Table of Contents
- Key takeaways: which HIPAA compliant chatbot fits which job
- What makes a chatbot HIPAA compliant?
- How these HIPAA compliant chatbots were ranked
- The 7 best HIPAA compliant chatbots for 2026
- 1. Zendesk: best for hospitals and clinics with a staffed service desk
- Key features
- Pros
- Cons
- Pricing
- 2. Fin, formerly Intercom: best for an AI agent that takes actions inside a helpdesk
- Key features
- Pros
- Cons
- Pricing
- 3. SiteGPT: best for patient questions answered from your own content
- Key features
- Pros
- Cons
- Pricing
- 4. Freshchat: best for low-cost chat with agents on every channel
- Key features
- Pros
- Cons
- Pricing
- 5. Hyro: best for health systems that need Epic scheduling
- Key features
- Pros
- Cons
- Pricing
- 6. Ada: best for enterprise health plans that want a managed AI agent
- Key features
- Pros
- Cons
- Pricing
- 7. Chatbase: best for teams already on Chatbase that can move to Enterprise
- Key features
- Pros
- Cons
- Pricing
- Which popular chatbots are not HIPAA compliant?
- HIPAA compliant chatbots compared: BAA, plan, and price
- How to choose a HIPAA compliant chatbot
- Use-case cheat sheet: which HIPAA compliant chatbot for which scenario
- Frequently asked questions about HIPAA compliant chatbots
- The basics
- What is a HIPAA compliant chatbot?
- Are medical chatbots HIPAA compliant?
- Does a chatbot need a BAA if it only answers general questions?
- BAAs and plans
- Which chatbot vendors sign a BAA?
- Which SiteGPT plan includes a BAA?
- Will a vendor change its BAA?
- Hospitals and clinics
- Are any chatbots suitable for a hospital setting?
- Can a HIPAA compliant chatbot book appointments?
- Where is PHI allowed in a SiteGPT HIPAA workspace?
- Pricing
- How much does a HIPAA compliant chatbot cost?
- What is the cheapest HIPAA compliant chatbot?
- How much does SiteGPT cost?
- Sources

- The BAA is the test. A vendor that will not sign one cannot receive PHI, whatever its security page says.
- Zendesk signs a BAA through Advanced Compliance, which is included in Suite Professional ($115 per agent per month, billed yearly) and higher plans.
- Fin (formerly Intercom) says every Fin workspace is eligible for a BAA. Its pricing page still lists HIPAA support under the Expert plan at $132 per seat per month, billed annually, so confirm the plan in writing.
- SiteGPT signs a BAA on the Enterprise plan only, never on Starter, Growth, or Scale. The standard BAA is published and SiteGPT tailors it during onboarding.
- Ada, Hyro, and Chatbase name HIPAA on their sites and publish no BAA terms. Tidio provides no HIPAA compliance documentation.
Key takeaways: which HIPAA compliant chatbot fits which job
Platform | Best for | BAA terms on the vendor's own pages | Price of the plan named |
Zendesk | Hospitals and clinics with a staffed service desk | Suite Professional and above, signed by DocuSign | $115 per agent per month, billed yearly |
Fin (formerly Intercom) | An AI agent that takes actions inside a helpdesk | Every workspace eligible, per the help center | $29 to $132 per seat per month, billed annually, plus $0.99 per outcome |
Patient questions answered from your own content | Enterprise plan only, standard BAA published | Custom | |
Freshchat | Low-cost chat with agents on every channel | BAA offered, plan not stated | From $19 per agent per month, billed annually |
Hyro | Health systems that need Epic scheduling | BAA terms not published | Not published |

What makes a chatbot HIPAA compliant?
- A signed BAA. Both parties sign before the first patient message. Whether a website chatbot needs one at all is answered in do you need a BAA for your website chatbot.
- The scope of the BAA. Vendors cover named products and exclude others. Marketplace apps, social channels, and third-party integrations are the usual exclusions.
- The plan the BAA requires. The plan sets the real price of compliance. Some vendors state it and some do not.
- The vendor chain. The AI model provider and the database host also touch PHI. Each needs its own BAA with the chatbot vendor.

How these HIPAA compliant chatbots were ranked
- BAA availability. A BAA described on the vendor's own site ranks above a HIPAA claim with no contract terms.
- Plan gating. A BAA on a plan with a published price ranks above a BAA behind a sales call.
- Covered scope. Chat, AI agent, voice, and ticketing each need to be named as covered.
- Fit for PHI workflows. Scheduling, record lookups, and agent handoff need integrations that a content-trained chatbot does not have.
- Price of the compliant setup. The price that counts is the plan where the BAA starts.
The 7 best HIPAA compliant chatbots for 2026
1. Zendesk: best for hospitals and clinics with a staffed service desk

Key features
- BAA available on Suite Professional and higher plans
- Covered services include ticketing, help center, live chat and Zendesk messaging, analytics, and voice (text messaging excluded)
- AI Agents Advanced, Copilot, and Contact Center are listed as HIPAA enabled add-ons
- Recommended security settings for accounts that hold PHI
- 14-day free trial with no credit card
Pros
- The plan, the covered services, and the signing route are all public
- One BAA covers chat, tickets, and phone
- AI agents and human agents work in the same covered account
Cons
- Support Team and Suite Team cannot get the BAA
- Marketplace apps, early access features, and social messaging channels are outside the BAA
- Contact Center customers also need their own BAA with AWS
- Per-agent pricing: 5 agents on Suite Professional cost $575 a month, or $6,900 a year
Pricing
Plan | Per agent per month, billed yearly | BAA available |
Support Team | $19 | No |
Suite Team | $55 | No |
Suite Professional | $115 | Yes |
Suite Enterprise and Enterprise Plus | Through sales | Yes |
2. Fin, formerly Intercom: best for an AI agent that takes actions inside a helpdesk

Key features
- BAA requested through the Messenger or by email to the Fin team
- HIPAA attestation examination against the Security Rule and the HITECH Breach Notification Rule
- Fin AI Agent priced per outcome
- Inbox, tickets, and help center in one product
- Fin also runs on top of another helpdesk, including Salesforce, with no seats required
Pros
- The BAA rule is short: be a covered entity or business associate and hold a Fin workspace
- The AI agent takes actions in external systems and hands off to agents
- Pricing is published for seats and for outcomes
Cons
- The two Fin pages disagree. The help article says every workspace is eligible, and the pricing page lists HIPAA support under Expert only
- Fin's terms prohibit sending ePHI before the BAA is signed
- Two meters run at once: seats and $0.99 per outcome
- 5 Expert seats and 1,000 outcomes cost $1,650 a month ($660 plus $990)
Pricing
Item | Price, billed annually | HIPAA support listed on the pricing page |
Essential | $29 per seat per month | No |
Advanced | $85 per seat per month | No |
Expert | $132 per seat per month | Yes |
Fin AI Agent | $0.99 per outcome | Not stated |
3. SiteGPT: best for patient questions answered from your own content

- PHI belongs in conversations only. This is a term of the BAA, and HIPAA itself does not set it. The reason is practical: the chatbot answers from its training content, so anyone who can chat with it can reach that content.
- Cloud drive sources are switched off. Notion, Google Drive, Dropbox, OneDrive, Box, and GitHub are not offered. Content is added with website links, file uploads, and text snippets.
- Chat tool integrations are switched off. Zendesk, Slack, Crisp, and the others are not offered. Conversations stay in the chat widget on your website, which the BAA covers.
- Conversation content is redacted 7 days after the last activity. The order form can set a different window. Leads are kept until you delete them.
Key features
- BAA on the Enterprise plan, signed during onboarding
- PHI goes to three subprocessors: Convex, OpenAI on zero-data-retention endpoints, and Pinecone. Each has signed a BAA with SiteGPT, per the subprocessor list
- Breach reporting within five business days of discovery
- PHI is never used to train AI models
- Email notifications and webhooks carry no conversation content or visitor contact details
- Human escalation with team notifications
- 95+ languages
Pros
- Counsel can read the BAA before the first call and ask for changes
- SiteGPT countersigns only after every vendor in the PHI chain has signed its own BAA
- Flat pricing with no per-seat or per-outcome fee on the self-serve plans
- A healthcare team can start today on public content with no PHI, such as FAQs and service information
Cons
- The BAA is Enterprise only, at a custom price. No self-serve plan includes it
- No scheduling, EHR, or patient record integration
- Cloud drive sources and chat tool integrations are not available in a HIPAA workspace
- SiteGPT does not scan content for PHI. Keeping PHI out of training content and lead forms is your own review step
- HIPAA workspaces share one separate index. It is not a dedicated environment per customer
- The 7-day trial requires a credit card
Pricing
Plan | Monthly | Annual (per month, billed yearly) | Messages per month | BAA |
Starter | $59 | $39 ($468/yr) | 400 to 4,000 | No |
Growth | $129 | $79 ($948/yr) | 1,000 to 10,000 | No |
Scale | $429 | $259 ($3,108/yr) | 4,000 to 40,000 | No |
Enterprise | Custom | Custom | Custom | Yes |
4. Freshchat: best for low-cost chat with agents on every channel

Key features
- BAA executed between Freshworks and the customer
- Role-based access and SAML single sign-on, both required by the guide
- Regex-based truncation of ePHI in chat messages, switched on by Freshworks on request
- Web chat, messaging apps, and a Freddy AI Agent
- A free plan for up to 10 agents
Pros
- The lowest per-agent entry price on this list
- A written configuration guide tells you what to switch off
- Chat and ticketing come from one vendor
Cons
- Freshworks does not state which plan the BAA requires, so get it in writing
- The BAA holds only while you follow the guide, which was last modified in February 2024
- Integrations that send data outside Freshworks are outside the HIPAA scope
- Visitor notifications must be disabled, because the notification subprocessors sign no BAA
- Freshchat inside Freshsales or Freshmarketer is not covered by the guide
Pricing
Plan | Per agent per month, billed annually |
Free | $0, up to 10 agents |
Growth | $19 |
Pro | $49 |
Enterprise | $79 |
5. Hyro: best for health systems that need Epic scheduling

Key features
- Listed in the Epic Vendor Services marketplace
- Patient verification from Epic records
- Appointment booking, rescheduling, and cancelling
- Prescription refill support through the Epic Willow Ambulatory module
- Calls and messages handled by the same agents
Pros
- The only platform on this list built for scheduling inside an EHR
- Voice and chat from one vendor
- Content is pulled from the health system's web pages and Epic, which cuts manual upkeep
Cons
- BAA terms not published. The pages reviewed describe the agents as HIPAA compliant and name no plan, contract, or subprocessor terms
- No public pricing and no self-serve trial
- Built for health systems, so a small clinic is unlikely to be the target buyer
- 20 G2 reviews, the smallest count on this list after SiteGPT
Pricing
6. Ada: best for enterprise health plans that want a managed AI agent

Key features
- SOC 2 Type II, GDPR, and HIPAA listed on the trust page
- Zero data retention with LLM providers
- Annual third-party penetration tests and LLM evaluations
- AIUC-1 certification, a standard for AI agents
- Role-based access, MFA, and audit logging
Pros
- A public trust center with reports to request
- Responses are checked against approved sources before they reach the customer
- Customer data is not used to train models
Cons
- BAA terms not published. No page reviewed names the plan or the contract terms
- No public pricing. The site offers a conversation with sales only
- Built for enterprise contracts, so it is a poor fit for a single practice
Pricing
7. Chatbase: best for teams already on Chatbase that can move to Enterprise

Key features
- HIPAA eligibility listed on Enterprise
- SSO, audit logs, and custom roles on Enterprise
- AI agents trained on websites and files
- A native helpdesk, voice, and telephony from the Standard plan
- A free plan with 50 message credits a month
Pros
- Self-serve plans let a team test the product on content with no PHI
- Helpdesk and voice are built in from Standard
- Yearly billing takes 20% off
Cons
- BAA terms not published. The security page does not mention HIPAA or a BAA
- Free, Hobby, Standard, and Pro are not listed as HIPAA eligible
- Removing Chatbase branding costs $99 a month
- Credits are small on Hobby: 700 a month
Pricing
Plan | Billed monthly | Message credits per month | HIPAA eligible |
Free | $0 | 50 | No |
Hobby | $40 | 700 | No |
Standard | $150 | 4,000 | No |
Pro | $500 | 15,000 | No |
Enterprise | Custom | Custom | Yes |
Which popular chatbots are not HIPAA compliant?
HIPAA compliant chatbots compared: BAA, plan, and price
Platform | BAA stated on the vendor's site | Plan the BAA requires | Lowest price of that plan | G2 rating |
Zendesk | Yes | Suite Professional and above | $115 per agent per month, billed yearly | 4.3 (7,089) |
Fin (formerly Intercom) | Yes | Every workspace per the help center. Expert per the pricing page | $29 to $132 per seat per month, plus $0.99 per outcome | 4.5 (3,918) |
Yes, published in full | Enterprise only | Custom | 4.9 (12) | |
Freshchat | Yes | Not stated | From $19 per agent per month, billed annually | 4.4 (502) |
Hyro | BAA terms not published | Not stated | Not published | 4.9 (20) |
Ada | BAA terms not published | Not stated | Not published | 4.6 (173) |
Chatbase | BAA terms not published | Enterprise is listed as HIPAA eligible | Custom | 4.8 (46) |
How to choose a HIPAA compliant chatbot
If you need... | Pick... | Why |
PHI handled in tickets, chat, and phone by agents | Zendesk | One BAA on Suite Professional covers all three |
An AI agent that resolves requests inside a helpdesk | Fin | BAA for every workspace per the help center, $0.99 per outcome |
Patient questions answered from your website and files | Published BAA on Enterprise, PHI limited to conversations | |
Appointments booked inside Epic | Hyro | Epic integration for scheduling and refills |
Agent chat at the lowest seat price | Freshchat | From $19 per agent per month, with a written configuration guide |
A managed AI agent for a large health plan | Ada | Public trust center and a custom contract |
To stay on Chatbase | Chatbase Enterprise | The only Chatbase plan listed as HIPAA eligible |

Use-case cheat sheet: which HIPAA compliant chatbot for which scenario
Scenario | Best pick | Why |
A hospital contact center with 40 agents | Zendesk | Chat, tickets, and voice under one BAA |
A health system on Epic that wants self-service scheduling | Hyro | Books, reschedules, and cancels through Epic |
A telehealth startup with a small service team | Fin | BAA eligibility for every workspace per the help center |
A clinic group that wants its website FAQs answered at night | SiteGPT | Answers from site content and escalates to staff |
A health software company with long product docs | SiteGPT | Trains on website links and uploaded files in a HIPAA workspace |
A dental practice with two front-desk staff | Freshchat | Low per-agent price and a free plan to test with |
A health insurer with a procurement team | Ada | Enterprise contract and a public trust center |
A team that must read the BAA before any sales call | SiteGPT | The standard BAA is published and open to changes |
A practice that only needs a bot for content with no PHI | SiteGPT Starter or Growth | No BAA is needed when no PHI is involved |
A team that shortlisted Tidio for patient chat | Zendesk or Fin | Tidio provides no HIPAA compliance documentation |






