Hello, I’m building a voice assistant for the healthcare space using VAPI.AI and have strict HIPAA compliance requirements. I understand that VAPI.AI can sign a Business Associate Agreement (BAA) with my organization. Could you please clarify whether this BAA extends to all underlying services used within the platform—including the LLM (GPT-4i-mini-cluster), OpenAI’s TTS-1, and Deepgram for speech-to-text? Essentially, does your BAA cover the entire stack (LLM, TTS, STT), or would I need to establish individual BAAs with these third-party providers if I use them through your platform?

Hi Jawwad Memon, Yes, Vapi can sign a Business Associate Agreement (BAA) with your organization for HIPAA compliance. However, third-party tools like OpenAI’s TTS-1 and Deepgram will need separate BAAs. Please ensure those services are HIPAA compliant. You can enable the

hipaaEnabled

configuration in your assistant setup for compliance. For more details, check our [HIPAA Compliance documentation](https://docs.vapi.ai/security-and-privacy/hipaa).

Hi Sahil

Are you bringing your own API keys from deepgram and OpenAI or will you be using the default VAPI keys?

I am using default Vapi keys

Hi Jawwad Memon, Vapi can sign a Business Associate Agreement (BAA) to meet HIPAA requirements. Keep in mind that third-party services like LLMs, OpenAI's TTS, and Deepgram for STT may need their own BAAs. Make sure any external providers are HIPAA compliant. For more details, check our [HIPAA Compliance](https://docs.vapi.ai/security-and-privacy/hipaa) documentation.

Thank you Praveen for your response. Could you please confirm the following: will I need to sign BAA with OpenAI, and Deepgram even if I am using GPT and Deepgram service that Vapi.ai is offering from the platform. I am not bringing these services externally. I am only using what is currently available from the vapi.ai platform.

Hey Jawwad Memon, Kyle's actually out on an offsite right now, but he'll be able to dive into this for you on Monday, and help figure out the best approach for your setup. Regards, Shubham Bajaj Solutions Engineer

Thank you so much. I am actually piloting with an health care practice so for now I am fine but as soon as we go production I have to figure all this out. Your help is much appreciated.

Hi Jawed, To obtain a BAA, you'll need to visit the VAPI Dashboard and enable HIPAA compliance. Once HIPAA compliance is activated, we’ll send you the BAA agreement, which you can then sign via email. Please note that both BAA and HIPAA compliance are mandatory and come with a combined cost of $1,000 per month. Think of HIPAA as the implementation name for the BAA. Feel free to reach out if you have any further questions about this process.

Shubham, I understand all this but you still have not answered my question.

Hey Jawwad Memon, Thanks for reaching out! We're currently swamped with a bunch of tickets and it's taking us longer than usual to get back to everyone. I know waiting isn't fun, but we want to make sure we give your issue the attention it deserves rather than rushing through it. We'll circle back with you soon to get this sorted out.

Thank you!

Hey Jawwad Memon, Thanks for reaching out! We're currently swamped with a bunch of tickets and it's taking us longer than usual to get back to everyone. I know waiting isn't fun, but we want to make sure we give your issue the attention it deserves rather than rushing through it. We'll circle back with you soon to get this sorted out.

Ok

Hey Jawwad Memon, I wanted to let you know that we're managing a high volume of support requests at the moment, so our response time might be a bit slower than usual. I truly appreciate your understanding and will get back to you as soon as possible!  Thanks again for your patience!

Any update?

From what I could gather from the HIPAA compliance documentation, you may not need to get a BAA separately if you are only using our keys for those services. Please read the following section: Under the Business Associate Agreement (BAA), you agree: 1. Not to introduce PHI onto Vapi’s platform through its API or dashboard except as permitted 2. To use HIPAA-compliant accounts with external providers when providing keys 3. To only use HIPAA-compliant providers that Vapi has signed BAA with when not providing keys. This includes OpenAI, Azure, Google, Anthropic, Deepgram, ElevenLabs, Cartesia, and PlayHT. For updated list, check [security.vapi.ai](http://security.vapi.ai) 4. To use the platform in accordance with all BAA requirements If you agree to proceed with signing the BAA, you can head over to our security center to request the document. You can go through our security portal and read the necessary documents, which you can access through , and it will answer all your questions. Also, once you request the document, just email back with the email address and the company name through which you registered. I will approve the request for it.

Thank you

If you have any other questions, please feel free to reach out. Thanks for hanging in there through the delayed responses this past week. We really appreciate it!

If I use twilio's phone numver, would I have to sign BAA with them?

Hi Javed,  I sincerely apologize for the delays and any frustration caused. Let me clarify everything regarding BAA and HIPAA compliance, as well as your initial question: Do you need to sign a BAA with OpenAI and Deepgram if you're using our keys?  To ensure HIPAA compliance, you need to enable it as an add-on in your account or organization settings. This feature costs $1,000 per month. Once enabled, we’ll email you a BAA contract for your records.  The good news is that we have already signed BAAs with providers like Deepgram and OpenAI, so you don’t need to sign separate agreements with them. All you need to do is enable HIPAA compliance at the organization level, which will activate the add-on in your billing. After that, you’ll receive the BAA contract.  Once this process is complete, your dashboard will only display HIPAA-compliant providers (e.g., Deepgram Transcriber and OpenAI). Additionally, no call data or recordings will be stored on our servers. If you want to store call recordings, you’ll need to configure your own storage.  For webhooks that we send to your server, it’s best to store them on your server to facilitate debugging or troubleshooting any call-related issues you may encounter during production.  Let me know if you have any further questions or need additional assistance.

Thank you, this is helpful

Marking this ticket as Solved ✅

Vapi Team, I originally set up my Vapi account using my personal Gmail and created a phone number through that account. I now have a customer actively using this number, and since then I’ve established my company and a company email. Is there a way to transition my Vapi account from my personal Gmail to my company email while preserving my existing bot and phone number, so there’s no disruption for my customer? Jawwad Suleman Memon

The best way to transfer your account is by creating a VAPI account with your new company email then inviting your company email address to your current org as admin. From there, you can decide if you want to change the org ownership to your company email. Let us know if you run into any issues

With this, I would be able to keep the phone number and my bots that I have created right?

Yes, you will be able to keep your phone number and bots. And yes, invite your company email from your gmail VAPI account and add that company email as admin. You are understanding this perfectly! 🙂

Vapi team, I need a list of TTS providers with whom you have the BAA, so that I can integrate those providers in my application. Can someone please help me with this?

Hey, You can go through our security portal and read the necessary documents, which you can access through , and it will answer all your questions. Also, once you request the document, just email back with the email address and the company name through which you registered. I will approve the request for it.