AI Concierge Medicine Intake: Cash-Pay Plus HIPAA in 2026

A concierge practice that does not bill insurance is not automatically outside HIPAA. The trigger is electronic standard transactions — and the AI intake agent that runs an eligibility check or sends an electronic claim has just dragged the practice in.

What this workflow does

flowchart TD
 In[Patient interaction] --> MinNec{Minimum necessary?}
 MinNec -->|yes| Process[AI process]
 MinNec -->|no| Reject[Block + log]
 Process --> Encrypt[(AES-256 at rest)]
 Encrypt --> DB[(PostgreSQL)]
 Process --> Audit[(Audit trail)]
 DB --> Right[Right of access §164.524]

A prospective member calls about joining the concierge practice. The AI intake agent walks them through the membership model, qualifies fit (chronic conditions, expectations, geography), captures intake data (medical history, medications, allergies, prior records), schedules the meet-and-greet, runs the membership-payment processing, and onboards the new member into the practice. For practices that occasionally bill insurance for ancillary services (labs, imaging), the agent handles eligibility checks separately and the practice's covered-entity status follows the transaction.

Done well, the workflow turns a high-touch sales process into a 15-minute call. Done badly, it conflates marketing PHI with intake PHI and trips the practice into an uncertain HIPAA posture.

HIPAA constraints

A health care provider becomes a covered entity at 45 CFR 160.103 when it transmits health information in connection with a HIPAA standard transaction (eligibility, claims, claim status, referral certification, prior authorization, premium payment, enrollment, coordination of benefits, and a few others). A pure cash-pay practice that never transmits a standard transaction may not be a covered entity — but the moment it runs an eligibility check on a member's separate insurance, it is.

State law fills the gap. California CMIA, New York SHIELD Act, Texas HB 300, and Washington's My Health My Data Act all impose privacy requirements on health information regardless of HIPAA covered-entity status. Concierge and DPC practices typically assume HIPAA-aligned safeguards as a default because state law and professional liability expect them.

Marketing rules under 45 CFR 164.508 apply when the practice is a covered entity and pushes elective services or third-party offerings.

How CallSphere implements it

Explore a live demo and compare current plans to find the right fit for your business.

Implementation checklist

1. Determine the practice's covered-entity status — does it transmit any standard transaction?
2. Default to HIPAA-aligned safeguards regardless of covered-entity determination.
3. Apply state-specific privacy law requirements (CMIA, SHIELD Act, HB 300, MHMDA).
4. Capture membership payments via a PCI-DSS-aligned tokenized processor.
5. Run prior-records release through a HIPAA-compliant authorization flow with the previous provider.
6. Separate eligibility checks for ancillary insurance from the membership-payment flow.
7. Apply minimum-necessary discipline to voicemail and SMS regardless of covered-entity status.
8. Sign BAAs with EHR, payment processor, voice carrier, ASR, TTS, and LLM sub-processors.
9. Run a written notice that satisfies the strictest applicable state law.
10. Audit-log every intake with caller identity, consent capture, and disclosure decisions.
11. Marketing content (referral asks, testimonials) requires explicit consent.
12. Tabletop quarterly: prospective member calls about a sensitive condition — practice the discreet intake.

FAQ

Is a pure cash-pay practice a HIPAA covered entity? Only if it conducts a standard transaction electronically. A practice that takes cash, does not file insurance, and does not run electronic eligibility checks may not be a covered entity. Most concierge practices file at least some labs and imaging, which can pull them in.

Why apply HIPAA-aligned safeguards if not required? State privacy law, professional liability, member expectations, and the operational reality that PHI flows in and out of the practice every day. The cost of HIPAA-aligned hygiene is small; the downside of a state-law breach is large.

What about prospective-member intake before they join? Pre-membership intake is health information. Treat it as PHI under HIPAA-aligned safeguards regardless of formal covered-entity status; capture it through a secure channel; retain only what the qualification decision required.

Can the agent reference health conditions in marketing follow-up? No. Marketing content is generic; condition-specific follow-up requires consent.

Does the practice need a Notice of Privacy Practices if not a covered entity? Not under HIPAA, but state law often requires equivalent notice. Plus members expect one.

Sources

• 45 CFR 160.103 Definitions: https://www.ecfr.gov/current/title-45/section-160.103
• 45 CFR 164.501 Health care operations: https://www.ecfr.gov/current/title-45/section-164.501
• HHS HIPAA Covered Entities chart: https://www.hhs.gov/sites/default/files/ocr/privacy/hipaa/understanding/coveredentities/index.html
• California CMIA: https://leginfo.legislature.ca.gov/faces/codes_displayexpandedbranch.xhtml?tocCode=CIV
• Washington My Health My Data Act: https://www.atg.wa.gov/my-health-my-data-act