achieve success.”
Amy Severino
Chief Innovation Officer, NeverAlone
Where should a healthcare chatbot project start?
With one assistant, one audience and one handoff. Pick the questions that eat the most staff time, name who picks up when the bot can't answer, and measure the baseline before you build.
Most clients start with a Blueprint: we map the questions, the systems the assistant needs, the handoff and the rules for PHI, then put a clickable prototype in front of the people who'll use it. Teams that already have that work done start building straight away, one assistant at a time, measured against the baseline we set before the build. We run what we build, or hand it to your team on a build-operate-transfer plan.
Voice usually comes after text. Phone audio adds a telephony provider, consent rules and noisier input, so we scope it per project. See contact center and telephony.
Common starting points for a healthcare chatbot
| Starting point | Why start here | What we need from you |
|---|---|---|
| Staff assistant on your policies or manuals | Trained users check every answer, and no PHI is needed | The documents it answers from and a staff owner |
| Patient FAQs and visit prep | High volume, low risk, no PHI | Approved answers and the questions your front desk gets most |
| Summaries for care staff | Saves clinician time on work they already review | Sample calls or records under a BAA, and a reviewer |
| Scheduling and intake | Takes phone and portal load off staff | API access to your scheduling system or EHR, and rules for exceptions |
Common patterns, not rules. See ways to start.
Related healthcare AI work
Healthcare AI development
AI on your data, inside your cloud, with review built in.
Healthcare AI development →Ambient scribes
Notes and call summaries drafted for clinician review.
Ambient scribes →AI agents
Agents that take routine back-office work off your staff.
AI agents →Scheduling
Scheduling automation with staff handling the exceptions.
Scheduling →Contact center and telephony
Where voice assistants meet your phone system.
Contact center and telephony →Healthcare security and PHI
BAAs, a security plan mapped to NIST CSF 2.0 and per-client addenda.
Healthcare security and PHI →Latest thinking on AI and patient data
Questions about HIPAA-compliant chatbots
Is ChatGPT HIPAA compliant?
Consumer ChatGPT is not: OpenAI doesn't sign a BAA for it, so PHI shouldn't go into it. OpenAI's published terms say it offers BAAs for certain API and enterprise arrangements. Whether one covers you depends on the product, the plan and what you sign, so confirm OpenAI's current terms and your plan before any PHI touches it. A BAA alone doesn't make a chatbot compliant; access controls, logging and data retention matter too. On new builds, Digital Scientists runs models in your own AWS account through Amazon Bedrock, under your BAA with AWS.
Can a chatbot schedule appointments?
Yes, when your scheduling system or EHR has an API the assistant can use. It reads open slots, books or moves the appointment, confirms with the patient and logs what it did. Anything outside the rules, such as a new-patient visit that needs triage or a slot that needs approval, goes to your staff. We confirm API access early, before the build. See scheduling.
Should a healthcare assistant use voice or text?
Start with text in most cases. It's cheaper to build, easier to test and every exchange is already written down for the log. Voice fits when your patients call rather than type, but it adds a telephony provider, consent and recording rules, and noisier input, so we scope it per project and test on a sample of your real calls first. The same rules apply to both: a BAA, your AWS account, every output logged and a handoff to a person.
Does patient data train the model?
No. Your data trains nothing for anyone else. On new builds the model runs through Amazon Bedrock in your own AWS account, and Bedrock doesn't use your prompts or outputs to train its foundation models. If we tune a model on your data, that model is yours and runs only in your environment.
What happens when the chatbot doesn't know the answer?
It says so and hands off to a person, with the conversation attached. Patient answers come only from content your team approved, so a question outside that content goes to staff instead of getting a guess. Clinical and urgent questions always go to a person. We log every handoff and review them, because they show what the assistant should learn to answer next and what it should never try.
Talk it over
Tell us what you are trying to do. A senior person from our Atlanta team replies within one business day, and you can book a 30-minute call right after you send this.
- We tell you if we're the right fit, and if we're not, who is.
- Most work starts small, so you see how we work before you commit to more.
- We sign a BAA before we touch patient data.