HIPAA & BAA coverage

How RevDesk supports HIPAA workloads, what our BAA covers, and how to request one.

RevDesk’s HIPAA posture

If your business handles Protected Health Information (PHI), you sign one Business Associate Agreement, and it is with RevDesk. We’ve already executed BAAs with the subprocessors in our stack that require them. You don’t need to chase individual provider BAAs; we handle that upstream.

Once your BAA is on file, we set hipaa_enabled on your workspace. That flag activates real runtime controls (described below), not just a contractual posture.

Our subprocessor BAA status

We use several third-party services to deliver RevDesk. Here’s where each one stands today. This is informational only; you don’t act on this list.

Service	Role	RevDesk’s BAA status
Tier-1 carrier (voice, SMS, SIP trunking)	Carrier	Conduit Exception: the carrier transmits PHI but doesn’t access message content, so no BAA is required. Encryption in transit and at rest, access controls, and audit logging still apply.
LiveKit (real-time audio)	Media transport + AI agent runtime	Executed.
Vercel (hosting) + Vercel Blob (recording storage)	Platform	Executed under Enterprise BAA.
Managed Postgres	Data store	Executed with our managed Postgres provider.
OpenAI (LLM)	AI inference — voice models, and every text feature	BAA-eligible enterprise tier: we route HIPAA workspaces to BAA-covered model paths and block fallback to non-BAA providers.
Deepgram (STT)	Transcription	Executed.
Stripe	Billing	Executed. We avoid putting PHI in invoice descriptions or metadata regardless.

If you need documentation of any individual subprocessor BAA for your own compliance audit, email [e-mail] and we’ll provide it.

How to request a BAA from RevDesk

Self-serve is the fastest path. On the Revenue Engine or Custom plan, an owner or admin can turn HIPAA mode on in Settings → Organization → HIPAA, review the standard BAA as a PDF, and accept it in the dialog. That acceptance is a complete two-party execution — our side is pre-signed — and the runtime controls below take effect immediately.

If you need the agreement marked up, or you are not on a qualifying plan:

1. Email [e-mail] with subject “HIPAA BAA Request”.
2. Include:
   • Your legal entity name
   • The workspace or team that will handle PHI
   • Your primary compliance contact (name + email)
3. What happens next:
   • We respond within 2 business days with our standard BAA.
   • For customers who can sign as-is: same-day workspace activation once the BAA is countersigned.
   • For customers needing legal markup: we route through our counsel; typical close in 5–10 business days.
4. After signing: We record execution on your workspace (baaSignedAt) and flip hipaa_enabled = true.

If you’re a partner with consistent healthcare volume, ask us about platform-wide HIPAA, a single agreement that covers your entire downstream customer base. Details on the HIPAA add-on page.

What hipaa_enabled does

A workspace with hipaa_enabled: true enforces the following at runtime:

1. Voice pinned to BAA-covered providers: voices from providers without a BAA become unselectable, and an assistant still holding one is switched to a covered default at config-build time.
2. Gemini routed through Vertex AI: the worker initializes the Gemini Live client against Google Cloud Vertex AI, so inference happens under the Google Cloud BAA rather than the consumer API terms.
3. Call content stripped from external egress: recordings and transcripts are removed from outbound webhook payloads and the public API for a HIPAA workspace, including legacy rows that still hold content.
4. Recording retention defaulted to 30 days: enabling HIPAA sets recordingRetentionDays to 30 for every number currently retaining longer (the minimum-necessary default). You can adjust it per number afterward — there is no statutory cap on retaining PHI you are the custodian of — or turn call recording off entirely for the workspace in Settings → Privacy (callRecordingDisabled).
5. Audit log: compliance-relevant mutations (flag flips, BAA recording, retention changes) are recorded.

What it does not do, and you should plan around:

• It is not a storage switch. HIPAA permits BAA-covered storage, so recordings and transcripts keep being stored unless you turn them off yourself in Settings → Privacy.
• It does not narrow the sub-processors outside the call path. Product analytics, error monitoring, and contact enrichment are not BAA-covered and are not disabled by the flag. We send them no call audio, transcripts, or message content — but do not run contact enrichment against a record that is PHI.
• It does not block a greeting that omits the recording disclosure. Our default greetings carry it in 40+ languages, and the Compliance Center flags any drift between a greeting and the recording policy, but a custom greeting still saves.

Flipping the flag is reversible, and we don’t mass-delete historical data. Enabling it yourself requires accepting the click-through BAA if none is on file; when our team enables it for you, that memorializes a BAA executed offline.

Security baseline RevDesk always provides

Regardless of whether hipaa_enabled is set:

• TLS 1.3 in transit, AES-256 at rest.
• Encrypted credential storage (REVDESK_ENCRYPTION_KEY).
• Row-level access control: every API query runs through buildOwnershipFilter which scopes results to the authenticated principal’s org/team visibility.
• Audit log on every mutation via tRPC middleware.
• Breach notification procedures per § 164.410.

Missing something your compliance officer needs? Email [e-mail].