SiteGPT · Healthcare
Make AI your 24/7 patient support agent
Answer the questions that fill a front desk, 24/7 and in 95 or more languages: visiting hours, billing and insurance, scheduling, pre-visit education. The bot answers only from content you approve, and hands anything about one patient's care to a person.
- BAA on the Enterprise plan
- Answers from your content only
- 95+ languages, one knowledge base
- On-demand human handoff
SOC 2 Type II examination completed, GDPR certified, HIPAA assessed by DPLMC International.
Patient Assistant- Hours, locations, and departments
- Billing and insurance policies
- Appointments, forms, and the portal
Powered bySiteGPT
A few terms first, because the rest of this page depends on them. HIPAA is the Health Insurance Portability and Accountability Act, the US law governing health information. PHI is protected health information, meaning health data that can be tied to a person.
A business associate is a vendor that handles PHI on behalf of a covered entity such as a clinic or health plan. A BAA (Business Associate Agreement) is the contract that makes that relationship lawful. HHS is the Department of Health and Human Services, which enforces HIPAA. HHS sets out who counts as a business associate, and what the agreement must cover, in its business associate guidance.
Why it matters
What does a healthcare chatbot take off the front desk?
Patients ask the same handful of questions all day, in many languages. A trained assistant answers those, and staff spend their time on the calls that need a person.
Phone and form only
- Callers wait on hold for hours-and-locations questions
- Non-English speakers drop off before they reach anyone
- After-hours questions go unanswered until morning
- Staff repeat the same billing and scheduling answers all day
With SiteGPT
- Instant answers from your published content, around the clock
- The same knowledge base responds in 95 or more languages
- Anything clinical or account-specific is routed to a person
- Staff time goes to the conversations that actually need them
How it works
How do you deploy a HIPAA-covered chatbot?
Train on PHI-free content
Point SiteGPT at your website or upload your FAQs, service pages, and scheduling guidance. A healthcare org can run on PHI-free content today.
Sign the BAA for a covered workspace
On the Enterprise plan, execute the published BAA. Only then does protected health information reach the workspace at all.
Answer, and escalate
Embed the widget on your site. It answers from your content and hands anything clinical to a person, with the transcript.
Answers from your content
What can a healthcare chatbot answer?
- Handles: hours, billing and insurance policies, scheduling, pre-visit education
- Routes to a person: diagnosis, treatment advice, and any one patient's case
- Escalates to a person when the patient asks for one, on every plan
Compliance
Will SiteGPT sign a BAA, and on which plan?
- Security Rule safeguards, breach notice timelines, and subcontractor flow-down
- PHI is never used to train AI models, backed by zero-data-retention endpoints
- The standard document is amendable during onboarding. What a BAA asks of a chatbot is in the requirements guide.
- Comparing vendors? Take 12 questions to ask before you sign a BAA into each call.
Business Associate Agreement
Published in full, before any call
- Enterprise plan
- Amendable at onboarding
- Breach notice timelines defined
- PHI never used to train models
Covered workspace
What changes in a HIPAA-covered workspace?
- Cloud storage and chat integrations are off by default, per-vendor with your own BAA
- Conversation content is redacted seven days after last activity, configurable
- Keep training content PHI-free. Why that holds is covered in keeping PHI out of training data.
In a covered workspace
How does SiteGPT protect patient data?
Your data is encrypted, access-controlled, and never used to train AI models. Under a BAA, protected health information reaches three subprocessors only.
FAQ
Frequently asked questions
Is SiteGPT HIPAA compliant, and will it sign a BAA?
SiteGPT has been assessed for HIPAA security and privacy safeguards by DPLMC International, and signs Business Associate Agreements on the Enterprise plan only. A BAA is not available on Starter, Growth, or Scale. Until one is executed for your account, no protected health information may be submitted at all, including training content, conversations, uploads, and lead capture. The standard BAA is published in full so your counsel can read it before the first call.
What can a healthcare chatbot answer safely?
General, PHI-free questions: visiting hours, insurance and billing policies, appointment and scheduling guidance, service and department information, pre-visit and post-visit education, and forms or portal instructions. It answers only from the content you train it on, so it repeats your published guidance rather than generating medical advice. Anything specific to one patient's care is routed to a person.
What should the chatbot never do?
It should never diagnose, never give treatment advice specific to a person, and never decide an eligibility, coverage, or billing case. On-demand escalation hands those to a human along with the transcript. A patient who asks to talk to someone gets a person.
Can patient data go into the content the bot is trained on?
No. This is a contract term, and HIPAA itself does not forbid PHI in a knowledge base. You agree in the BAA to keep training content PHI-free. There is also a practical reason: the bot retrieves answers from its training content, so anyone who can chat with the bot can reach that content indirectly. PHI stays scoped to end-user conversations.
What changes in a HIPAA-covered workspace?
Cloud storage sources (Google Drive, Notion, Dropbox, OneDrive, Box, GitHub) and chat tool integrations (Zendesk, Slack, Crisp) are off by default. Sources already connected are switched off when HIPAA is enabled. You upload files directly instead, one at a time, so each file gets a PHI-free check. Each vendor can be turned back on when you hold your own BAA with that vendor. Conversation content is redacted seven days after last activity by default, configurable on the order form. The AI-generated disclosure stays pinned even on a white-labeled widget.
Which languages can the chatbot answer in?
SiteGPT answers in 95 or more languages from the same trained content, so a patient can ask in their own language without a separate deployment. This works in a covered workspace like any other capability.
Procurement usually wants one URL. The compliance hub answers the BAA and DPA questions on a single page, and the human-handoff roundup compares how platforms escalate.
Health plans have their own shortlist. If you run insurance member service, see HIPAA compliant chatbots for health insurance, and what an insurance chatbot can and cannot do with claims.
Sources
- HHS, Business Associates guidance: who counts as a business associate and why a BAA is required.
- SiteGPT standard BAA: the published agreement, including breach notice and subcontractor terms.
- SiteGPT HIPAA program: assessment status and the Enterprise-only BAA.
Send this page to your compliance officer
The BAA comes with the Enterprise plan and is scoped with you during onboarding. Bring the patient-facing content you want answered and the provisions your counsel needs to the first call.
- BAA on Enterprise
- 7-day trial on PHI-free content, card required
- 95+ languages