We are currently evaluating Vapi as the orchestration layer for a healthcare voice agent application. We understand there is a $1,000/month add-on for HIPAA compliance and Zero Data Retention (ZDR) on the Vapi platform. Before we commit, we need definitive clarification on how this add-on interacts with downstream model providers, specifically regarding Business Associate Agreements (BAA). We have been unable to definitively clarify from the help docs here: https://docs.vapi.ai/security-and-privacy/hipaa Could you please clarify the liability in the following two scenarios? *Scenario A: Vapi Managed Keys * If we pay the $1,000/mo HIPAA fee and use Vapi's default/managed keys for Deepgram (STT), Anthropic (LLM), and Cartesia (TTS): - Does Vapi's BAA with us cover these downstream providers as your sub-processors, and are the sub-processors required to adhere to ZDR? - Or are we still required to hold our own separate enterprise contracts/BAAs with Deepgram/Anthropic/Cartesia to ensure they do not retain PHI or violate ZDR? Scenario B: Bring Your Own Key (BYOK) If we bring our own API keys for these providers to get direct pricing: - Does the "HIPAA Enabled" toggle in the Vapi dashboard technically prevent these downstream providers from logging data on their end? - Or is the ZDR status strictly dependent on the settings/contract associated with our specific API keys? We are trying to determine if the $1,000 fee provides a "compliance wrapper" for the entire stack, or if it only covers Vapi's orchestration logs.

Our [Enterprise plan](https://vapi.ai/pricing) includes unlimited concurrency, higher rate limits, and features like hands-on support, a shared Slack channel, HIPAA BAA and SOC 2 certifications, Single Sign-On (SSO) support (Okta, Azure AD, SAML, OIDC), and Role-Based Access Control (RBAC). If this sounds like it could meet your needs, please contact our sales team via this link: . Once submitted, our sales team will reach out after reviewing your requirements!

Scenario A (Vapi Managed Keys): If you enable HIPAA compliance and use Vapi's managed keys, Vapi's BAA with you does cover downstream providers (like Deepgram, Anthropic, Cartesia) as sub-processors, provided Vapi has a signed BAA with them—no separate contracts are needed on your end. To activate this, set the following in your assistant config:

json
{
  "hipaaEnabled": true
}

This ensures Vapi does not store PHI and only uses HIPAA-compliant providers for the call pipeline. For more details, see the [Vapi HIPAA documentation](https://docs.vapi.ai/security-and-privacy/hipaa). Source: - [Vapi HIPAA Compliance Documentation](https://docs.vapi.ai/security-and-privacy/hipaa)

Thanks bots but I need a human response - no point me paying for enterprise or teh $1k HIPAA add on if it turns out i have to go through the same process for each STT / LLM / TTS downstream provider too

Hi BrendanH, To enable HIPAA compliance on Vapi's platform, configure your assistant by setting the

hipaaEnabled

property to

true

in your assistant's configuration file. This will ensure that Vapi doesn't store call logs, recordings, or transcriptions during or after your calls. Here's the JSON configuration for enabling HIPAA:

json
{
  "hipaaEnabled": true
}

Under HIPAA compliance, you can only use specific providers for models, voice, and transcription services. Here are the compatible providers: - Model Providers (LLM): OpenAI, Azure OpenAI, Anthropic, Google, Together AI - Voice Providers (TTS): Vapi, ElevenLabs, Cartesia, Rime AI, Deepgram, Azure - Transcription Providers (STT): Azure, Deepgram For more detailed information, please refer to the [HIPAA compliance documentation](https://docs.vapi.ai/security-and-privacy/hipaa). If you need further customization or specific use cases, ensure they do not involve storing any PHI to maintain compliance.

Our Sales form has been updated - please use this NEW link: https://vapi.ai/sales