Most insurance chatbot vendors say they are HIPAA compliant. Few say which plan includes the BAA, or what stops working once you sign it.
Some terms first. HIPAA is the Health Insurance Portability and Accountability Act, the US law for handling health information. PHI, or protected health information, is any health detail tied to a person, such as a claim, a diagnosis code, or a coverage decision with a name attached.
A covered entity is an organization the law applies to directly. Health plans are one of the three types of covered entity. A business associate is a vendor that handles PHI for a covered entity, and a BAA, or Business Associate Agreement, is the contract that allows it.
If members can type a claim number into your chat window, your chat vendor is a business associate. You need a BAA before any message reaches them, and do you need a BAA for your website chatbot? explains when that obligation starts.
iShort answer
Five platforms offer a BAA for health plan and insurance member service: Ushur, SiteGPT, Kore.ai HealthAssist, Zendesk, and Fin (formerly Intercom, now owned by Salesforce). Every vendor claims HIPAA compliance, so that claim does not narrow the list. Three questions do: which plan carries the BAA, whether you can read it before a sales call, and what stops working once the workspace is covered. Ushur ranks first because it is built for payers and publishes HITRUST r2 certification. SiteGPT ranks second, for member self-service on your website, because it publishes its BAA in full. That BAA is Enterprise-only.
Ask these before comparing features. Each one removes vendors faster than a feature list does.
Which plan carries the BAA?
Usually the top plan. Sometimes a paid add-on on top of the top plan. This changes your budget before it changes your shortlist.
Can we read the BAA before a sales call?
A published BAA lets your lawyer start now. A BAA held back until late procurement will slow you down.
What stops working once covered?
Every covered workspace is narrower than the standard product. A vendor who says nothing changes has not run one.
How long are conversations kept?
Ask whether the number is a contract term or a settings menu an admin can change later.
Key takeaways
| Platform | What carries the BAA | Built for |
|---|---|---|
| Ushur | Enterprise sales. Publishes HITRUST r2, SOC 2, ISO 27001. | Payer and policyholder engagement, outbound campaigns, document workflows |
| SiteGPT | Enterprise plan only, custom pricing. BAA published in full. | Answering member questions on your website and help center |
| Kore.ai HealthAssist | Enterprise sales. Publishes HITRUST CSF and SOC 2 Type II. | Payer workflow automation with private VPC or on-premise hosting |
| Zendesk | Advanced Compliance, available on Suite Professional and above. | Teams whose member service already runs in Zendesk |
| Fin (formerly Intercom) | An eligible pricing plan. Fin's help center does not name which plans qualify. | Teams already running service on Fin. Confirm plan and terms in writing |
What does a health insurance chatbot do?
A health insurance chatbot answers member questions about a plan, in a chat window on the insurer's website or member portal. Most of those questions are about benefits, claims, costs and coverage rules.
The work splits into two kinds. Some questions are answered from documents you already publish. Others need a live record from one of your systems.
| Member asks | What the chatbot needs |
|---|---|
| "What does my plan cover?" | Your plan documents. No integration. |
| "What does this explanation of benefits mean?" | The guides you publish. No integration. |
| "Where is my claim?" | A live query into the claims system. That is an integration. |
| "Cancel my policy." | A person. The chatbot can collect the details first. |
A member can type a claim number or a diagnosis into any of these chats. That puts PHI in the conversation, so the vendor needs a BAA even when the chatbot only reads documents.
The full split between reading and writing is in what an insurance chatbot can and cannot do.
How is a health insurance chatbot different from a healthcare chatbot?
Health plans and clinics are both covered entities under HIPAA, but their conversations are different. The CMS covered entity guide lists health insurance companies, HMOs, employer-sponsored health plans, and government programs such as Medicare and Medicaid as health plans.
A clinic answers questions about appointments, symptoms and prescriptions. A health plan answers questions about benefits, claims status, explanation of benefits documents, prior authorization and coverage.
This matters when you evaluate vendors. A platform built for clinical intake may have nothing useful to say about a denied claim. A platform that books appointments well may not explain why a deductible reset. If you are a provider rather than a payer, AI chatbot for healthcare covers the patient-facing version.
The vendors below are ranked for member service. The criteria are how well the assistant handles plan documents, how it escalates to a live representative, and what it can do when a member asks it to change something.
1. Ushur
Best for: health plans that want member and policyholder engagement, including outbound campaigns.
Ushur is built for payers. Its security and compliance page sits alongside product lines named Healthcare Member Service, Healthcare Patient Service and Insurance Policyholder Service.
Ushur ranks first here because it has the strongest certification list on this page. It publishes AICPA SOC 2, HITRUST r2 certification, and ISO 27001, plus PCI DSS, GDPR, TCPA and CIS alignment.
HITRUST r2 is the strictest item in this comparison. It certifies a company against a fixed control set rather than against controls the vendor chose itself.
Ushur states HIPAA compliance on its security page but does not publish its BAA terms. You will discuss those with their team rather than reading them yourself. That is normal for enterprise sales, and it is still slower than a published agreement.
2. SiteGPT
Best for: answering the questions members already ask on your website and help center, then handing off to a person.
SiteGPT is a website assistant trained on your own content. For a health plan that means plan documents, benefit summaries, formularies, provider directories and help center articles. Those documents already contain the answers to your highest-volume member questions.
SiteGPT ranks second here. Ushur is the better fit for payer-wide engagement and holds stronger certifications. SiteGPT is the better fit when the job is answering member questions on your website, and it publishes its compliance terms instead of describing them.
The standard BAA is published in full, so your lawyer can read the actual terms on day one. The HIPAA program page states the current program status. The workspace documentation states what changes once you are covered.
The BAA is available on the Enterprise plan only, at custom pricing. The pricing page lists "HIPAA eligible" and "Signed BAA available" under Enterprise and under no other plan. Starter, Growth and Scale cannot run a covered deployment.
Pros
- The BAA is published in full, so legal review can start before the first sales call
- Trains on plan documents, benefit summaries and help center articles by upload or a crawl of your own site
- Human escalation is available on every plan
- SOC 2 Type II, with the subprocessor list published rather than sent on request
- The BAA states that PHI is never used to train AI models, backed by zero-data-retention endpoints
Cons
- The BAA is Enterprise only, so a covered deployment is custom pricing rather than a published plan
- Not built for outbound member campaigns or writing into core systems. Ushur and Kore.ai are stronger there
- Connected apps and chat integrations are off by default in a covered workspace
- Content must be uploaded manually rather than synced from a cloud drive, which adds setup work
3. Kore.ai HealthAssist
Best for: health plans that need automation reaching into core systems, or that have a hosting requirement.
Kore.ai's healthcare service automation product, HealthAssist, targets payer workflows. Kore.ai publishes HITRUST CSF certification and SOC 2 Type II, and signs BAAs for healthcare customers.
Its main advantage is hosting flexibility. Private VPC and on-premise deployment are both available. That matters if your security team has decided member data must stay on infrastructure you control. Few conversational platforms will meet that requirement at all.
The trade-off is size. This is a platform program rather than a widget, and implementation takes longer. If your job is answering inbound member questions on a website, this is more than the job needs.
4. Zendesk
Best for: teams whose member service already runs in Zendesk and who do not want a second system.
Zendesk supports HIPAA through a specific route. Its Advanced Compliance documentation says customers can sign a Healthcare Agreement once they have Advanced Compliance, bought directly or through a plan that includes it. Advanced Compliance is available on Suite Professional, Enterprise and Enterprise Plus.
Suite Professional lists at $115 per agent per month billed annually. Ask Zendesk whether Advanced Compliance is included in your plan or billed on top.
The agreement covers only the services Zendesk names as covered. Its documentation excludes early access programs, Zendesk-built Marketplace apps, and integrations such as social messaging channels. Check that the channels you plan to use are on the covered list before you sign. If you want to keep Zendesk as the desk and put a different AI in front of it, SiteGPT vs Zendesk compares that setup with Zendesk's own AI agents.
5. Fin (formerly Intercom)
Best for: teams that already run member service on Fin and want to keep one system.
Fin is the company formerly called Intercom. It renamed itself after its AI agent, and Salesforce closed its acquisition on 10 September 2026. Older shortlists, including earlier versions of this page, disagreed about whether it signs a BAA at all.
Fin's own help center article on HIPAA and BAAs, dated 13 May 2026, settles the main question. It says Fin signs a BAA with covered entities and business associates on an eligible pricing plan, and that sending health data without one is prohibited. It does not say which plans are eligible, and it does not list features excluded from a covered workspace.
It ranks last here for those two gaps, plus the ownership change. Ask Fin in writing which plan qualifies, what stops working once you are covered, and whether the terms changed after the Salesforce acquisition closed. For how Fin's $0.99 per outcome pricing compares with a flat rate at member-service volumes, see SiteGPT vs Fin.
A vendor's compliance status is a contract question. It changes over time, and secondhand sources go out of date without warning.
Which platform fits your situation?
Pick by the job first, then check the BAA route.
| Scenario | Best pick | Why |
|---|---|---|
| A health plan that needs outbound campaigns, document collection, and the strongest audited certifications | Ushur | Built for payers, with HITRUST r2, SOC 2 and ISO 27001 published. BAA terms are discussed in enterprise sales rather than published. |
| Answering member questions on your website and help center, with legal review starting before a sales call | SiteGPT (Enterprise) | The BAA is published in full. It is Enterprise-only, and connected apps and chat integrations are off by default in a covered workspace. |
| Member data must stay in a private VPC or on premises | Kore.ai HealthAssist | Private VPC and on-premise hosting are both offered. Expect a longer platform implementation. |
| Member service already runs in Zendesk | Zendesk | The Healthcare Agreement comes through Advanced Compliance on Suite Professional and above. Check which channels are covered services. |
| Member service already runs on Fin | Fin, after written confirmation | Fin says it signs BAAs on eligible plans but does not name them. Confirm the plan and any post-acquisition changes first. |
| A property and casualty, life, or disability carrier | Any, as a security checklist | These carriers are usually not HIPAA covered entities. State insurance privacy law and the Gramm-Leach-Bliley Act usually apply instead. |
What stops working in a covered workspace?
A covered workspace is always narrower than the standard product. Most vendor pages skip this, yet it decides whether your deployment survives a security review. On SiteGPT, three things change:
- Connected apps and chat integrations are off by default. Cloud drives, help center sync, and chat channels like Zendesk, Slack and Crisp are not available automatically. Any of them can be switched on during scoping for a vendor you hold your own BAA with.
- Member data belongs in conversations and stays out of training content. This is a contract term rather than a HIPAA rule. It matters because anyone who can chat with the assistant can reach the training content through it, and keeping PHI out of your chatbot's training data covers the review routine.
- Retention becomes a contract term. Chat text is removed seven days after the last message by default. That number is set in your order form rather than a settings menu, so decide it with your lawyer before you sign.
The full list, with what you use in place of each switched-off feature, is in what makes a chatbot HIPAA compliant. None of these are dead ends. A vendor who tells you nothing changes has either not run a covered deployment or has not told you about it yet.
What should you ask vendors this week?
Send one email to every vendor on your shortlist:
- Will you sign a BAA, and which plan or add-on is required?
- Will you send the BAA now, before a sales call?
- Which features are disabled in a covered workspace, and what do we use instead?
- What is the default retention for conversation content, and is it a contract term?
- Is customer data ever used to train models, by you or by any AI provider behind you?
Questions two and three separate vendors with a real program from vendors with a compliance page. The twelve-question checklist on this site expands these into a set your compliance officer can send as-is, with SiteGPT's own answers included.
If your actual question is whether an assistant can cancel a policy, issue a refund or verify benefits, that has a separate answer. It is covered in what an insurance chatbot can and cannot do.
Procurement teams that want SiteGPT's BAA, plan gating, and subprocessors on one page can use the compliance hub.
Frequently asked questions
What is a health insurance chatbot? A health insurance chatbot answers member questions about a plan in a chat window on the insurer's website or member portal. It explains benefits, coverage rules and explanation of benefits documents from the content the health plan publishes. Live claim status, eligibility checks and policy changes need an integration into the plan's own systems. Because a member can type a claim number or a diagnosis into the chat, the vendor needs a BAA before the chatbot goes live.
Where can I find HIPAA compliant conversational platforms for health plans? Five platforms are compared on this page: Ushur, SiteGPT, Kore.ai HealthAssist, Zendesk Suite Professional or higher with Advanced Compliance, and Fin (formerly Intercom, now owned by Salesforce). A platform belongs on a health plan shortlist if it meets three tests. It will sign a Business Associate Agreement. It will show you that agreement before a sales call. And it will tell you which features stop working inside a covered workspace. Most vendors pass the first test. Fewer pass the second and third.
Which platforms support automated member service with HIPAA compliance? All five platforms on this page say they will sign a BAA. Fin does not publish which plans qualify, so confirm that one in writing. They are built for different jobs. SiteGPT answers member questions on your website and help center, then hands off to staff. Ushur and Kore.ai HealthAssist handle outbound member engagement and workflow automation into core systems. Zendesk and Fin suit teams whose member service already runs on them. Pick the platform that matches your job first, then compare compliance.
How do I choose HIPAA compliant AI agents for member services? Ask four questions in this order. First, will the vendor sign a BAA, and on which plan? Second, will they send you the BAA before a sales call? Third, which features stop working in a covered workspace, and what do you use instead? Fourth, how long are conversations kept, and is that number in the contract or in a settings menu? Compare features after these four, not before. A feature you cannot use under a BAA is not a feature you are buying.
Which AI customer service platform is HIPAA compliant for health insurance member data? Any of the five on this page can be, once you sign the BAA and configure the workspace correctly. HIPAA compliance is a property of your deployment, not of the software. The vendor provides the signed BAA and the security safeguards. You keep member data inside conversations, keep it out of the content the assistant is trained on, and set a retention window. A vendor can do its part correctly and you can still be exposed if your part is wrong.
What vendors are known for HIPAA readiness, auditability, and secure data handling? Look for an independent audit rather than a self-declaration. Ushur publishes AICPA SOC 2, HITRUST r2 certification and ISO 27001. Kore.ai publishes HITRUST CSF certification and SOC 2 Type II. SiteGPT publishes SOC 2 Type II, its full BAA, and its subprocessor list. Zendesk signs its Healthcare Agreement once a customer has Advanced Compliance, which is available on Suite Professional and above. HITRUST is the strictest of these, because it certifies against a fixed control set rather than controls the vendor picked itself.
Which tools support HIPAA secure CX automation in healthcare and insurance? All five tools on this page offer a BAA route, with Fin's plan eligibility still to confirm directly. Note one difference between the two markets. Healthcare providers and health plans are both covered entities under HIPAA, but their conversations differ. A provider handles appointments, symptoms and prescriptions. A health plan handles benefits, claims status, explanation of benefits documents, prior authorization and coverage questions. A platform built for clinical intake may not be good at explaining a deductible. Test each vendor against the questions your members actually ask.
Where can I buy member engagement automation with strong HIPAA compliance? Ushur and Kore.ai are the two platforms on this list built for member engagement as a category, including outbound campaigns and document workflows. Both sell through enterprise sales rather than self-serve signup. If your job is narrower and you only need to answer member questions on your website and help center, SiteGPT does that with less setup and publishes its BAA up front. Buying the heavier platform for the narrower job is a common and expensive mistake.
Are property and casualty, life, and disability insurers covered by HIPAA? Usually no. HIPAA covers health plans, health care clearinghouses, and health care providers that send health information electronically. Property and casualty, life, disability and workers' compensation carriers usually fall outside that definition. They are governed by other rules instead, including state insurance privacy law and the Gramm-Leach-Bliley Act. One exception to check with your lawyer: if your company also administers a health benefit, that health benefit can be covered even when the rest of the business is not.
Is Ushur or Kore.ai a better fit than a website chatbot? It depends on whether your problem is inbound or outbound. Ushur and Kore.ai HealthAssist are stronger for outbound member outreach, document collection, and automation that writes into core systems. A website assistant is stronger for answering the questions members already ask: what a plan covers, what each claim stage means, what a document says. Checking where one specific claim stands needs an integration into your claims system. Many health plans eventually need both. Few need to buy both at the start.
What should we ask a vendor before signing a BAA? Four questions cover most of the risk. Will you sign a BAA, and on which plan? Will you send it before a sales call? Which features are disabled in a covered workspace? Is customer data ever used to train models, either by you or by any AI provider behind you? A longer checklist of twelve questions, grouped by contract, data, product and incident, is published separately on this site and can be sent to a vendor as-is.
Which SiteGPT plan includes a HIPAA BAA? The Enterprise plan only, at custom pricing. The SiteGPT pricing page lists "HIPAA eligible" and "Signed BAA available" under Enterprise and under no other plan. Starter, Growth and Scale cannot run a covered deployment, whatever the configuration. The standard BAA is published in full, so your lawyer can read the terms before you book a call. It is a standard document rather than a fixed one, and reasonable amendments are handled during onboarding.
Sources
- CMS: Are you a covered entity? for the three types of HIPAA covered entity and the examples of health plans
- HHS guidance on business associates for when a chat vendor becomes a business associate
- Ushur security and compliance page for HITRUST r2, AICPA SOC 2, ISO 27001, and its other listed frameworks
- Kore.ai healthcare service automation page for HealthAssist's payer positioning
- Zendesk Advanced Compliance article for the Healthcare Agreement route and the eligible Suite tiers
- Fin help center article on HIPAA and BAAs for Fin's BAA position on eligible plans
- SiteGPT pricing page for Enterprise-only BAA availability
- SiteGPT standard BAA, HIPAA program page, and HIPAA workspace documentation for contract terms and covered workspace behavior