Using a website chatbot in a regulated industry

Medical and dental practices, law firms, accountants and insurance agencies get the same repetitive questions as any other business: hours, location, what to bring, which insurance they accept. A website assistant can handle those. It must not give advice or collect sensitive data. This page sets out the rules we recommend for each sector.

This is general information, not legal or compliance advice. Your profession's regulator and your own counsel have the final word.

The common rule: administrative questions only

Split every question into two kinds:

• Administrative: hours, location, parking, services offered, which plans or carriers you work with, how to book, what to bring, fees you publish, forms. The assistant can answer these from your approved knowledge.
• Professional: anything that depends on the person's own situation. Symptoms, a legal problem, a tax position, whether a loss is covered. The assistant declines and offers to pass the request to a qualified person.

Then add a rule for data: the assistant should never ask for sensitive personal details, and if a visitor offers them, it should tell them not to share them in the chat.

What Allinaa does and doesn't claim

Allinaa makes no HIPAA compliance claim. Allinaa has no SOC 2 report and no ISO 27001 certificate. If your practice needs a business associate agreement or a specific security attestation, ask us before you start, and don't assume one exists. What Allinaa does provide: consent before an inquiry is saved, separation of each business's data, file uploads on Premium checked for malware and stored privately, and conversation and inquiry records you control.

Healthcare: no medical advice, no health details

Medical, dental, veterinary, therapy and chiropractic practices.

• Can answer: hours, location, services, accepted insurance, new-patient process, what to bring, cancellation policy, published self-pay prices.
• Must decline: symptoms, diagnoses, medication questions, whether to come in, test results.
• Emergency wording: "If this is a medical emergency, call 911 now."
• Don't collect: health details, insurance member numbers, dates of birth. A name and a contact method are enough for the front desk to call back.

Health privacy rules in the US are explained by the Department of Health and Human Services on its HIPAA pages. Read them with your compliance advisor before you decide what the chat may collect. Specific guidance for practices is on the medical practices page.

Legal: no legal advice, no attorney-client relationship

• Can answer: practice areas, office hours, consultation process, published consultation fees, languages spoken.
• Must decline: whether someone has a case, deadlines for their matter, what they should do.
• Say clearly: "Chatting here doesn't create an attorney-client relationship. Please don't share confidential details here."
• Conflicts: collect only what the firm needs to run a conflict check before a lawyer gets involved.

Lawyer advertising and client communication rules are set by each state bar, with the ABA Model Rules of Professional Conduct as the common reference. See also the law firms page.

Tax and finance: no advice, no account numbers

• Can answer: services, filing-season hours, document checklists, how to book, published fees.
• Must decline: what to deduct, how to file, investment or credit questions.
• Don't collect: Social Security numbers, bank or card numbers, copies of tax documents in chat.

More for firms is on the accounting firms page.

Insurance: no coverage confirmations

• Can answer: lines of insurance you write, carriers you work with, office hours, how to report a claim, what information a quote needs.
• Must decline: whether a loss is covered, binding or changing coverage, premiums for a specific person.
• Say clearly: "Coverage can only be confirmed by a licensed agent. I can pass your request to one."

Writing your "do not answer" list

Put the declines into the assistant's knowledge in plain words, with the reply you want. For example:

Then test it: ask the assistant ten professional questions in different words and make sure each one is declined. The guide on writing chatbot knowledge covers the rest of the text.

Check your own regulator's rules

Rules depend on your state, your license and your clients. Before launch, check what your licensing board, state bar or insurance department says about advertising, client communication and record keeping. If anything in this page conflicts with their rules, theirs win. Also read chatbot privacy basics.

Frequently asked questions

Can I use the chat for patient health information?

No. Allinaa makes no HIPAA compliance claim. Use the assistant for administrative questions only and do not collect health details in the chat.

Can the assistant tell a patient whether to come in?

No. It should decline and offer a call back, and give emergency instructions where relevant.

Can a law firm use the chat for intake?

For basic contact details and the area of law, yes. It should say that chatting does not create an attorney-client relationship.