VAPI•5mo ago

BAAs for supporting providers?

Hey – working on a HIPAA compliant app and need to get BAAs signed by model providers. I'm assuming I'll need API info about voices, chat & reasoning models, etc. to make those requests with supporting providers (i.e. OpenAI, Eleven Labs, DeepGram, etc.). What's the best way to go about this?

Vapi Support BotAPP•8/12/25, 1:05 PM

Actionable Next Step:
To ensure HIPAA compliance, you should directly contact each third-party provider (e.g., OpenAI, Eleven Labs, DeepGram) and request a Business Associate Agreement (BAA) for your enterprise account. When reaching out, provide your organization details and specify your need for HIPAA-compliant usage of their APIs (voice, chat, reasoning models, etc.).
Tip: Most providers have a security or compliance contact listed on their website or in their documentation—start there for the fastest response.
For more on your responsibilities, see the Vapi HIPAA documentation.

Source:

Vapi HIPAA documentation

⤵️ Mention @Vapi Support Bot for follow-ups 🐥

VapiAPP•8/12/25, 6:16 PM

Yes, if you purchase HIPAA compliance on the billing page ($1000/month), you can still have call recordings and VAPI can store them in a HIPAA-compliant manner. However, there are specific requirements to ensure HIPAA compliance for your recordings:

1. Cloud Storage Requirements:

You must provide your own HIPAA-compliant cloud storage credentials
VAPI supports several providers for HIPAA-compliant storage:
- Amazon S3
- Google Cloud Storage (GCP)
- Others

2. Configuration Steps:

1. Purchase the HIPAA compliance add-on in your subscription billing page ($1000/month)

2. Set up one of the supported cloud storage providers (S3, GCP, Azure, etc.)

3. Add your storage credentials on the Provider Credentials page in the Dashboard

4. Make sure your assistant's

artifactPlan.recordingEnabled

artifactPlan.recordingEnabled

is set to true

5. Configure the

recordingPath

recordingPath

if you want to customize where recordings are stored

3. Important Notes:

Without proper cloud storage credentials, recordings won't be stored when HIPAA compliance is enabled
You'll still receive an end-of-call report with call information
With HIPAA enabled, VAPI won't store the recordings in their own storage

This approach ensures your call recordings are stored in your own HIPAA-compliant environment while still allowing you to benefit from VAPI's call recording functionality.

sophisticated-purpleOP•8/12/25, 8:22 PM

Cool that recordings are still possible.

The bot says I MUST go to get a BAA from every provider... but this post says otherwise. Can you clarify what needs to happen?

BAA agreement

sophisticated-purpleOP•8/13/25, 11:48 AM

VapiAPP•8/14/25, 8:53 PM

If you are using our approved providers, you will only need a BAA from VAPI.

BAAs for supporting providers?

Similar Threads

Similar Threads

Similar Threads