Yes. Any company that answers your clinic's phone handles patient information, and it should be insured for the day something goes wrong. Ask for technology errors and omissions (E&O) insurance that includes privacy and network security liability, plus cyber insurance, from a licensed insurer, and ask to see the certificate before a single real patient reaches the service.
Why insurance matters more for AI reception than for most software
A booking widget sees a name and a time. An AI receptionist hears whatever the caller says: why they're calling, sometimes a symptom, sometimes a worry about a treatment. It keeps a transcript so your team can follow up. That makes the vendor a holder of personal health information, with the same kind of exposure a clinic has if information is lost, stolen or misdirected.
Many AI receptionist companies are small, recent and fast-moving. A promise of "bank-level security" is worth only what the company can stand behind. If a breach happens, someone has to pay for the investigation, the notices to patients, legal advice and any claims. Insurance is how a vendor proves it can do its share.
Under Ontario's PHIPA, your clinic stays the custodian even when an agent handles the information. You can't hand off accountability, but you can choose an agent that is insured, contractually bound and able to help you respond.
What to ask for
| Cover | What it's for | What to ask |
|---|---|---|
| Technology E&O | Claims that the vendor's service failed or made a costly mistake | Does it include privacy and network security liability? What are the limits per claim and in aggregate? |
| Privacy and network security liability | Claims arising from a breach of personal information | Is it part of the E&O policy or a separate one? Does it cover health information? |
| Cyber (first-party) | The vendor's own costs after an incident: investigation, restoration, notification support | Is it in place, and with which licensed insurer? |
| Certificate of insurance | Proof the policy exists and is current | Will you give it to us before go-live, and again on request? |
Insurance only works with a contract that means something
A policy pays for the vendor's liability, so look at what the vendor is actually liable for. Many software terms cap liability at a few months of fees, which for a small clinic could be a few hundred dollars: far below the cost of a privacy incident. Ask how the agreement treats a privacy breach. A fair agreement raises the cap for breaches of its privacy and confidentiality terms, and keeps indemnities mutual and narrow: each side covers third-party claims its own breach or its own systems caused.
Also check what comes with the policy: a breach deadline in hours, a named contact, and a written incident report. See what should be in a contract with an AI receptionist company.
Is ZeroMiss insured?
Yes. ZeroMiss is insured for the work it does for clinics, including privacy and cyber risks, with a licensed Canadian insurer, and our services agreement requires us to stay insured for as long as it's in force. Every clinic gets our certificate of insurance before any real patient reaches the service, and again whenever it asks.
The agreement backs it up: for a breach of its privacy or confidentiality terms, our liability cap is raised well above the ordinary limit, so the cover isn't just decoration.
Frequently Asked Questions
What insurance limits should a clinic ask for?
There's no legal minimum. Ask for limits stated per claim and in the aggregate, and compare them with what an incident could cost your clinic. Your own broker can tell you what your clinic's policy expects from vendors.
Does vendor insurance replace my clinic's own cyber insurance?
No. The vendor's policy responds to the vendor's liability. Your clinic is still the custodian and should keep its own cover. Many clinic insurers ask about your vendors, and a vendor with a certificate and a written breach plan makes those questions easier to answer.
Is a vendor without insurance automatically a bad choice?
Not automatically, but it shifts more risk onto your clinic. If a vendor won't carry privacy cover, weigh how much patient information it handles, how long it keeps it, and whether its contract leaves you holding the costs of an incident.
Bottom Line
An AI receptionist is a privacy decision as much as a phone decision. Ask every vendor the same three things: are you insured for privacy and cyber, at what limits, and can I see the certificate before go-live? A clear answer to all three, backed by a contract with a real breach deadline, is what separates a provider you can rely on from one you're hoping for the best with.