Hey,
this is actually a telephony infrastructure limitation rather than a Vapi-specific one. To place an outbound call, the carrier (Twilio) needs the destination number to dial it. There's no way to route a call without the carrier knowing the number.
The good news is Twilio is a HIPAA eligible service and supports BAAs. So the recommended path is:
1. Sign a BAA with Twilio directly
2. Enable hipaaEnabled: true at the org level in Vapi
3. Use your own Twilio credentials in Vapi so data flows under your BAA
This way the phone number is handled by Twilio under your own HIPAA agreement rather than Vapi's infrastructure.
Here's Vapi's HIPAA guide for reference:
https://docs.vapi.ai/security-and-privacy/hipaa