Is Genesys Cloud AI HIPAA compliant?
Only on the right plan. Genesys signs a Business Associate Agreement with its customers on Genesys Cloud (HIPAA-enabled organization, US regions). Other plans aren't covered, so keep patient data out of them. Genesys doesn't say whether the BAA covers all of its AI features.
Does Genesys Cloud AI sign a BAA?
Only on some plans or setups
Genesys signs a BAA for HIPAA-enabled Genesys Cloud organizations hosted in its US regions, arranged through the account executive. Genesys says most features are covered, with exceptions. Its HIPAA page does not mention AI Studio, virtual agents or Copilot, and third-party bots and LLM integrations need their own BAA.
Not fully covered by the BAA: Third-party bots and LLMs (Dialogflow, Amazon Lex, third-party summarization); Voicemail transcription.
Not confirmed for the AI features: Genesys doesn’t say whether its BAA covers AI Studio, AI Guides and Genesys virtual agents. Get that in writing before using it with patient data.
- Business associate
- Genesys
- Tool
- Genesys Cloud AI
- Plans with a BAA
- Genesys Cloud (HIPAA-enabled organization, US regions)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Genesys Cloud (HIPAA-enabled organization, US regions) | Signs a BAA | Through sales | New customers ask their account executive, who opens a request with Genesys legal. Once the BAA is signed, Genesys turns on the org's HIPAA setting. HIPAA service runs only in AWS US East and US West. ACD email and SMS are excluded, and voicemail transcription is unavailable while HIPAA is on.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Genesys says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| AI Studio, AI Guides and Genesys virtual agents | Not stated | The HIPAA page says most Genesys Cloud features are compliant, with exceptions, but does not name these AI features. The AI Studio and AI Guides pages do not mention HIPAA or PHI.[1],[2],[3] |
| Third-party bots and LLMs (Dialogflow, Amazon Lex, third-party summarization) | Excluded | Third-party and AppFoundry components, including Google Dialogflow and Amazon Lex, fall outside the Genesys BAA, so the customer needs a BAA with that provider too. AI Studio summaries can use third-party LLM services through a connector.[1],[2] |
| Voicemail transcription | Excluded | Unavailable when the HIPAA setting is turned on.[1] |
AI voice agents that offer a BAA
- Bland AIBAA on: Healthcare / Enterprise deploymentsSome plans only
- Nextiva AIBAA on: Nextiva HIPAA service configurationSome plans only
- NiCE CXone MpowerBAA on: CXone tenants (enterprise contract)Some plans only
- SynthflowBAA on: Enterprise (sales-led annual agreement)Some plans only
- Twilio (Voice, ConversationRelay, Flex)BAA on: Security Edition or Enterprise EditionSome plans only
- VapiBAA on: Usage-only or any Success Package, with the HIPAA add-onSome plans only
All BAA-ready alternatives to Genesys Cloud AI
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.