> ## Documentation Index
> Fetch the complete documentation index at: https://docs.revdesk.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA & BAA coverage

> How RevDesk supports HIPAA workloads, what our BAA covers, and how to request one.

## RevDesk's HIPAA posture

If your business handles Protected Health Information (PHI), you sign **one** Business Associate Agreement, and it is with RevDesk. We've already executed BAAs with the subprocessors in our stack that require them. You don't need to chase individual provider BAAs; we handle that upstream.

Once your BAA is on file, we set `hipaa_enabled` on your workspace. That flag activates real runtime controls (described below), not just a contractual posture.

## Our subprocessor BAA status

We use several third-party services to deliver RevDesk. Here's where each one stands today. This is informational only; you don't act on this list.

| Service                                            | Role                               | RevDesk's BAA status                                                                                                                                                                           |
| -------------------------------------------------- | ---------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Tier-1 carrier (voice, SMS, SIP trunking)          | Carrier                            | **Conduit Exception**: the carrier transmits PHI but doesn't access message content, so no BAA is required. Encryption in transit and at rest, access controls, and audit logging still apply. |
| LiveKit (real-time audio)                          | Media transport + AI agent runtime | **Executed.**                                                                                                                                                                                  |
| Vercel (hosting) + Vercel Blob (recording storage) | Platform                           | **Executed** under Enterprise BAA.                                                                                                                                                             |
| Managed Postgres                                   | Data store                         | **Executed** with our managed Postgres provider.                                                                                                                                               |
| OpenAI / Anthropic (LLM)                           | AI inference                       | **BAA-eligible enterprise tier**: we route HIPAA workspaces to BAA-covered model paths and block fallback to non-BAA providers.                                                                |
| Deepgram (STT)                                     | Transcription                      | **Executed.**                                                                                                                                                                                  |
| Stripe                                             | Billing                            | **Executed.** We avoid putting PHI in invoice descriptions or metadata regardless.                                                                                                             |

If you need documentation of any individual subprocessor BAA for your own compliance audit, email `compliance@revdesk.com` and we'll provide it.

## How to request a BAA from RevDesk

1. **Email `support@revdesk.com`** with subject "HIPAA BAA Request".
2. **Include:**
   * Your legal entity name
   * The workspace or team that will handle PHI
   * Your primary compliance contact (name + email)
3. **What happens next:**
   * We respond within 2 business days with our standard BAA.
   * For customers who can sign as-is: same-day workspace activation once the BAA is countersigned.
   * For customers needing legal markup: we route through our counsel; typical close in 5–10 business days.
4. **After signing:** We record execution on your workspace (`baaSignedAt`) and flip `hipaa_enabled = true`. The runtime controls below take effect immediately.

If you're a partner with consistent healthcare volume, ask us about platform-wide HIPAA, a single agreement that covers your entire downstream customer base. Details on the [HIPAA add-on page](/integrations/other/hipaa).

## What `hipaa_enabled` does

A workspace with `hipaa_enabled: true` enforces the following at runtime:

1. **Voice AI provider HIPAA mode**: every AI assistant we create on your behalf is provisioned with the upstream provider's HIPAA setting enabled, routing inference through BAA-covered paths only.
2. **Recording disclosure locked on**: you cannot save a custom assistant greeting that omits the "this call is recorded" disclosure. Our default greetings include it in 40+ languages.
3. **Recording retention defaulted to 30 days**: enabling HIPAA sets `recordingRetentionDays` to **30** for every number currently retaining longer (the minimum-necessary default). You can adjust it per number afterward — there is no statutory cap on retaining PHI you are the custodian of — or turn call recording off entirely for the workspace in **Settings → Privacy** (`callRecordingDisabled`).
4. **LLM routing** prefers BAA-covered model providers; fallback to non-BAA providers is blocked.
5. **Integration installs gated**: third-party apps that handle PHI but don't have a subprocessor BAA on file (e.g., certain CRM and messaging integrations) are blocked from being installed on the workspace. The full list is shown in the integrations directory with a HIPAA notice.
6. **Audit log**: every compliance-relevant mutation (flag flips, BAA recording, retention changes, blocked installs) is recorded.

Flipping the flag is reversible, and we don't mass-delete historical data. The flag itself can only be enabled when `baaSignedAt` is set, which requires a fully executed BAA on our side.

## Security baseline RevDesk always provides

Regardless of whether `hipaa_enabled` is set:

* TLS 1.3 in transit, AES-256 at rest.
* Encrypted credential storage (`REVDESK_ENCRYPTION_KEY`).
* Row-level access control: every API query runs through `buildOwnershipFilter` which scopes results to the authenticated principal's org/team visibility.
* Audit log on every mutation via tRPC middleware.
* Breach notification procedures per § 164.410.

Missing something your compliance officer needs? Email `compliance@revdesk.com`.