Updated October 2026
The short answer: Before you let an AI assistant near your clinic's operations, ask twelve questions: what data it answers from, whether it asks before it acts, whether it can be talked into acting, what happens to patient details, where conversations are kept, what it remembers, whether it stays out of clinical decisions, how it hands off to a person, whether it admits its limits, what you can switch off, how texting works, and what each staff login can do. Good answers are specific and in writing. Below, each question with what a good answer looks like, and how Genesis, MedGrid's built-in AI assistant, answers it.
Med spas, wellness clinics and physician offices are being offered AI receptionists, booking assistants, charting tools and ordering assistants all at once. They do different jobs, but the questions that protect your practice are much the same. MedGrid makes Genesis, so we've been transparent about how it answers each one; use the same list for any product you consider.
The checklist at a glance
| Question | A good answer looks like | How Genesis answers |
|---|---|---|
| 1. What data does it answer from? | Named sources: your account, your records, published listings | Your own MedGrid account and the product listings |
| 2. Does it ask before it acts? | A confirmation step for every action, with a time limit | Prepares; you confirm within five minutes; rechecked on confirm |
| 3. Can it be talked into acting? | Acts only on plain, present requests | Negations, conditions and "later" prepare nothing |
| 4. What happens to patient details? | Kept out, or covered by a business associate agreement | Recognized patient, credential and payment details screened out |
| 5. Where are conversations kept? | Short retention, restricted and logged access | Popup: the browser tab, 30 minutes. Messages thread: deleted after 90 days by default. Text: restricted, logged access |
| 6. Does it remember what you tell it? | Only what you ask it to keep, never patient details, and a way to delete it | Where memory is on, lasting work facts only; never patients; you can tell it to forget |
| 7. Does it stay out of clinical decisions? | No doses, no treatment recommendations | Never states a dose; points to labels and education |
| 8. How does it hand off to a person? | A clear route to a human, with context | Pre-filled support ticket you confirm; by text, pings your rep |
| 9. Does it admit its limits? | Says when it can't answer, and that it can be wrong | Says what it couldn't match; reminds you it is an AI |
| 10. What can be switched off? | Features that are off until someone turns them on | Actions and newer features each sit behind a switch that starts off |
| 11. How does texting work? | Verified numbers, consent, STOP honored | Verified numbers only; read-only by text; STOP recorded |
| 12. What can each staff login do? | The same permissions as the rest of the system | A staff login's ordering switch still applies |
Data and actions
1. What data does it answer from?
An assistant that answers from your own records is a different tool from one that answers from general training data. Ask for the list of sources. Genesis answers account questions, such as orders, tracking, cart and reorders, from the signed-in user's own account, and product questions from MedGrid's listings. A practice never sees another practice's orders.
2. Does it ask before it acts?
Anything that spends money or changes a record should need a person to confirm. Genesis prepares a reorder or a hand-off to checkout and shows what it will do; the preparation expires after five minutes, and on confirm it checks again who you are, whether you may order and whether the price has changed. It never places, pays for or transmits an order itself.
3. Can it be talked into acting?
Language is slippery. "Don't reorder until it ships" contains the word "reorder". Genesis prepares an action only when the whole message is a plain, present request; wording with a negation, a condition or a later time gets guidance, and nothing is prepared. It doesn't schedule anything for later.
Privacy
4. What happens to patient details?
Under HIPAA, a vendor that creates, receives, maintains or transmits protected health information on a covered entity's behalf is a business associate, and the covered entity needs satisfactory assurance, usually a business associate agreement, before sharing PHI with it. The minimum necessary standard also applies. So ask whether the tool needs PHI at all. Genesis is built for the business side and screens out recognized patient names, birth dates, credentials and payment details before anything is acted on; MedGrid's documentation calls these guards heuristic and says they can miss things, so the house rule is still no patient details in chat. See HIPAA basics for aesthetic and wellness clinics.
5. Where are conversations kept, and who can read them?
Ask for retention periods and who can open transcripts. In the website popup, Genesis keeps the conversation in the browser tab for 30 minutes and clears it when another person signs in. Where Messages is on, your Genesis conversation is also a thread in Messages, deleted after 90 days by default; questions its privacy screen refuses and Confirm buttons are never kept there, and an admin can open a Genesis thread only with a dedicated role or full admin rights, giving a reason, with each opening logged. By text, transcripts are kept where only a specially assigned role can open them, each opening is logged, and reps, support agents and MedGrid admins without that role cannot open them.
6. Does it remember what you tell it?
Some assistants keep notes about you between conversations. Ask what is kept, who can see it and how to delete it. Where memory is switched on, Genesis remembers only lasting work facts you tell it, such as "we reorder gloves monthly", privately for you. Anything that mentions patients, diagnoses, passwords or card numbers is refused rather than saved, and you can tell it to forget.
What "HIPAA-compliant" should mean to you
The phrase appears on a lot of AI marketing. Treat it as a claim to check, not a certificate: ask for the business associate agreement if PHI is involved, where data is stored, who can access it, and what happens when you leave.
Clinical boundaries and people
7. Does it stay out of clinical decisions?
FDA's guidance on clinical decision support software, dated January 2026, explains which decision-support functions it does not treat as medical devices; an operations assistant shouldn't be drifting into that territory. Genesis never states a dose, a recommendation or an efficacy claim. For clinical questions it points to MedGrid's education and public sources, such as the FDA-approved label on DailyMed and a PubMed search, and says the provider makes the clinical decisions.
8. How does it hand off to a person?
The test of an assistant is what happens when it can't help. Genesis can start a support ticket with your question filled in, which you review and confirm. By text, asking for your rep pings the rep with who asked, not what was said, once every four hours.
9. Does it admit its limits?
Look for an assistant that says what it couldn't do rather than guessing. Amazon, for example, notes that Amazon Business Assistant may not always get things right. When Genesis can't match part of a request, such as a size or a word no product carries, it says so and labels the closest alternatives, and its clinical answers remind you it is an AI and can make mistakes.
Control
10. What can be switched off?
New capabilities should start off. Genesis's ability to prepare actions, and each of its newer features, sits behind a site switch that is off by default; with actions off, it still answers questions and points you to your cart.
11. How does texting work?
If an assistant answers texts, ask how numbers are verified, how consent is recorded and how STOP is handled. Genesis answers texts only for a number verified on exactly one account, by a code sent to that phone; STOP, START and HELP are recorded, and by text it is read-only, so no order can be prepared that way.
12. What can each staff login do?
An assistant should inherit your permissions, not bypass them. On MedGrid, the ordering switch on each staff login still applies to anything Genesis prepares, because the normal purchase checks run when it's confirmed.
Questions to ask any vendor, in writing
- Which data sources does the assistant use, and what does it keep between conversations?
- Will you sign a business associate agreement if the tool will touch PHI?
- Which actions can it take, and what confirmation does each need?
- How long are conversations kept, who can read them, and is access logged?
- How do we turn features off, and who at the vendor can see our data?
Before you buy, also read marketing a medical practice without getting in trouble if the assistant will talk to patients or send messages for you.
This article is general information, not legal advice. MedGrid publishes this guide and makes Genesis. Details of other companies' products were checked against their makers' public pages on October 18, 2026.
Frequently asked questions
Is there such a thing as a HIPAA-certified AI assistant?
Treat any compliance label as a claim to verify. What matters is whether the vendor will sign a business associate agreement when PHI is involved, and how it stores, limits and logs access to that data.
Should an AI assistant be allowed to place orders?
Only with a person confirming each one. A good assistant prepares the order, shows exactly what it will do, and rechecks price and permissions when you confirm.
Can I use an AI assistant for clinical questions?
Not a business assistant. Keep clinical decisions with clinicians and their references; FDA's clinical decision support guidance is a reminder that clinical software is a different category.
What does Genesis do with my data?
It answers from your own MedGrid account, keeps the popup conversation in your browser tab for 30 minutes and any Genesis thread in Messages for 90 days by default, restricts and logs access to text transcripts, and screens out recognized patient, credential and payment details.
Can staff misuse an assistant to order things?
Not on MedGrid without permission: anything Genesis prepares still needs confirming, and the ordering switch on each staff login still applies.
Sources
- Legal Information Institute (Cornell Law School), 45 CFR § 160.103 — Definitions (Business associate) (accessed October 18, 2026)
- Legal Information Institute (Cornell Law School), 45 CFR § 164.502 — Uses and disclosures of protected health information: general rules (accessed October 18, 2026)
- U.S. Food and Drug Administration, Clinical Decision Support Software: Guidance for Industry and Food and Drug Administration Staff (January 2026)
- Amazon Business, Amazon Business Assistant (https://business.amazon.com/en/solutions/streamlined-purchasing/ab-assistant), accessed October 18, 2026
See how Genesis works on your account: Verify your NPI and join MedGrid → Or read what an AI assistant can do for a practice's back office.
