We operate our own software platform that is used by multiple healthcare clinics. As an agency, we’re currently working to implement AI Voice-Agent capabilities for these clinics, and VAPI is one of the platforms we’re integrating on the backend. Our clients (clinics) only interact with our platform directly—they do not engage with or manage any third-party services we use, including VAPI. We plan to enable HIPAA compliance at the main account level and/or per assistant, depending on the setup. I wanted to confirm how the Business Associate Agreement (BAA) should work in this agency model to ensure proper HIPAA coverage. Here’s our current understanding: VAPI acts as a Business Associate (BA) to our company (the agency). Our company then acts as a BA to our healthcare clients (the Covered Entities under HIPAA). We pay a single HIPAA enablement fee to VAPI, which—based on our understanding—would cover all sub-accounts (assistants) under our agency account. Question: Would this structure—one BAA between VAPI and our company, and a separate BAA between our company and each clinic—be sufficient to meet HIPAA requirements? We’d appreciate your confirmation on this or any guidance you can provide from your legal/compliance team.

Hi np, To integrate VAPI into your platform for healthcare clinics, ensuring HIPAA compliance is critical. You can enable HIPAA compliance at both the main account level and the assistant level. Here’s how to proceed: 1. Enable HIPAA Compliance: - At the organization level, set

hipaaEnabled

to

true

in your assistant's configuration:

json
     {
       "hipaaEnabled": true
     }

- This prevents VAPI from storing call logs, recordings, or transcriptions. 2. BAA Requirements: - You need to sign a Business Associate Agreement (BAA) with VAPI. This is essential to formally align your use with HIPAA requirements. - Contact our security team at [security@vapi.ai](security@vapi.ai) to initiate the BAA process. 3. Using HIPAA-compliant Providers: - Ensure you use HIPAA-compliant third-party providers (like OpenAI, Azure) for STT, LLM, and TTS services. - Confirm that VAPI has a signed BAA with these providers to ensure full compliance. These steps will help you maintain HIPAA compliance across your platform. You can refer to the [detailed HIPAA Compliance documentation](https://docs.vapi.ai/security-and-privacy/hipaa) for more information.

Thanks! For two of our clients (small clinics) we have setup two organizations within our main VAPI accounts. I understand we initially sign a BAA with VAPI. And then the clinic will sign a BAA with our company (clinic will not need to sign BAA with VAPI). HIPAA enablement fee Question: our clinics we are trying to help setup “Appointment booking – intake Agent” but can’t afford $1K VAPI Hipaa enablement fees individually. We are managing their organization with our main account so if we pay $1K Hipaa fee, that can cover all the orgs we are managing within our main account? Below is what I found on internet…please double confirm. “Yes, Vapi.ai's HIPAA compliance fee covers all organizations within a single main account. When you purchase the $1,000 per month HIPAA add-on, it enables enterprise-wide protection for your entire Vapi account”

Hi, you can have multiple assistants under one org with HIPAA enabled for the org. But it can't cover multiple Vapi orgs.