Hey everyone! Quick question about HIPAA compliance. I'm building AI voice receptionists for dental clinics in the US, and HIPAA compliance is a hard requirement for this market (clinics handle PHI like patient names, appointment details, medical info over the phone). Does Vapi support HIPAA compliance? Specifically: Do you offer a BAA (Business Associate Agreement)? Is it available on all plans or only Enterprise? Are there any specific configurations needed (e.g. disabling call recordings/transcripts, specific LLM/TTS providers)? Thanks! 🙏

Vapi supports HIPAA compliance for voice AI in dental clinics. To enable it, set the following in your assistant or organization config:

json
{
  "hipaaEnabled": true
}

This disables call recordings/logs and restricts you to HIPAA-compliant providers. A BAA is available for $1,000/month via Billing → Add-on. For more details, see the [official HIPAA documentation](https://docs.vapi.ai/security-and-privacy/hipaa). Sources: - [Vapi HIPAA Compliance Documentation](https://docs.vapi.ai/security-and-privacy/hipaa) - [Vapi Security and Compliance Google Doc](https://docs.google.com/document/d/1X1UzOVUrma47typ4RnohwConQu9gH26iYz9wpZvDXO0/edit?usp=drivesdk)

Hi, Vapi as Business Associate: Once you enable HIPAA Mode and execute the BAA add-on, Vapi operates as a HIPAA-compliant Business Associate for the core services within the platform (TTS, STT, LLM). When

hipaaEnabled

is active, Vapi only uses HIPAA-compliant providers and does not store call logs, recordings, or transcriptions. Third-Party Services Outside BAA Scope: Integrations with services like Telnyx, Twilio, [Make.com](http://Make.com), Zoom, and EMR systems fall outside Vapi's BAA scope. These can still be integrated through Vapi, but they are not covered under Vapi's BAA. Customer Responsibility for Third-Party BAAs: It is your responsibility to: • Ensure any third-party services that process PHI are separately covered under their own BAAs • Use HIPAA-compliant accounts with external providers when providing your own keys No Technical Blocking of Integrations: Vapi does not technically block third-party integrations when HIPAA Mode is enabled. However, for the core voice pipeline (STT, LLM, TTS), only HIPAA-compliant providers may be selected. External integrations remain available, but compliance responsibilities for those services must be handled by your organization. Regarding pricing, the HIPAA add-on is $2,000/month, and there is a separate Zero Data Retention (ZDR) add-on available at $1,000/month for customers requiring stricter privacy controls. You can check in your billing section in the dashboard For additional details: [https://docs.vapi.ai/security-and-privacy/hipaa](https://docs.vapi.ai/security-and-privacy/hipaa) Let me know if you have any other questions!

@Oshi Raghav I am having the same issue: https://discord.com/channels/1211482211119796234/1498395724340138234 could you please help me

Hi MarcPP, Sorry for the delay, I am looking into it. Thank you