When HIPAA is enabled, VAPI doesn't store call transcripts in the database for compliance reasons. Instead, you receive all call data (including transcripts) via a webhook called end-of-call-report that's sent to your server URL after every call ends
\[1\]
Set up a server endpoint that can receive POST requests
Create a webhook handler that accepts JSON data
The endpoint should handle the end-of-call-report message type
\[2\]
Open your assistant configuration in the VAPI dashboard
Find the "Server" section
Set the following fields:
Server URL:
Server Secret: your-secret-key (optional but recommended)
Timeout: 20 seconds (default)
\[3\]
In your assistant configuration, ensure end-of-call-report is included in serverMessages
\[4\]
Make a test call with HIPAA enabled
Check your webhook endpoint for the end-of-call-report
Verify you're receiving the transcript and other call data
End the call early to test that webhooks still work