AI Dental Assistant and Patient Data Security: What to Check Beyond HIPAA

Why Patient Data Needs Extra Care

An AI assistant that answers patient messages, books appointments or sends reminders sees names, contact details and often health information. Health data is treated as sensitive in most jurisdictions. In the United States, HHS guidance says a covered entity must have a written contract with any business associate that handles protected health information for it; our HIPAA checklist for US practices covers that in detail. In the EU, Article 9 of the GDPR prohibits processing health data by default unless a specific exception applies, such as provision of health care by someone bound by professional secrecy or explicit consent; the UK ICO applies the same idea under UK GDPR. Practices elsewhere should check their own national rules.

The Checklist

• Where is the data stored? Ask for the country and the hosting provider, and whether data crosses borders.
• Who can see it? Ask for role-based access, and whether vendor staff can read patient conversations.
• Is it used to train models? Ask in writing whether your patients' data is used to train or improve any model, and how to opt out.
• How long is it kept? Ask for a retention period and a deletion process.
• Is there an audit trail? You should be able to see what the assistant said and did, and who accessed records.
• What does the contract say? In the US, a business associate agreement is the relevant document, and HHS's sample provisions include limits on use, safeguards, breach reporting and return or destruction of data at the end. In the EU and UK, Article 28 of the GDPR requires a written processor contract covering documented instructions, security, sub-processor approval, deletion or return of data and audit rights.
• What happens on a breach? Ask how and how fast the vendor notifies you.

What the Assistant Should Not Do

A patient-facing assistant should hand off to staff for clinical questions, emergencies and anything it cannot answer confidently, rather than guessing. See our clinic guide on what AI may and may not say.

Questions for Your Vendor

Put the checklist above into a short written questionnaire and ask for answers before a pilot. A vendor that cannot answer plainly is telling you something. Zunkiree Labs' Dental AI Assistant is in private beta; if you want to discuss your practice, contact the team.

Sources

• HHS, Business Associate Contracts: sample provisions, read November 5, 2026
• HHS, Is a software vendor a business associate of a covered entity?, read November 5, 2026
• GDPR, Article 9: processing of special categories of personal data, read November 5, 2026
• GDPR, Article 28: processor, read November 5, 2026
• UK ICO, What are the rules on special category data?, read November 5, 2026

This is general information, not legal advice. Rules change, so confirm the current text with qualified counsel.