Hi Vapi team 👋, I’m exploring Vapi for use in a healthcare/legal context where HIPAA compliance is required. Could you clarify: Do you offer a HIPAA Business Associate Agreement (BAA)? If so, what additional requirements must be met to enable HIPAA mode? (e.g., disabling logs, limiting storage, data handling configs, etc.) Is there an extra cost for HIPAA compliance, and if yes, how is that priced (flat monthly fee, per-assistant, account-wide, etc.)? Thanks in advance — this is a key factor for us in evaluating whether to use Vapi in production.

To enable HIPAA compliance in Vapi, set the

hipaaEnabled

flag at the organization or assistant level. Here’s a sample configuration:

json
{
  "compliancePlan": {
    "hipaaEnabled": true
  }
}

Ensure PHI only passes through the

/call

endpoint and is not stored in configuration. For more details or to discuss a BAA, contact security@vapi.ai. Note: Pricing and BAA signing details are not specified in the documentation I have found. Source: - [Vapi HIPAA Compliance Documentation](https://docs.vapi.ai/security-and-privacy/hipaa)

Yes, if you purchase HIPAA compliance on the billing page ($1000/month), you can still have call recordings and VAPI can store them in a HIPAA-compliant manner. However, there are specific requirements to ensure HIPAA compliance for your recordings: 1\. **Cloud Storage Requirements**: - You must provide your own HIPAA-compliant cloud storage credentials - VAPI supports several providers for HIPAA-compliant storage: - Amazon S3 - Google Cloud Storage (GCP) - Others 2\. **Configuration Steps**: 1\. Purchase the HIPAA compliance add-on in your subscription billing page ($1000/month) 2\. Set up one of the supported cloud storage providers (S3, GCP, Azure, etc.) 3\. Add your storage credentials on the Provider Credentials page in the Dashboard 4\. Make sure your assistant's

artifactPlan.recordingEnabled

is set to true 5\. Configure the

recordingPath

if you want to customize where recordings are stored 3\. **Important Notes**: - Without proper cloud storage credentials, recordings won't be stored when HIPAA compliance is enabled - You'll still receive an end-of-call report with call information - With HIPAA enabled, VAPI won't store the recordings in their own storage This approach ensures your call recordings are stored in your own HIPAA-compliant environment while still allowing you to benefit from VAPI's call recording functionality.