Vapi HIPAA compliance: building healthcare voice agents safely

What HIPAA actually requires of a voice agent

HIPAA does not certify software; it obligates covered entities and their business associates. For a voice agent that means three things in practice: a signed Business Associate Agreement (BAA) with every vendor that can see protected health information (PHI), technical safeguards (encryption in transit and at rest, access control, audit logging), and a documented retention and breach-notification process. A voice call is unusually leaky because PHI exists in four forms at once — raw audio, interim transcripts, LLM prompts and completions, and synthesized speech — and each of those can be logged by a different vendor.

Vapi's BAA and enterprise posture

Vapi offers a BAA on its enterprise/HIPAA plans rather than on self-serve accounts. Before you handle real patient data, confirm three things in writing: that the BAA is executed, which Vapi subprocessors are covered, and whether your account has HIPAA mode enabled (this is what disables long-term call recording and transcript retention on Vapi's side). Do not assume a self-serve account inherits the enterprise terms — the defaults keep recordings and transcripts for dashboard debugging, which is exactly what you must turn off.

Zero data retention configuration

Disable call recording at the assistant level, not just in the dashboard UI.
Disable transcript persistence, or route transcripts to your own HIPAA-eligible store via webhook and keep nothing on the vendor side.
Set the shortest available log retention on every provider that supports it, and request zero-retention endpoints where offered.
Strip PHI from tool-call payloads and webhook bodies — those often land in third-party logging tools nobody audited.
Turn off vendor model-training opt-ins; most providers train on API data unless explicitly disabled or covered by a BAA.

HIPAA-eligible upstream providers

Vapi is an orchestrator, so your compliance boundary is only as strong as the providers you plug in. For speech-to-text, Deepgram will sign a BAA and offers zero-retention processing. For language models, Azure OpenAI is the common choice because Microsoft's BAA covers it and it supports no-retention abuse monitoring; AWS Bedrock is an equivalent path. For text-to-speech, both Cartesia and ElevenLabs have enterprise agreements that can include a BAA — the self-serve tiers generally do not. Any provider without an executed BAA must never receive PHI, no matter how good the latency numbers look.

PHI redaction techniques

Redaction is your defense in depth for the hops you cannot fully control. Practical techniques: run entity detection over the final transcript and mask names, dates of birth, MRNs, and addresses before persisting anything; keep identifiers out of the system prompt and pass an opaque patient token to your tools instead; use DTMF collection rather than spoken digits for card numbers and member IDs so the audio never contains them; and mask before you log, not after. Assume every log line you write will be read by someone without treatment-relationship authorization.

Secure telephony setup

The carrier leg matters as much as the AI leg. Twilio will sign a BAA and supports SIP over TLS with SRTP media encryption; enable both, and disable Twilio-side call recording. If you bring your own carrier (BYOC) through Vapi's SIP support, confirm that the carrier encrypts media, will sign a BAA, and does not retain recordings for quality monitoring by default. Voicemail, fax bridges, and call-center transfer targets are frequently the weakest link — audit where a transferred call actually lands.

Access control, audit logging, and incident readiness

Enforce SSO and least-privilege roles on the Vapi dashboard; production assistants should not be editable by everyone.
Keep an immutable audit trail of who accessed transcripts, in your own system rather than the vendor's.
Store transcripts encrypted at rest with row-level access scoped to the treating team.
Write and rehearse a breach-notification runbook covering vendor-side incidents, not just your own.
Re-review subprocessor lists quarterly; providers add and swap infrastructure vendors often.

A realistic compliant reference stack

A configuration teams actually ship in 2026: Vapi on an enterprise plan with an executed BAA and HIPAA mode enabled, Deepgram Nova streaming STT under a BAA with zero retention, Azure OpenAI GPT-4o-mini for the hot path with abuse-monitoring retention disabled, Cartesia or ElevenLabs enterprise TTS under a BAA, Twilio telephony over TLS/SRTP with recordings disabled, and all transcripts written to your own encrypted database via webhook with PHI masked at write time. Latency is typically 100–200ms worse than an unconstrained stack, which is the fair price of a defensible compliance boundary.

FAQ

Which model providers support HIPAA on Vapi?

Healthcare voice bots require HIPAA-eligible endpoints such as Microsoft Azure OpenAI, AWS Bedrock, Deepgram Nova-2 with zero retention, and ElevenLabs enterprise tiers with signed BAAs.

How does Vapi handle Protected Health Information (PHI)?

When configured for healthcare, Vapi redacts sensitive audio and transcripts, enforces TLS encryption in transit, avoids persistent server-side storage, and routes requests to zero-retention downstream inference providers.

Is Vapi HIPAA compliant out of the box?

No. Vapi can be configured for HIPAA use, but a default self-serve account retains recordings and transcripts and has no BAA in place. Compliance requires an executed BAA with Vapi, HIPAA mode enabled on the account, recording and transcript retention disabled, and BAAs with every upstream STT, LLM, TTS, and telephony provider that can see PHI.

Do I need a BAA with every AI provider?

Yes, with every provider that can receive PHI. Audio sent to a speech-to-text vendor, prompts sent to a language model, and text sent to a text-to-speech vendor are all potential PHI disclosures. Providers without an executed BAA must be architected out of the PHI path entirely, either by swapping them or by redacting identifiers before the call reaches them.

Which LLM providers will sign a BAA for voice agents?

Azure OpenAI and AWS Bedrock are the usual production answers, because Microsoft and Amazon both offer BAAs covering those services and support disabling retention for abuse monitoring. Anthropic and OpenAI offer enterprise agreements that can include a BAA on request. Consumer API tiers and most aggregator gateways do not, so do not route PHI through them.

How do I keep PHI out of transcripts?

Disable vendor-side transcript storage, deliver transcripts to your own encrypted store via webhook, and mask entities such as names, dates of birth, medical record numbers, and addresses at write time. Collect sensitive digits with DTMF rather than speech so identifiers never appear in the audio, and keep patient identifiers out of prompts by passing opaque tokens to tools.

Can I record HIPAA calls for quality assurance?

You can, but recordings become PHI and inherit the full obligation set: encryption at rest, least-privilege access, audit logging, a defined retention period, and coverage under every relevant BAA. Many healthcare teams choose to keep masked transcripts only and skip audio recording entirely, because a transcript is far easier to redact and expire than a wav file.

Does HIPAA mode hurt latency?

Somewhat. HIPAA-eligible endpoints are often in fewer regions, Azure OpenAI can be slower to first token than the direct OpenAI API, and redaction adds a processing step. Expect roughly 100–200ms of extra first-word latency versus an unconstrained stack. You can win most of it back by co-locating every provider in one region and keeping the system prompt short.

What about state laws and call-recording consent?

HIPAA is the floor, not the ceiling. Two-party consent states require you to disclose recording at the start of the call, and several states have their own health-privacy statutes that are stricter than HIPAA. Add an explicit disclosure to the agent's greeting, log the consent event alongside the call, and have counsel review the script for the states you operate in.

How do I document compliance for an audit?

Keep a vendor inventory listing every provider in the audio path with its BAA status and retention setting, an architecture diagram showing where PHI flows, your assistant configuration exported as code, access-control and audit-log evidence, and a written breach-notification runbook. Auditors care less about the model you chose than about whether you can show the boundary and prove it holds.