Hey – working on a HIPAA compliant app and need to get BAAs signed by model providers. I'm assuming I'll need API info about voices, chat & reasoning models, etc. to make those requests with supporting providers (i.e. OpenAI, Eleven Labs, DeepGram, etc.). What's the best way to go about this?

Actionable Next Step: To ensure HIPAA compliance, you should directly contact each third-party provider (e.g., OpenAI, Eleven Labs, DeepGram) and request a Business Associate Agreement (BAA) for your enterprise account. When reaching out, provide your organization details and specify your need for HIPAA-compliant usage of their APIs (voice, chat, reasoning models, etc.). Tip: Most providers have a security or compliance contact listed on their website or in their documentation—start there for the fastest response. For more on your responsibilities, see the [Vapi HIPAA documentation](https://docs.vapi.ai/security-and-privacy/hipaa). Source: - [Vapi HIPAA documentation](https://docs.vapi.ai/security-and-privacy/hipaa)

Yes, if you purchase HIPAA compliance on the billing page ($1000/month), you can still have call recordings and VAPI can store them in a HIPAA-compliant manner. However, there are specific requirements to ensure HIPAA compliance for your recordings: 1\. **Cloud Storage Requirements**: - You must provide your own HIPAA-compliant cloud storage credentials - VAPI supports several providers for HIPAA-compliant storage: - Amazon S3 - Google Cloud Storage (GCP) - Others 2\. **Configuration Steps**: 1\. Purchase the HIPAA compliance add-on in your subscription billing page ($1000/month) 2\. Set up one of the supported cloud storage providers (S3, GCP, Azure, etc.) 3\. Add your storage credentials on the Provider Credentials page in the Dashboard 4\. Make sure your assistant's

artifactPlan.recordingEnabled

is set to true 5\. Configure the

recordingPath

if you want to customize where recordings are stored 3\. **Important Notes**: - Without proper cloud storage credentials, recordings won't be stored when HIPAA compliance is enabled - You'll still receive an end-of-call report with call information - With HIPAA enabled, VAPI won't store the recordings in their own storage This approach ensures your call recordings are stored in your own HIPAA-compliant environment while still allowing you to benefit from VAPI's call recording functionality.

Cool that recordings are still possible. The bot says I MUST go to get a BAA from every provider... but this post says otherwise. Can you clarify what needs to happen? https://discord.com/channels/1211482211119796234/1391908730043633694/1399636472386158632

If you are using our approved providers, you will only need a BAA from VAPI.