AI for healthcare practices: cost, HIPAA, and what is actually allowed.

Healthcare is the highest-value place to put an AI assistant and the easiest place to do it wrong. The cost question and the compliance question are the same question, because the compliance architecture is most of what you are buying.

Start where the risk is lowest and the volume is highest

The best first workflow in a practice is almost never clinical. It is the front desk: appointment requests, prescription refill questions, hours and directions, insurance and billing questions, and the forty other questions your staff answer every single day from a policy that is already written down somewhere.

That work is high-volume, rule-based, and low-risk — and it is where staff time disappears. Providers have broadly concentrated AI adoption on administrative and back-office work for exactly this reason.

What HIPAA actually requires before you start

• A signed BAA with the vendor, and one with every subprocessor touching data. "HIPAA-friendly" in marketing copy is not a signature on your paper.
• Deployment you control. Your cloud tenancy, least-privilege access, full logging of every access to protected information.
• A human in the loop on anything clinical, with override authority named in writing rather than implied by an org chart.
• An audit trail recording input, the rule applied, the output, and who reviewed it — because that is the first thing anyone asks for after an incident.

State legislatures have been actively regulating AI in clinical decision-making, and insurers are expanding AI in claims and utilisation review. The direction of travel is toward more documentation, not less. Build for it now; retrofitting an audit trail is painful.

What it costs

A front-desk assistant for a single practice is a focused build — ours is $3,500 fixed, live in two to three weeks, with BAA in place before any data is touched. A multi-site group with integration into a practice management system is a bigger scope and priced accordingly. A prior-authorisation or denials workflow across a health system is a full agent programme, not a chatbot, and is priced as one.

The distinction matters because the wrong-sized purchase is the expensive mistake here, in both directions.

The number that decides it

Count the calls your front desk answers in a week that are pure policy lookups. Multiply by minutes, multiply by loaded hourly cost, annualise. Compare that against a one-time build. For most practices the comparison is not close — and it does not require touching a single clinical decision to be true.