Does Twilio (Voice, ConversationRelay, Flex) sign a BAA?
Only on some plans or setups
Twilio signs a Business Associate Addendum for customers on Security Edition or Enterprise Edition, covering only the services on its HIPAA Eligible Services list. ConversationRelay, Conversation Intelligence (classic) for Voice and Virtual Agent with Dialogflow are on that list. AI Assistants is not.
Not fully covered by the BAA: AI Assistants / Agent Copilot.
- Business associate
- Twilio
- Tool
- Twilio (Voice, ConversationRelay, Flex)
- Plans with a BAA
- Security Edition or Enterprise Edition
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Security Edition or Enterprise Edition | Signs a BAA | Through salesRequest page | HIPAA accounts need Security Edition or Enterprise Edition plus a signed BAA. Only services on the HIPAA Eligible Services list may be used in PHI workflows, and items marked with an asterisk need the 'Architecting for HIPAA on Twilio' guidance. Twilio says signing a BAA alone does not make an application compliant.[1],[2],[3] |
| Standard / pay-as-you-go accounts without an eligible Edition | No BAA | Not offered | Twilio requires Security or Enterprise Edition to sign a BAA.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Twilio says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| ConversationRelaySecurity Edition or Enterprise Edition | Covered | Became HIPAA eligible on March 17, 2025, and appears on the eligible list as 'Conversation Relay*' (asterisk: follow the HIPAA architecture guide). The list does not say whether third-party STT/TTS or LLM providers chosen by the customer are covered. Only 'Text to Speech (Basic and Amazon Polly)' and 'Speech Recognition' are listed.[3],[4] |
| Conversation Intelligence (classic) – VoiceSecurity Edition or Enterprise Edition | Covered | Listed with an asterisk on the eligible list (June 30, 2026 version).[3] |
| Virtual Agent (with Google Dialogflow)Security Edition or Enterprise Edition | Covered | Listed with an asterisk under Programmable Voice basics.[3] |
| AI Assistants / Agent CopilotSecurity Edition or Enterprise Edition | Excluded | Neither is on the HIPAA Eligible Services list, and Twilio says only listed products should be used for PHI workflows.[1],[3] |
AI voice agents that offer a BAA
- Assort HealthBAA on: Healthcare provider customer agreementsSome plans only
- Bland AIBAA on: Healthcare / Enterprise deploymentsSome plans only
- SynthflowBAA on: Enterprise (sales-led annual agreement)Some plans only
- VapiBAA on: Usage-only or any Success Package, with the HIPAA add-onSome plans only
- Amazon ConnectBAA on: Any AWS account that accepts the AWS BAASigns a BAA
- Google Cloud Contact Center AI / Customer Engagement SuiteBAA on: Google Cloud customers who accept the Google Cloud BAASigns a BAA
All BAA-ready alternatives to Twilio (Voice, ConversationRelay, Flex)
Sources
- Twilio and HIPAA
- HIPAA Accounts | Twilio Docs
- HIPAA Eligible Services
- ConversationRelay is now HIPAA eligible | Twilio Changelog
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.