HIPAA clarifications
# supportb
barelledboi
12/07/2025, 8:34 PMWanted to clarify 3 things from the docs
**1. Use HIPAA-compliant accounts with all third-party providers (STT, LLM, TTS). **Does this just means we must select the right providers (i.e. Deepgram, OpenAI, Vapi) for our assistant, right? Do you handle BAAs with those orgs? I don't want to go wrangle BAAs & update accounts with all of them.
2. Tool Calls / Integrations. How does integrating with other services work with tool calling? We might be interfacing with external providers to accomplish our work over the phone (i.e. we get a patient reference number and pull in specific data for that patient) and need to be able to execute tool calls while on the phone.
3. End of Call workflows. Our server is compliant. We need to get end of call reports w/ transcripts to understand what happened, process the data, and share it with our clients. Is that functionality still supported in a HIPAA-enabled instance?
c
Chiranjeet Mishra
12/07/2025, 8:34 PMHi there,
Thank you for your message. Our team is currently out of the office. We operate Monday through Friday, from 9:00 AM to 8:00 PM Pacific Standard Time (PST).
We’ll get back to you as soon as possible during our normal business hours.
If your message is urgent, please mark it accordingly or include “URGENT” in the subject line, and we’ll do our best to respond promptly.
Warm regards,
Vapi
Customer Support Team
Chiranjeet Mishra
12/09/2025, 5:07 PMHi barelledboi,
1. **HIPAA-compliant providers**: You're correct; you need to select the right HIPAA-compliant providers (e.g., Deepgram, OpenAI, Vapi). Vapi handles the necessary BAAs with these organizations, so you don't need to set up separate agreements.
2. **Tool Calls / Integrations**: For integrating with external services during tool calls, you can build tools in your Vapi dashboard that call external APIs. Ensure that these external services are HIPAA-compliant as you transmit any PHI.
3. **End of Call workflows**: When HIPAA is enabled, Vapi doesn't store transcripts or recordings. However, an end-of-call report message is generated and stored on your server, ensuring compliance. You'll need to handle transcripts and any additional data processing using your HIPAA-compliant storage solutions.
For more details on enabling HIPAA compliance, refer to Vapi's [HIPAA documentation](https://docs.vapi.ai/security-and-privacy/hipaa).
a
Armando J.
12/15/2025, 9:29 PMHello Aditya! So we basically need to use the end of call workflow to send the transcripts over to our infrastructure and process them there? (Instead of providing custom keys for services)
Also, can the end of call report send the recording as well? Or only the transcripts? Thanks!