Is Luma Health HIPAA compliant?
Luma Health signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Luma Health with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Luma Health doesn't say whether the BAA covers its AI features.
Does Luma Health sign a BAA?
Yes, it signs a BAA
Luma Health publishes a Business Associate Agreement template on its own site, naming itself as the business associate, so it signs BAAs with customers. Its AI materials claim HIPAA compliance and zero data retention but don't say the BAA covers the Spark AI products.
Not confirmed for the AI features: Luma Health doesn’t say whether its BAA covers Navigator (voice AI concierge) and Fax Transform, powered by Spark. Get that in writing before using it with patient data.
- Business associate
- Luma Health
- Tool
- Luma Health
- Plans with a BAA
- Luma Health customer contract
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Luma Health customer contract | Signs a BAA | Through salesRequest page | The published BAA is a template with blank party and date fields, so it is signed per customer. It covers all existing or future contracts between the parties. No plan or tier restrictions are stated.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Luma Health says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Navigator (voice AI concierge) and Fax Transform, powered by Spark | Not stated | The BAA template doesn't mention AI. Luma's AI committee kit claims HIPAA compliance, zero retention by Luma and its AI partners, and no training on customer or patient data. It names Vapi, Deepgram, OpenAI, Claude and ElevenLabs as partners but doesn't say whether they have BAAs with Luma.[1],[2],[3] |
Compare Luma Health
- Luma Health vs ArteraArtera: signs a BAA
Sources
- Business Associate Agreement - Luma Health
- AI Committee Kit: Navigator
- Luma Health announces Spark multi-model generative AI
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.