> ## Documentation Index > Fetch the complete documentation index at: https://docs.revdesk.com/llms.txt > Use this file to discover all available pages before exploring further. # HIPAA & BAA coverage > How RevDesk supports HIPAA workloads, what our BAA covers, and how to request one. ## RevDesk's HIPAA posture If your business handles Protected Health Information (PHI), you sign **one** Business Associate Agreement, and it is with RevDesk. We've already executed BAAs with the subprocessors in our stack that require them. You don't need to chase individual provider BAAs; we handle that upstream. Once your BAA is on file, we set `hipaa_enabled` on your workspace. That flag activates real runtime controls (described below), not just a contractual posture. ## Our subprocessor BAA status We use several third-party services to deliver RevDesk. Here's where each one stands today. This is informational only; you don't act on this list. | Service | Role | RevDesk's BAA status | | -------------------------------------------------- | --------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Tier-1 carrier (voice, SMS, SIP trunking) | Carrier | **Conduit Exception**: the carrier transmits PHI but doesn't access message content, so no BAA is required. Encryption in transit and at rest, access controls, and audit logging still apply. | | LiveKit (real-time audio) | Media transport + AI agent runtime | **Executed.** | | Vercel (hosting) + Vercel Blob (recording storage) | Platform | **Executed** under Enterprise BAA. | | Managed Postgres | Data store | **Executed** with our managed Postgres provider. | | OpenAI (LLM) | AI inference — voice models, and every text feature | **BAA-eligible enterprise tier**: we route HIPAA workspaces to BAA-covered model paths and block fallback to non-BAA providers. | | Deepgram (STT) | Transcription | **Executed.** | | Stripe | Billing | **Executed.** We avoid putting PHI in invoice descriptions or metadata regardless. | If you need documentation of any individual subprocessor BAA for your own compliance audit, email `compliance@revdesk.com` and we'll provide it. ## How to request a BAA from RevDesk **Self-serve is the fastest path.** On the Revenue Engine or Custom plan, an owner or admin can turn HIPAA mode on in **Settings → Organization → HIPAA**, review the standard BAA as a PDF, and accept it in the dialog. That acceptance is a complete two-party execution — our side is pre-signed — and the runtime controls below take effect immediately. If you need the agreement marked up, or you are not on a qualifying plan: 1. **Email `compliance@revdesk.com`** with subject "HIPAA BAA Request". 2. **Include:** * Your legal entity name * The workspace or team that will handle PHI * Your primary compliance contact (name + email) 3. **What happens next:** * We respond within 2 business days with our standard BAA. * For customers who can sign as-is: same-day workspace activation once the BAA is countersigned. * For customers needing legal markup: we route through our counsel; typical close in 5–10 business days. 4. **After signing:** We record execution on your workspace (`baaSignedAt`) and flip `hipaa_enabled = true`. If you're a partner with consistent healthcare volume, ask us about platform-wide HIPAA, a single agreement that covers your entire downstream customer base. Details on the [HIPAA add-on page](/integrations/other/hipaa). ## What `hipaa_enabled` does A workspace with `hipaa_enabled: true` enforces the following at runtime: 1. **Voice pinned to BAA-covered providers**: voices from providers without a BAA become unselectable, and an assistant still holding one is switched to a covered default at config-build time. 2. **Gemini routed through Vertex AI**: the worker initializes the Gemini Live client against Google Cloud Vertex AI, so inference happens under the Google Cloud BAA rather than the consumer API terms. 3. **Call content stripped from external egress**: recordings and transcripts are removed from outbound webhook payloads and the public API for a HIPAA workspace, including legacy rows that still hold content. 4. **Recording retention defaulted to 30 days**: enabling HIPAA sets `recordingRetentionDays` to **30** for every number currently retaining longer (the minimum-necessary default). You can adjust it per number afterward — there is no statutory cap on retaining PHI you are the custodian of — or turn call recording off entirely for the workspace in **Settings → Privacy** (`callRecordingDisabled`). 5. **Audit log**: compliance-relevant mutations (flag flips, BAA recording, retention changes) are recorded. What it does **not** do, and you should plan around: * **It is not a storage switch.** HIPAA permits BAA-covered storage, so recordings and transcripts keep being stored unless you turn them off yourself in **Settings → Privacy**. * **It does not narrow the sub-processors outside the call path.** Product analytics, error monitoring, and contact enrichment are not BAA-covered and are not disabled by the flag. We send them no call audio, transcripts, or message content — but do not run contact enrichment against a record that is PHI. * **It does not block a greeting that omits the recording disclosure.** Our default greetings carry it in 40+ languages, and the Compliance Center flags any drift between a greeting and the recording policy, but a custom greeting still saves. Flipping the flag is reversible, and we don't mass-delete historical data. Enabling it yourself requires accepting the click-through BAA if none is on file; when our team enables it for you, that memorializes a BAA executed offline. ## Security baseline RevDesk always provides Regardless of whether `hipaa_enabled` is set: * TLS 1.3 in transit, AES-256 at rest. * Encrypted credential storage (`REVDESK_ENCRYPTION_KEY`). * Row-level access control: every API query runs through `buildOwnershipFilter` which scopes results to the authenticated principal's org/team visibility. * Audit log on every mutation via tRPC middleware. * Breach notification procedures per § 164.410. Missing something your compliance officer needs? Email `compliance@revdesk.com`.