What Is a Medical Virtual Receptionist? A 2026 Guide for US Practices

A medical virtual receptionist is any off site service, human or AI, that answers patient calls and handles routine front desk work. The case for one is arithmetic: AgentZap's phone statistics roundup, which cites MGMA DataDive 2025, puts a primary care physician at about 53 inbound calls a day, concentrated in the first and last hours of the office day, and Curogram estimates an independent practice can lose around $150,000 a year to no shows, at roughly $200 or more per missed visit. Voicemail is a large part of how that happens.

As of October 2026, an AI receptionist handling 1,000 minutes a month costs about $114 to $179 when I build it on Retell with a BAA, and about $2,090 or more on Vapi, because its HIPAA add on is $2,000 a month. One full time front desk hire at the $18.27 median hourly wage that the Bureau of Labor Statistics reports for receptionists costs about $4,524 a month once benefits are loaded in. HIPAA does not prohibit any of this: it requires a business associate agreement (BAA) with any vendor that handles patient information for you, security safeguards chosen through a risk analysis (HHS treats encryption as addressable, not mandatory), and a breach notification process. Integration is the real timeline risk, not compliance. ASTP/ONC data shows 70% of hospitals let patients reach their records through FHIR based apps in 2024, and Epic lists its appointment find and book operations in its STU3 specification, and genuine bidirectional Epic integration still takes 10 to 14 weeks by my planning estimate. Use AI for routine repetitive volume, and keep humans on complex care navigation and any practice without an EHR API.

If you run a medical practice in the US, the front desk is probably your most expensive bottleneck. Phones ring at 8 a.m. on a Monday. A patient calls to reschedule, another wants a refill confirmation, a third has a question about an MRI prep. Your receptionist is on a call, the answering machine is full, and the no-show rate is creeping toward 15%. This is exactly the moment most practice managers I work with start Googling "medical virtual receptionist" and quickly fall into a tab explosion of HIPAA disclaimers and pricing pages that all start at "Contact Sales".

I deploy AI receptionists for healthcare practices across the US. I've shipped 126 production AI systems, and a meaningful chunk of those run inside primary care, dental, dermatology, and physical therapy clinics. This guide explains what a medical virtual receptionist actually is in 2026, how the AI version differs from a traditional answering service, what HIPAA and BAA realities look like in practice, and a clear decision framework for whether your practice should adopt one. No sales pitch.

What is a medical virtual receptionist?

A medical virtual receptionist is a service that handles front-desk work for a healthcare practice without sitting at the front desk. If you want the version of this question that is not specific to healthcare, I wrote a plain explainer on what a virtual receptionist is for a small business. Two flavors exist:

• Human virtual receptionist services. A remote person, usually employed by a third-party answering service, picks up calls under your practice's name. Examples include Ruby, AnswerConnect, and PatientCalls. They handle live transfers, message taking, and basic scheduling through a shared portal.
• AI medical receptionist (voice agent). A software agent answers the call directly. It transcribes patient speech, runs through a structured workflow, looks up your schedule in your EHR or practice management system, books or reschedules the visit, and writes a structured note back to your charts. No human sits in the loop unless the call needs to escalate.

The category is older than people think. Telephone answering services have served physicians since the 1950s. What changed in 2024 and 2025 was the cost and quality of speech-to-text plus large language models. By the time we hit 2026, the AI version finally crossed the line where most patients on a routine call cannot tell they are not talking to a person, and the cost dropped below the breakeven point against a part-time hire.

How do AI medical receptionists actually work?

When a patient calls your practice and you have an AI receptionist set up, the flow looks like this. I'm describing what happens in production deployments I've configured:

1. The call hits your phone system. Most practices keep their existing number through Twilio, RingCentral, or a SIP trunk into the AI vendor.
2. The AI greets the patient: "Thanks for calling Mountain View Family Medicine, how can I help?". The greeting voice is cloned or pre-built, and the patient hears it within about 600 milliseconds, which is the latency threshold that stops people from feeling like they're on a robot call.
3. Speech-to-text (usually Deepgram Nova or AssemblyAI) transcribes the patient. The agent classifies intent: scheduling, refill, billing, clinical question, or other.
4. For scheduling, the agent calls into your EHR's API. If you're on Athenahealth, that means hitting /v1/appointments/open to find slots. On Epic, slot search and booking are the $find and $book operations on the STU3 Appointment resource, while the R4 Appointment resource is Read and Search only.
5. The agent reads back availability, confirms the appointment, and writes the booking into your schedule along with a structured note ("Patient called 5/6 to schedule annual physical, prefers afternoon, has Aetna PPO").
6. If the call is anything the agent does not handle, it escalates. Either it transfers live to your front desk, or it takes a structured message and texts the on-call provider.

The piece that separates a real medical AI receptionist from a generic one is the EHR connection. A receptionist that can hear the patient but cannot book the appointment is a $200/month answering machine.

What jobs can a medical virtual receptionist actually handle?

This is where most practice managers get oversold. A vendor demo will show you the AI doing 14 different things flawlessly. In production, you usually get four or five jobs done very well, and that is enough to justify the deployment.

Here is what I see consistently work in real practices:

The realistic ceiling for AI handling without escalation is about 70 to 80% of inbound call volume in a primary care or specialty office. The remaining 20% to 30% needs a human, and that is fine. Your front desk goes from "drowning" to "handling the calls that actually need a human".

When is a medical virtual receptionist right for your practice?

Not every practice should run out and buy one. Here is how I size a clinic for it on a discovery call:

• You have at least one full-time receptionist (or you should). If your call volume is 10 calls a day, an AI receptionist is overkill. The math works once you cross roughly 30 calls per day, which is about 660 calls a month, or 660 to 2,000 minutes of answered call time at one to three minutes a call.
• Your no-show rate is over 8%. Curogram's 2025 guide puts the national average at 5% to 8%, with primary care studies reaching 18% to 20% and some specialties past 30%. If you are above 8%, the proactive outbound reminder calls alone usually pay for the system. I have seen no-show rates drop from 14% to 6% in 60 days.
• You miss calls outside business hours. AgentZap's roundup, citing Talkdesk, puts the average medical practice at 23% of incoming calls missed, with solo practices above 30%. An AI receptionist answers those calls and books visits the patient would have otherwise looked elsewhere for.
• You use a modern EHR. Epic, Athenahealth, eClinicalWorks, NextGen, DrChrono, Practice Fusion, Kareo, AdvancedMD all have appointment APIs in 2026. If your EHR does not, you cannot do real scheduling automation, only call answering.
• Your front-desk turnover is high. If you are losing receptionists every 9 months, the cost of hiring, training, and the gaps in between often dwarf the cost of the AI plus a smaller front-desk team.
• You have a clear escalation policy. AI receptionists fail gracefully when there is a defined human fallback. If your practice is "everyone is on a call all day, nobody can pick up", the AI cannot escalate to anyone, and patients hate that.

When is a medical virtual receptionist NOT right for your practice?

I'd rather lose a sale than watch a practice deploy an AI receptionist that should not exist. These are the situations where I tell people not to do it:

• You do not have an EHR with an API. Some legacy practices still run paper-and-Outlook scheduling, or EHRs without exposed APIs. Without the integration, the AI is glorified voicemail. Skip it.
• Your patient base is uncomfortable with technology. Geriatric-heavy practices and concierge medicine practices are usually a hard no. The expectation is "call my doctor's office and a person picks up". An AI breaks that expectation, and you will get complaints.
• Most of your inbound is clinical. If 60% of your calls are nurse triage, OB pregnancy questions, or oncology follow-up, the AI cannot help. You need a clinical contact center, not a receptionist.
• You want to avoid ongoing operational work. An AI receptionist is not "set and forget". You will review call transcripts weekly for the first 90 days, tune the prompt, add FAQs, and fix edge cases. Practices that want zero ongoing involvement should hire a virtual receptionist service instead.
• Your call volume is genuinely tiny. Under 200 calls a month, the math does not work. A part time hire or a low priced plan is cheaper and simpler. Dialzara lists AI plans from $29 a month for 60 minutes and Goodcall lists plans from $79 a month, but neither pricing page mentions a BAA, so ask before patient calls go near either one.
• You operate in a state with strict consent laws and your vendor has not handled it. About a dozen states require every party's consent to record a call, and counts differ by source. If your vendor cannot show you how its recording disclosure works for callers in those states, the legal risk is real.

How much does a medical virtual receptionist cost?

Pricing is the topic where vendors most deliberately confuse buyers, so let me lay it out cleanly. There are four published pricing models, and the table lists the vendors I checked for each, with prices taken from each vendor's own published pricing on October 11, 2026 (AnswerConnect's come from its price sheet PDF dated September 2025, which I could not match to its live page). The last column matters as much as the price, because a receptionist service that will not sign a BAA cannot take patient calls.

A note on the per minute pricing: the headline rates platforms quote are orchestration only. Vapi's hosting fee is $0.05 per minute, and its own 1,000 minute estimate is $82 to $129 once Deepgram transcription ($0.0095 to $0.0099 per minute), the language model ($0.0077 to $0.0452) and an ElevenLabs voice ($0.0146 to $0.0238) are added, before telephony. Retell prices voice infrastructure at $0.055 per minute, its own voices at $0.015 (ElevenLabs Flash at $0.04), and language models priced from $0.024 per minute for GPT 5.4 mini up to $0.064 for Claude 5.5 Sonnet. Twilio charges $0.0085 per minute for inbound calls to a local number plus $1.15 a month for the number, and $0.014 per minute is its outbound rate. Deepgram lists its Nova 3 streaming model at a regular $0.0077 per minute on pay as you go, with a promotional $0.0048 showing when I checked. Retell's blog puts PII redaction at about a penny a minute, which I include for healthcare calls. Here is what that adds up to at three call volumes, computed in a script from those published rates:

For Retell, the low end uses GPT 5.4 mini with Retell's own voice, and the high end uses Claude 5.5 Sonnet with ElevenLabs Flash. For Vapi, the range is Vapi's own estimate plus Twilio inbound at $0.008 per minute. Neither includes the one time work of connecting your scheduling system and tuning the prompt.

To put it against a human cost: the Bureau of Labor Statistics reports a median hourly wage of $18.27 for receptionists in May 2025, which is $38,010 a year, and $19.00 an hour in healthcare and social assistance. BLS employer cost data for June 2026 shows wages are 70.0% of total compensation cost in private industry, so $18.27 an hour loaded for benefits is about $54,300 a year, or $4,524 per month for one full time employee. At the healthcare median of $19.00 it is about $4,705 a month. At 1,500 minutes, the Retell setup above runs 3.7% to 5.9% of one loaded receptionist. The comparison is not like for like, because the AI hands the calls it cannot take back to a person, so the honest framing is how many front desk hours it frees, not whether it replaces a salary. You can run your own numbers in the AI versus human employee cost calculator, and I compare the two service types in AI answering service versus human answering service. If you are weighing options outside the United States, the Canadian cost guide uses the same method with CAD prices.

What does HIPAA actually require for a medical virtual receptionist?

This is the section most articles get wrong, so I want to be precise. HIPAA does not "ban AI". It requires that any vendor handling Protected Health Information on behalf of your practice qualifies as a business associate, signs a Business Associate Agreement, and meets the technical safeguards in 45 CFR §164. The regulation text sits on eCFR: the business associate definition, and the rules for disclosures to business associates and the contract itself. HHS also publishes business associate guidance, which lists vendors that create, receive, maintain or transmit protected health information for a practice, such as a transcription vendor or a patient messaging app, as business associates. That list does not name answering services, but the regulation turns on whether the vendor creates, receives, maintains or transmits protected health information on your behalf. A service that hears patient names and reasons for calling does, and I treat any receptionist service the same way, human or AI.

The minimum bar for a HIPAA compliant AI medical receptionist as of October 2026:

• A signed BAA before any patient audio reaches the vendor. The Privacy Rule lets a practice disclose protected health information to a business associate only with satisfactory assurance that it will safeguard the information, and the BAA is that assurance. A generic software contract that predates AI may say nothing about model training, prompt and transcript logging, or audio retention, so ask for a BAA that states your audio and transcripts are not used for model training. Also ask which subprocessors hear the audio (the speech to text, language model and voice providers), because a business associate that passes protected information to a subcontractor must get the same assurances from it. Vendors differ widely here: Ruby signs a BAA at no extra charge, Vapi includes one in its $2,000 a month HIPAA add on, and Smith.ai says it is not HIPAA compliant at all.
• Encryption, decided through a risk analysis. The Security Rule makes encryption an addressable specification, not a mandatory one (45 CFR 164.312(a)(2)(iv) and (e)(2)(ii), and HHS's FAQ on it). You implement it if the risk analysis finds it reasonable and appropriate, or document why not and use an equivalent measure. No sensible voice vendor skips it, and I ask for encryption at rest and in transit in writing. The rule names no cipher, so ask which algorithms and protocol versions the vendor uses. A January 2025 proposed rule would make encryption mandatory, and Fierce Healthcare reported in July 2026 that final action was pushed back to July 2027, so the current rule still applies.
• Audit controls. The Security Rule requires mechanisms that record and examine activity in systems that contain electronic protected health information (45 CFR 164.312(b)). I log every call, every API call into your EHR and every escalation, with timestamps and actor identity. The 6 year retention period in 45 CFR 164.316(b)(2) applies to the documentation the Security Rule requires you to keep, such as policies and risk analyses. I did not find a log retention number in the rule, so set one in the BAA and in your own policy and ask your counsel what applies.
• Access controls and minimum necessary. Unique user identification is a required specification (45 CFR 164.312(a)(2)(i)), and the minimum necessary standard asks a practice to limit who sees protected health information and how much. Role based access for staff who review transcripts follows from that. The AI vendor's engineers should not casually browse your patient calls.
• Breach notification process. A business associate must notify the practice without unreasonable delay and no later than 60 calendar days after discovery (45 CFR 164.410(b)), and the practice's own notice to individuals has the same outer limit (45 CFR 164.404(b)). Sixty days is a ceiling, not a target. Ask the BAA to require a faster notice, and check your state's breach law, which can set a shorter clock.
• Recording consent. HIPAA does not set a call recording consent rule. A recording of a patient call is generally protected health information, like any other record, because HHS's definition of health information covers information "oral or recorded in any form or medium", and the consent question comes from wiretap law. Federal law needs only one party's consent (18 U.S.C. 2511(2)(d)), but some states need everyone's. Maryland's wiretap statute lets a participant record a call lawfully where all of the parties have given prior consent (Courts and Judicial Proceedings 10-402), and Montana's section 45-8-213 covers recording a conversation without the knowledge of all parties. Counts vary by source: one law firm lists twelve all party states (California, Connecticut, Florida, Illinois, Maryland, Massachusetts, Michigan, Montana, Nevada, New Hampshire, Pennsylvania and Washington). I read the statute text for Maryland and Montana only, so treat the rest of that list as a starting point. The practical rule is to play a recording disclosure at the start of every call, whatever state the caller is in.

On enforcement, OCR publishes its resolution agreements, and many of the 2025 and 2026 entries are titled as ransomware or Security Rule investigations, such as the settlement with Syracuse ASC on July 23, 2025 and the one with BST & Co. CPAs, LLP on August 18, 2025, which involved a business associate. None of the entry titles mentions artificial intelligence. A figure circulating in vendor blogs, that 17 practices were fined $2.1 million in 2025 for AI documentation gaps, does not appear in that list and I could not trace it to OCR, so I removed it from this post. The paperwork lesson still holds: keep a copy of each vendor's BAA and a current risk analysis, which is a required specification under 45 CFR 164.308(a)(1)(ii)(A). That is a paperwork problem, not a technology problem, and it is fixable.

What are the requirements for a virtual receptionist that schedules medical and legal appointments?

This is the question behind a lot of searches, and the honest answer is that the two professions share a problem and have different rule books. A receptionist who books an appointment hears who the patient or client is and why they are calling, and that is confidential information in both. Medical practices in the United States answer to HIPAA, which is federal and has specific contract and safeguard requirements. Law firms answer to their state bar's conduct rules, which are usually modeled on the ABA Model Rules, so the detail depends on the state. The table keeps to rules I could read at the source, and I have left out anything I could only find in vendor marketing. This is a summary of public rules, not legal advice, so check the details with your own counsel.

Appointment scheduling adds one practical requirement on top of the rules: the receptionist has to reach your calendar. For a medical practice that means the EHR or practice management system, and for a law firm it usually means the firm's calendar and intake tools. A receptionist that cannot write to either one can answer the phone and take a message but cannot book anything, which is the difference between an answering service and a scheduling service. If you do not have an EHR with an API, a human service or an AI receptionist that takes structured messages for your staff to book is the realistic version.

For law firms I covered the rules and the tools in best virtual receptionist for law firms in Australia, which is Australian in its pricing and privacy rules. If your practice is Australian, virtual receptionist for a medical practice in Australia covers the Australian version of this question, with prices in AUD and the RACGP criteria instead of HIPAA. This guide stays with the American medical rules.

A real client deployment: dermatology practice in Phoenix

One of the cleanest deployments I shipped was for a dermatology practice in Phoenix, Arizona. Single doctor, two PAs, around 4,000 active patients, running on Athenahealth. The practice manager called me in November because the front desk had been short two people for three months, and patient complaints about voicemail were piling up on Yelp. Here is what we built and what it returned, redacted but real.

The starting state:

• Inbound call volume: ~1,800/month
• Calls answered live: 62%
• No-show rate: 11.4%
• After-hours voicemails returned within 24 hours: 38%
• Front desk staff time on phones: ~6 hours/day combined
• Existing tools: Athenahealth, RingCentral, no scheduling SMS reminders

The deployment:

• AI voice agent on Vapi with a custom-trained system prompt covering 47 dermatology FAQs (Mohs prep, biopsy results, cosmetic vs medical visit triage, insurance accepted)
• Athenahealth integration via the public API for slot lookup, booking, and rescheduling
• Outbound 48-hour reminder calls with confirm/reschedule/cancel options
• Live transfer to a designated front-desk extension when intent was billing dispute, clinical question, or anything unclear
• Full HIPAA stack: signed BAA, AES-256 encryption, all-party consent recording prompt, audit log export to S3

The results 90 days in:

• Calls answered live (or by AI without voicemail): 97%
• No-show rate: 5.8% (was 11.4%)
• After-hours bookings captured: 84 new visits in month 3 alone
• Front desk time on phones: ~2 hours/day combined, repurposed to in-person check-in, prior auths, and patient pre-visit education
• Cost: $412/month (Vapi orchestration + Deepgram + ElevenLabs + Twilio) plus a one-time $2,400 build and integration fee
• Payback: month 2

The practice manager's quote that I think captures the actual value: "We didn't fire anyone. We just stopped feeling like we were drowning every Monday morning."

A pricing note as of October 2026: Vapi's current price sheet lists its HIPAA add on, which includes its BAA, at $2,000 a month, so check how the BAA is priced before you copy a stack like the one above. The cost section earlier shows the monthly totals with and without it.

How do you evaluate a medical virtual receptionist vendor?

If you decide an AI medical receptionist is the right move, here is the short evaluation framework I give clients before they commit. Read it as a checklist for the demo call:

1. Ask for the BAA template before the demo. Read it. If they refuse to send one without a signed NDA, walk away. Real vendors publish redacted BAAs.
2. Ask which EHR APIs they integrate natively. "We can integrate with anything" is a red flag. The right answer is a specific list with named endpoints. If they have not done your EHR before, the project will take 4 to 8 weeks longer.
3. Ask for the all-in per-minute cost. Force them to break out orchestration, STT, LLM, TTS, and telephony. If they cannot, they do not understand their own cost stack.
4. Listen to a real call recording from a similar practice. Not a demo script. A real, unscripted patient call. Vendors who cannot produce one have not actually run production volume.
5. Ask about escalation latency. When the AI hands off to a human, how many seconds does the patient wait? Anything over 4 seconds feels broken. Good vendors land at 1.5 to 2.5 seconds.
6. Ask who owns the call data. You should. The vendor should be a data processor, not a data owner. Ask for export terms in writing.
7. Pilot for 30 days, single workflow. Do not start with the full scope. Start with FAQ deflection and one scheduling workflow. Scale from there.

Frequently asked questions

Is a medical virtual receptionist HIPAA compliant?

It can be, but compliance is the vendor's responsibility plus yours. The vendor must sign a Business Associate Agreement, address encryption through its risk analysis (it is an addressable specification, so most vendors encrypt at rest and in transit), keep audit controls, and have a documented breach process. Your practice should keep a copy of the BAA, configure access controls, and review the vendor's compliance documentation on a schedule you set. Giving an AI receptionist patient information without a signed BAA is a HIPAA problem for your practice (45 CFR 164.502(e)), however secure the technology is.

Can a medical virtual receptionist book appointments in Epic?

Yes, through Epic's FHIR APIs, with a version caveat. Epic's Epic on FHIR page lists $find on the Appointment resource for slot search and $book for confirming the booking in its STU3 specification (checked October 11, 2026), while the R4 Appointment resources it lists support Read and Search only. Third party apps connect through Epic's Showroom program or a connector built on it. My planning estimate for a real bidirectional Epic integration is 10 to 14 weeks, and 4 to 6 weeks for a read only one. Your actual timeline depends on your Epic build.

How much does an AI medical receptionist cost compared to a human?

For a small practice handling around 1,500 minutes per month, usage on Retell with a BAA and PII redaction runs $170 to $267 a month, and on Vapi about $2,135 to $2,206 once its $2,000 HIPAA add on is included (prices checked October 11, 2026). One full time receptionist at the BLS median wage of $18.27 an hour costs about $4,524 a month with benefits loaded in. The AI handles 70 to 80% of inbound call volume without escalation. Most practices keep at least one human on staff to handle escalations and in person check in.

What happens when a patient asks the AI a clinical question?

The agent should escalate immediately. A well-built medical receptionist has guardrails that detect clinical intent (symptom, dosage, concerning side effect) and route the call to a clinician or take a structured message. Any vendor whose AI tries to answer clinical questions itself is creating malpractice exposure for your practice.

Can a medical virtual receptionist reduce no-shows?

Yes, primarily through proactive outbound reminder calls 24 to 48 hours before the visit, with confirm, reschedule, and cancel options. Curogram puts the national no show rate at 5% to 8%, with some specialties far higher. In the dermatology deployment above the rate fell from 11.4% to 5.8% in 90 days. The financial impact is significant since Curogram estimates each missed appointment costs a physician roughly $200 or more in lost revenue.

What is the difference between an AI medical receptionist and a virtual answering service?

A traditional virtual answering service uses remote human agents. They answer the phone under your practice's name, take messages, and sometimes book appointments through a portal. An AI medical receptionist is software that handles the call directly, integrates with your EHR for live scheduling, and escalates to a human only when needed. Cost, scalability, and EHR integration depth are the main practical differences.

Will my patients hate talking to an AI?

The honest answer is that some will, especially older patients or those with strong relationships with your front desk. In production deployments I have shipped, complaint rates run 1 to 4% of calls. Most of those are resolved by adjusting the AI's greeting to make the option to talk to a human very explicit ("press 0 anytime to reach the front desk"). The 95% who do not complain often prefer the AI because they get answers faster and at any hour.

How long does it take to deploy a medical virtual receptionist?

For a single-EHR, single-workflow deployment with a vendor that has done your EHR before, expect 4 to 6 weeks from signed contract to first live patient call. Multi-EHR or multi-location deployments run 10 to 16 weeks. The longest single piece is usually the EHR integration certification, not the AI itself.

Where to go from here

If you've read this far, you probably have a sense of whether a medical virtual receptionist fits your practice. The next step depends on where you are:

• If you're not sure your practice is ready, run the AI readiness assessment. It's 12 questions and gives you a tier-graded report on what to automate first, with healthcare-specific scoring.
• If you want to compare voice agent platforms, my deeper post on AI voice agent pricing across 40+ deployments has the side-by-side cost data that vendors do not publish on their own sites.
• If you're benchmarking the cost, the AI agent cost calculator lets you run your own all-in numbers based on your actual call volume, EHR, and required HIPAA controls.
• If you want to see real implementation examples, the case studies include deployments across primary care, dental, and specialty practices.
• If you want a voice agent built for your practice, the AI agent development service page explains how I scope and build one.

Healthcare in the United States loses roughly $150 billion per year to no shows (Curogram). A solo physician practice can lose about $150,000 a year to no shows (Kyruus Health). The national average no show rate runs 5% to 8%, with some specialties far higher (Curogram no show guide). Primary care physicians take about 53 inbound patient calls per day, a figure AgentZap attributes to MGMA DataDive 2025 (AgentZap medical phone stats). The median receptionist wage is $18.27 an hour as of May 2025, and $19.00 in healthcare and social assistance (Bureau of Labor Statistics). Wages were 70.0% of private industry employer compensation costs in June 2026 (BLS Employer Costs for Employee Compensation). In 2024, 70% of hospitals let patients access records through FHIR based apps (ASTP/ONC Data Brief 79). Epic lists Appointment find and book in its STU3 specification and Read and Search in R4 (Epic on FHIR). HIPAA requirements are from the regulation text on eCFR and HHS guidance. MGMA no show fee data from MGMA Stat.