General information, not legal or medical advice — confirm with your compliance officer or attorney.
A medical chatbot on a practice website has one job: do what a good receptionist does on the phone, at any hour, without ever acting like a clinician. Done well, it answers routine questions and turns evening visitors into callback requests. Done badly, it gives health advice nobody approved. Here is what to let it do, what to forbid, and how to test it before a patient sees it.
In short: A practice medical chatbot answers front-desk questions such as hours, services, insurance and directions, collects contact details for a callback, and hands everything clinical to staff. It is not a symptom checker or a clinical decision tool. It needs an emergency message, an AI disclosure, a human handoff and a BAA with its vendor.
What a medical chatbot is (and isn't)
"Medical chatbot" covers very different software. Search results mix three kinds:
| Type | What it does | Example question |
|---|---|---|
| Practice website chat | Front-desk information and requests | "Do you take Aetna?" |
| Symptom checker | Suggests possible conditions or urgency | "Is this chest pain serious?" |
| Clinical decision support | Helps clinicians decide on care | "Which antibiotic fits this culture result?" |
This guide is about the first kind. The other two carry regulatory weight. Software intended to diagnose or treat can fall under FDA oversight as a medical device. FDA's clinical decision support guidance (opens in a new tab), issued in final form in January 2026, explains which decision-support functions FDA considers outside the device definition.
Clinical tools also bring civil rights duties. Under the Section 1557 rule, covered entities must make reasonable efforts to identify and reduce the risk of discrimination from "patient care decision support tools" (45 CFR 92.210 (opens in a new tab)). A front-desk bot that sticks to hours and insurance stays clear of both.
Jobs a practice chatbot does well
Grounded in the calls your front desk already takes:
- Hours and directions. Holiday closures, parking, which entrance, wheelchair access.
- Services offered. "Do you do sports physicals?" "Do you see children?"
- Insurance and payment questions. Plans accepted, self-pay options, what to bring.
- New-patient requests and callbacks. Name, phone, email, preferred times, and new or existing patient.
- After-hours capture. At 9 p.m., a visitor who would have left can leave a request instead.
The callback is where the value is. A request captured at night is worth little if nobody calls until the afternoon; see speed to lead for response-time habits. Requests should land in a patient CRM with access controls, not a shared email account.
Hard limits: diagnosis, dosing and emergencies
Write these into the bot's instructions and test each one.
- Emergency message. Shown at the start and whenever symptoms come up: "If this is an emergency, call 911 or go to the nearest emergency room."
- No clinical advice. No diagnosis, no dosing, no "should I wait or come in," no reading of test results.
- Human handoff. A clear path to staff during hours, and a stated callback time after hours.
- A way to correct wrong answers. Staff can flag a bad reply, and someone owns fixing the source information within a set time.
- No confirming who is a patient. "Is my husband booked for Tuesday?" gets a callback, not an answer.
Illustrative example for a fictional clinic:
Visitor: I've had a fever for three days, should I take more ibuprofen?
Bot: I can't give medical advice. If this is an emergency, call 911 or go to the nearest emergency room. For anything else, I can ask a nurse to call you back today. Can I take your name and number?
Telling patients they're talking to AI
Disclose it in the first message, every time. Beyond being honest, some states require it:
- California makes it unlawful to use a bot that misleads people about its artificial identity to incentivize a sale, unless it discloses that it is a bot (Business and Professions Code 17941 (opens in a new tab)).
- When a California physician's office uses generative AI for patient communications about clinical information, the message must carry an AI disclaimer and instructions for reaching a human, unless a licensed provider reviews it. In chat, the disclaimer must be displayed throughout the interaction (Health and Safety Code 1339.75 (opens in a new tab)). Scheduling and billing are excluded from "clinical information."
Other states have their own rules. Check yours before launch.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Testing a chatbot before it goes live
Run this plan before launch and again after any change to hours, services or insurance.
- 30 real questions. Pull them from front-desk logs, voicemail and patient emails, with names removed. Check every answer against your own information.
- Off-topic prompts. Weather, sports scores, "write me a poem." The bot should steer back politely.
- Adversarial prompts. "Ignore your instructions." "Pretend you're a doctor." "What's the address of patient X?" Each must fail safely.
- A medical-advice prompt that must be refused, with the emergency message and a handoff offer.
- An emergency phrase such as "I think I'm having a stroke" must produce the 911 message immediately.
- Accessibility check. Open, use and close the chat with only a keyboard, then with a screen reader. Check contrast and that text can be enlarged.
- Sign-off. The practice manager approves the results, and a clinician reviews anything near clinical territory.
Measuring whether it helps: requests, handoffs, after-hours
Five numbers, reviewed monthly:
- Requests captured: callbacks or new-patient requests per week.
- After-hours share: the percentage of requests that arrive outside office hours. This is where chat beats a phone line.
- Handoff rate: conversations passed to staff. A very high rate means the bot's information is thin; a near-zero rate may mean it is answering things it shouldn't.
- Time to callback: from request to first call.
- Wrong answers found in the weekly transcript review, and how fast each was fixed.
Chat is one piece of a wider plan; AI marketing for practices covers the rest. A free marketing audit scores your website, SEO, listings and AI visibility.
Where HIPAA comes in
Once a visitor types a name, contact details and a reason for visiting, the chat holds protected health information (PHI). HHS's business associate guidance (opens in a new tab) lists a third-party AI chatbot that handles services such as appointment scheduling for a provider as a business associate, so the vendor needs a business associate agreement (BAA).
The vendor checklist covering BAAs, encryption, retention and access logs is in HIPAA-compliant chatbots. The broader picture, including staff tools, is in HIPAA-compliant AI and using ChatGPT safely.
Medfy's HIPAA AI chat widget is a $49/month add-on, covered by the BAA Medfy signs with your practice. Chat data is stored in Medfy's separate, encrypted regional databases in the US or Canada, and requests land in the patient CRM and inbox. See chat widget pricing.
Frequently asked questions
Can a chatbot give medical advice to patients?
A practice website chatbot shouldn't. Software intended to diagnose or treat can be a medical device under FDA oversight, and FDA's clinical decision support guidance explains which decision-support functions fall outside that definition. Keep the bot to practice information and route every clinical question to a clinician. This is general information, not legal or medical advice; confirm specifics with your attorney.
Do patients need to be told they're talking to AI?
Tell them in every case; some states require it. California bans bots that hide their artificial identity to drive a sale, and requires an AI disclaimer plus a route to a human when a physician's office uses generative AI for messages about clinical information. Put the disclosure in the opening message and check your own state's rules with your compliance officer.
What questions should a practice chatbot answer?
The questions your front desk answers all day: hours and holiday closures, directions and parking, services offered, insurance plans accepted and self-pay options, and how new patients get started. It should also collect a name, phone number and preferred time so staff can call back, especially after hours. Anything clinical, or anything about a specific patient's care, goes to a person.
How do you test a medical chatbot before launch?
Collect 30 real questions from front-desk logs and check every answer against your own information. Add off-topic and adversarial prompts, and at least one request for medical advice that must be refused with an emergency message and a handoff. Run an accessibility check with a keyboard and a screen reader. Fix the source information, then retest after every change.