Does Vapi sign a BAA?
Only on some plans or setups
Vapi signs a BAA as part of a paid HIPAA compliance add-on, listed on its pricing page at $2,000 per month and purchased from the dashboard. HIPAA mode is organization-wide and restricts assistants to HIPAA-compliant LLM, voice and transcriber providers.
Not fully covered by the BAA: Core voice pipeline (LLM, voice/TTS, transcriber/STT); Structured outputs.
- Business associate
- Vapi
- Tool
- Vapi
- Plans with a BAA
- Usage-only or any Success Package, with the HIPAA add-on
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Usage-only or any Success Package, with the HIPAA add-on | Signs a BAA | Accept or sign onlinesecurity@vapi.ai | Vapi docs say HIPAA is a paid add-on available with Usage only or any Success Package. Buy it under Packages & add-ons in the dashboard, enter the BAA recipient, then sign the BAA Vapi emails. The pricing page lists the HIPAA add-on at $2,000/month, including a DPA and BAA. HIPAA mode applies org-wide, cannot be enabled via API, and cannot be combined with Zero Data Retention.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Vapi says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Core voice pipeline (LLM, voice/TTS, transcriber/STT) | Partly covered | In HIPAA mode only HIPAA-compliant LLM, voice and transcriber providers can be selected; Vapi rejects non-compliant selections. Docs cite Azure OpenAI as an example used for PHI processing. With your own provider keys you must hold HIPAA-compliant accounts with those providers yourself. The current provider list is kept on the Trust Center, which did not name providers in the fetched text.[1],[3] |
| Call recordings, transcripts and logs | Covered | Stored in Vapi's private HIPAA-compliant storage unless you configure your own storage; retrieved via API with the private key rather than direct URLs. Docs note HIPAA mode limits some features such as reviewing call logs or transcriptions.[1] |
| Structured outputs | Partly covered | Not stored by default in HIPAA mode; a per-output override exists but only for non-PHI data.[1] |
| Telephony and third-party integrations (e.g., Twilio, Telnyx, workflow tools) | Not stated | Official docs do not say whether telephony or other integrations fall under Vapi's BAA. A reply on Vapi's support forum says they are outside it and need separate BAAs, but the poster's role is not verified, so this is not treated as confirmed.[1],[4] |
AI voice agents that offer a BAA
- Assort HealthBAA on: Healthcare provider customer agreementsSome plans only
- Bland AIBAA on: Healthcare / Enterprise deploymentsSome plans only
- SynthflowBAA on: Enterprise (sales-led annual agreement)Some plans only
- Twilio (Voice, ConversationRelay, Flex)BAA on: Security Edition or Enterprise EditionSome plans only
- Amazon ConnectBAA on: Any AWS account that accepts the AWS BAASigns a BAA
- Google Cloud Contact Center AI / Customer Engagement SuiteBAA on: Google Cloud customers who accept the Google Cloud BAASigns a BAA
All BAA-ready alternatives to Vapi
Sources
- HIPAA Compliance (Vapi docs)
- Vapi Pricing
- Vapi Trust Center - HIPAA
- HIPAA compliance (Vapi support forum thread)
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.