# Health data and the BAA

Lesson 1 of [Review voice agent risk and compliance before launch](https://voiceagents.fyi/academy/voice-agent-risk-and-compliance-review.md), 15 minutes.

This course supports a buyer's review. It is not legal advice. Ask your lawyer how each rule applies to your calls.

## When this applies

This lesson applies when you are a US covered entity or business associate and your calls include protected health information (PHI). An AI voice agent hears, records and stores what callers say. Callers often say private things.

## The business associate agreement

A business associate agreement (BAA) is a contract that HIPAA requires between a US covered entity and a vendor that handles PHI for it. The terms are in 45 CFR 164.504(e). The contract must require the vendor to use appropriate safeguards. It must require the vendor to report uses or disclosures that the contract does not allow, including breaches. It must make subcontractors agree to the same restrictions. It must also require the vendor to return or destroy the PHI at termination, where feasible.

## What to check

- The vendor signs the BAA before any PHI reaches it.
- The BAA covers the vendor's subcontractors, such as the model, speech and telephony providers.
- The BAA states how the vendor reports a breach.
- The BAA states that the vendor returns or destroys PHI at the end of the contract.

## Check the cost and the plan

A BAA can cost extra. On 2026-10-29, Vapi listed its HIPAA add-on at $2,000 a month, with a BAA. Retell AI listed HIPAA / BAA and Custom BAA in its plan table. Ask each vendor which plan includes the BAA and get the answer in writing.

## A badge is not an agreement

A compliance badge or a claim on a listing repeats what the vendor says. It is not a signed BAA. Ask for the agreement before you send PHI.

## Sources

- eCFR, 45 CFR 164.504, Uses and disclosures: organizational requirements
- VoiceAgents buyer guide: AI Voice Agent Security and Compliance Checklist
- Vapi and Retell AI pricing pages, fetched 2026-10-29

Also on the [web page](https://voiceagents.fyi/academy/voice-agent-risk-and-compliance-review/health-data-and-the-baa).