Enabling HIPAA compliance does not degrade the quality of the voice assistant services. However, it limits access to certain features, such as reviewing call logs or transcriptions, that some users may find valuable for quality improvement purposes.

This feature is particularly useful for businesses and organizations in the healthcare sector or any entity that handles sensitive health information and must comply with HIPAA regulations.

Yes, your organization can toggle HIPAA mode on or off from the Dashboard as needed. Consider the implications carefully first: turning HIPAA mode off applies to your entire organization, not just one assistant.

When using Vapi with PHI, you may only pass PHI through the /call endpoint. All other endpoints in the API Reference should not contain PHI. For example, you should not put PHI in an /assistant prompt or in a /phone-number label. The restriction applies to all configuration endpoints where data would be stored on Vapi’s platform.

No, there are no designated “HIPAA-safe endpoints.” Instead, when HIPAA mode is turned on, Vapi will only use HIPAA-compliant services (such as Azure OpenAI) for processing PHI through the pipeline. The voice pipeline (STT → LLM → TTS) can process PHI when properly configured, but Vapi does not store this data outside its HIPAA-compliant storage.

Enable HIPAA mode at the organization level, from the Vapi Dashboard. This is the only way to enable HIPAA compliance, and it applies to every assistant in your organization. There is no per-assistant HIPAA setting.

No. Even when using your own HIPAA-compliant provider keys, it remains your responsibility not to store PHI via Vapi’s endpoints. The model keys are a separate concern from the storage of PHI on Vapi’s platform. You must both use HIPAA-compliant keys AND ensure you’re not storing PHI on Vapi.

By default, when HIPAA mode is on, Vapi doesn’t store structured outputs. This keeps data private but limits your ability to use structured outputs in Insights and Call Logs.

You can enable storage for specific structured outputs using the compliancePlan.forceStoreOnHipaaEnabled setting. This allows you to store non-sensitive outputs even when HIPAA mode is active.

Important: Your organization is responsible for ensuring that any structured output with storage enabled does NOT extract or generate PHI or sensitive data. Only use this for non-sensitive information.

Enable storage ONLY for structured outputs that extract non-sensitive, non-PHI information.

Safe use cases:

• Boolean outcomes: appointmentBooked: true/false
• Call success indicators: issueResolved: true/false
• General categories: issueCategory: "billing" | "technical" | "general"
• Satisfaction scores: csatScore: 1-10
• Call sentiment: sentiment: "positive" | "neutral" | "negative"

Never enable storage for:

• Patient diagnosis information
• Medical record numbers
• Social security numbers
• Credit card details
• Patient names, dates of birth, or contact information
• Treatment plans or medication information

Warning: Enabling storage for outputs containing PHI violates HIPAA compliance and your BAA with Vapi.

You can enable storage for specific structured outputs via the Dashboard or API.

Via Dashboard:

1. Navigate to Structured Outputs in the left sidebar
2. Create or edit a structured output
3. Expand the Compliance Settings section
4. Enable the toggle for “Enable Storage of Structured Outputs while on HIPAA Mode”
5. Only enable if your output does not extract sensitive information

Via API:

When creating a structured output:

1
    {
2
      "name": "Appointment Booked",
3
      "type": "ai",
4
      "schema": {
5
        "type": "boolean",
6
        "description": "Whether an appointment was successfully booked"
7
      },
8
      "compliancePlan": {
9
        "forceStoreOnHipaaEnabled": true
10
      }
11
    }

When updating a structured output:

1
    {
2
      "compliancePlan": {
3
        "forceStoreOnHipaaEnabled": true
4
      }
5
    }

IMPORTANT: Only set forceStoreOnHipaaEnabled: true if you are certain your structured output does NOT extract PHI or sensitive data. Your organization is responsible for ensuring compliance. Misuse could result in BAA violations.

• Enable HIPAA mode at the organization level, from the Dashboard
• Ensure that PHI only passes through the call pipeline and is not stored in configuration
• Use HIPAA-compliant accounts with all third-party providers (STT, LLM, TTS)
• Never use real PHI in an organization that has not enabled HIPAA mode, including for testing or demos
• Remember that call recordings, transcripts, and logs are still stored, in Vapi’s private HIPAA-compliant storage, unless you configure your own storage

No. HIPAA mode is enabled at the organization level and applies to every assistant in that organization. There is no way to exclude a specific assistant. If your organization has not enabled HIPAA mode, none of your assistants are HIPAA-compliant, regardless of any other configuration. Never use real PHI until HIPAA mode is enabled for your organization.

Under the Business Associate Agreement (BAA), you agree:

1. Not to introduce PHI onto Vapi’s platform through its API or dashboard except as permitted
2. To use HIPAA-compliant accounts with external providers when providing keys
3. To only use HIPAA-compliant providers that Vapi has signed a BAA with when not providing keys. See HIPAA compliant providers for the current list.
4. To use the platform in accordance with all BAA requirements