From f7bff522d077c4318884fdd538bae1b73a2a6707 Mon Sep 17 00:00:00 2001 From: nathalie-vapi Date: Thu, 17 Sep 2026 17:22:48 -0700 Subject: [PATCH 1/2] docs: point HIPAA compliant providers to Trust Center --- fern/security-and-privacy/hipaa.mdx | 229 +--------------------------- 1 file changed, 1 insertion(+), 228 deletions(-) diff --git a/fern/security-and-privacy/hipaa.mdx b/fern/security-and-privacy/hipaa.mdx index f35a7720e..eff1a560e 100644 --- a/fern/security-and-privacy/hipaa.mdx +++ b/fern/security-and-privacy/hipaa.mdx @@ -1,228 +1 @@ ---- -title: HIPAA Compliance -subtitle: Learn how to ensure privacy when using Vapi's voice assistant platform -description: HIPAA on Vapi. Enable organization-wide compliance mode, use approved LLM, voice, and transcriber providers, and control how call recordings and logs are stored. -slug: security-and-privacy/hipaa ---- - -## Introduction to Privacy at Vapi - -At Vapi, we are committed to delivering exceptional voice assistant services while upholding the highest standards of privacy and data protection for our users. We understand the importance of balancing service quality with the need to respect and protect personal and sensitive information. Our privacy policies and practices are designed to give you control over your data while benefiting from the full capabilities of our platform. - -## Understanding HIPAA Compliance Basics - -The Health Insurance Portability and Accountability Act (HIPAA) is a United States legislation that provides data privacy and security provisions for safeguarding medical information. HIPAA compliance is crucial for any entity that deals with protected health information (PHI), ensuring that sensitive patient data is handled, stored, and transmitted with the highest standards of security and confidentiality. The key concepts of HIPAA compliance include the Privacy Rule, which protects the privacy of individually identifiable health information; the Security Rule, which sets standards for the security of electronic protected health information (e-PHI); and the Breach Notification Rule, which requires covered entities to notify individuals, HHS, and in some cases, the media of a breach of unsecured PHI. Compliance with these rules is not just about adhering to legal requirements but also about building trust with your customers by demonstrating your commitment to protecting their sensitive data. - -## Understanding Default Settings - -By default, Vapi records your calls and stores logs and transcriptions. This practice is aimed at continuously improving the quality of our service, ensuring that you receive the best possible experience. However, we recognize the importance of privacy and provide options for users who prefer more control over their data. - -## Opting for Privacy: The HIPAA Compliance Option - -For users prioritizing privacy, particularly in compliance with the Health Insurance Portability and Accountability Act (HIPAA). Choosing HIPAA compliance through our platform ensures that you can still use our voice assistant services without compromising on privacy requirements. - -## Enabling HIPAA Compliance - -HIPAA mode is an organization-wide setting that changes how Vapi handles call logs, recordings, and transcripts. It also limits the organization to compatible model, voice, and transcriber providers. - -To enable HIPAA compliance: - - - - HIPAA is available as a paid compliance add-on with Usage only or any Success Package. See [Buy compliance and data add-ons](/billing/manage-packages-and-add-ons#buy-compliance-and-data-add-ons) to add it. - - - - - In **Packages & add-ons**, select **HIPAA compliance**, then enter the BAA recipient's name and organization. The Dashboard lets you know that Vapi will email the BAA for signature. - - - - - Review and sign the BAA sent by email, then complete the remaining Dashboard prompts to activate **HIPAA compliance**. HIPAA is an organization-level setting: it applies to every assistant in your organization, with no per-assistant exception, and it cannot be enabled through the API. - - - - - Update any assistant using a non-compliant LLM, voice, or transcriber provider. See [HIPAA compliant providers](/security-and-privacy/hipaa#hipaa-compliant-providers) for the full list. Vapi rejects configuration changes that select a non-compliant provider while HIPAA mode is on. Your call records, transcripts, and logs are then stored in a HIPAA compliant manner. - - - - -HIPAA mode and Zero Data Retention (ZDR) are mutually exclusive. Disable one before enabling the other. See [Zero Data Retention (ZDR)](/security-and-privacy/zero-data-retention). - - -## HIPAA Compliant providers - -When enabling HIPAA compliance, only HIPAA compliant providers may be chosen. - -### Model Providers (LLM) - -- **Anthropic** -- **Anthropic Bedrock** -- **Anthropic Vertex** -- **Azure OpenAI** -- **Baseten** -- **Custom LLM** -- **Google** -- **OpenAI** -- **Together AI** -- **xAI** - -### Voice Providers (TTS) - -- **Azure** -- **Cartesia** -- **Deepgram** -- **ElevenLabs** -- **Rime AI** -- **Vapi** -- **xAI** - -### Transcription Providers (STT) - -- **Azure** -- **Cartesia** -- **Deepgram** -- **Soniox** -- **xAI** - -# FAQs - - - - Enabling HIPAA compliance does not degrade the quality of the voice assistant services. However, it limits access to certain features, such as reviewing call logs or transcriptions, that some users may find valuable for quality improvement purposes. - - - This feature is particularly useful for businesses and organizations in the healthcare sector or any entity that handles sensitive health information and must comply with HIPAA regulations. - - - Yes, your organization can toggle HIPAA mode on or off from the Dashboard as needed. Consider the implications carefully first: turning HIPAA mode off applies to your entire organization, not just one assistant. - - - -## Where can PHI be used with Vapi? - - - - When using Vapi with PHI, you may only pass PHI through the `/call` endpoint. All other endpoints in the API Reference should not contain PHI. For example, you should not put PHI in an `/assistant` prompt or in a `/phone-number` label. The restriction applies to all configuration endpoints where data would be stored on Vapi's platform. - - - No, there are no designated "HIPAA-safe endpoints." Instead, when HIPAA mode is turned on, Vapi will only use HIPAA-compliant services (such as Azure OpenAI) for processing PHI through the pipeline. The voice pipeline (STT → LLM → TTS) can process PHI when properly configured, but Vapi does not store this data outside its HIPAA-compliant storage. - - - -## HIPAA Compliance Configuration - - - - Enable HIPAA mode at the organization level, from the Vapi Dashboard. This is the only way to enable HIPAA compliance, and it applies to every assistant in your organization. There is no per-assistant HIPAA setting. - - - No. Even when using your own HIPAA-compliant provider keys, it remains your responsibility not to store PHI via Vapi's endpoints. The model keys are a separate concern from the storage of PHI on Vapi's platform. You must both use HIPAA-compliant keys AND ensure you're not storing PHI on Vapi. - - - -## Structured Outputs with HIPAA Mode - -When HIPAA mode is enabled, Vapi does not store structured outputs by default. This protects privacy but limits your ability to use structured outputs in Insights and Call Logs. For non-sensitive outputs, you can override this behavior. - - - - By default, when HIPAA mode is on, Vapi doesn't store structured outputs. This keeps data private but limits your ability to use structured outputs in Insights and Call Logs. - - You can enable storage for specific structured outputs using the `compliancePlan.forceStoreOnHipaaEnabled` setting. This allows you to store non-sensitive outputs even when HIPAA mode is active. - - **Important:** Your organization is responsible for ensuring that any structured output with storage enabled does NOT extract or generate PHI or sensitive data. Only use this for non-sensitive information. - - - - Enable storage ONLY for structured outputs that extract non-sensitive, non-PHI information. - - **Safe use cases:** - - Boolean outcomes: `appointmentBooked: true/false` - - Call success indicators: `issueResolved: true/false` - - General categories: `issueCategory: "billing" | "technical" | "general"` - - Satisfaction scores: `csatScore: 1-10` - - Call sentiment: `sentiment: "positive" | "neutral" | "negative"` - - **Never enable storage for:** - - Patient diagnosis information - - Medical record numbers - - Social security numbers - - Credit card details - - Patient names, dates of birth, or contact information - - Treatment plans or medication information - - **Warning:** Enabling storage for outputs containing PHI violates HIPAA compliance and your BAA with Vapi. - - - - You can enable storage for specific structured outputs via the Dashboard or API. - - **Via Dashboard:** - 1. Navigate to **Structured Outputs** in the left sidebar - 2. Create or edit a structured output - 3. Expand the **Compliance Settings** section - 4. Enable the toggle for "Enable Storage of Structured Outputs while on HIPAA Mode" - 5. Only enable if your output does not extract sensitive information - - **Via API:** - - When creating a structured output: -```json - { - "name": "Appointment Booked", - "type": "ai", - "schema": { - "type": "boolean", - "description": "Whether an appointment was successfully booked" - }, - "compliancePlan": { - "forceStoreOnHipaaEnabled": true - } - } -``` - - When updating a structured output: -```json - { - "compliancePlan": { - "forceStoreOnHipaaEnabled": true - } - } -``` - - **IMPORTANT:** Only set `forceStoreOnHipaaEnabled: true` if you are certain your structured output does NOT extract PHI or sensitive data. Your organization is responsible for ensuring compliance. Misuse could result in BAA violations. - - - -## Best Practices - - - - - Enable HIPAA mode at the organization level, from the Dashboard - - Ensure that PHI only passes through the call pipeline and is not stored in configuration - - Use HIPAA-compliant accounts with all third-party providers (STT, LLM, TTS) - - Never use real PHI in an organization that has not enabled HIPAA mode, including for testing or demos - - Remember that call recordings, transcripts, and logs are still stored, in Vapi's private HIPAA-compliant storage, unless you configure your own storage - - - No. HIPAA mode is enabled at the organization level and applies to every assistant in that organization. There is no way to exclude a specific assistant. If your organization has not enabled HIPAA mode, none of your assistants are HIPAA-compliant, regardless of any other configuration. Never use real PHI until HIPAA mode is enabled for your organization. - - - Under the Business Associate Agreement (BAA), you agree: - 1. Not to introduce PHI onto Vapi's platform through its API or dashboard except as permitted - 2. To use HIPAA-compliant accounts with external providers when providing keys - 3. To only use HIPAA-compliant providers that Vapi has signed a BAA with when not providing keys. See [HIPAA compliant providers](#hipaa-compliant-providers) for the current list. - 4. To use the platform in accordance with all BAA requirements - - - -## Retrieving Call Artifacts from Private Storage - -For HIPAA-enabled organizations, call recordings and logs are stored in a private bucket and cannot be downloaded directly from the URLs returned in webhooks or API responses. To retrieve recordings, call logs, or other artifacts, call the Vapi API with your Private API Key, see [Retrieve call artifacts](/assistants/retrieve-call-artifacts) for the full list of endpoints and example requests. This retrieval method is the same for HIPAA and non-HIPAA organizations alike. - -## Need Further Assistance? - -If you have more questions about privacy, HIPAA compliance, or how to configure your Vapi assistant, our support team is here to help. Contact us at security@vapi.ai for personalized assistance and more information on how to make the most of Vapi's voice assistant platform while ensuring your data remains protected. +LS0tCnRpdGxlOiBISVBBQSBDb21wbGlhbmNlCnN1YnRpdGxlOiBMZWFybiBob3cgdG8gZW5zdXJlIHByaXZhY3kgd2hlbiB1c2luZyBWYXBpJ3Mgdm9pY2UgYXNzaXN0YW50IHBsYXRmb3JtCmRlc2NyaXB0aW9uOiBISVBBQSBvbiBWYXBpLiBFbmFibGUgb3JnYW5pemF0aW9uLXdpZGUgY29tcGxpYW5jZSBtb2RlLCB1c2UgYXBwcm92ZWQgTExNLCB2b2ljZSwgYW5kIHRyYW5zY3JpYmVyIHByb3ZpZGVycywgYW5kIGNvbnRyb2wgaG93IGNhbGwgcmVjb3JkaW5ncyBhbmQgbG9ncyBhcmUgc3RvcmVkLgpzbHVnOiBzZWN1cml0eS1hbmQtcHJpdmFjeS9oaXBhYQotLS0KCiMjIEludHJvZHVjdGlvbiB0byBQcml2YWN5IGF0IFZhcGkKCkF0IFZhcGksIHdlIGFyZSBjb21taXR0ZWQgdG8gZGVsaXZlcmluZyBleGNlcHRpb25hbCB2b2ljZSBhc3Npc3RhbnQgc2VydmljZXMgd2hpbGUgdXBob2xkaW5nIHRoZSBoaWdoZXN0IHN0YW5kYXJkcyBvZiBwcml2YWN5IGFuZCBkYXRhIHByb3RlY3Rpb24gZm9yIG91ciB1c2Vycy4gV2UgdW5kZXJzdGFuZCB0aGUgaW1wb3J0YW5jZSBvZiBiYWxhbmNpbmcgc2VydmljZSBxdWFsaXR5IHdpdGggdGhlIG5lZWQgdG8gcmVzcGVjdCBhbmQgcHJvdGVjdCBwZXJzb25hbCBhbmQgc2Vuc2l0aXZlIGluZm9ybWF0aW9uLiBPdXIgcHJpdmFjeSBwb2xpY2llcyBhbmQgcHJhY3RpY2VzIGFyZSBkZXNpZ25lZCB0byBnaXZlIHlvdSBjb250cm9sIG92ZXIgeW91ciBkYXRhIHdoaWxlIGJlbmVmaXRpbmcgZnJvbSB0aGUgZnVsbCBjYXBhYmlsaXRpZXMgb2Ygb3VyIHBsYXRmb3JtLgoKIyMgVW5kZXJzdGFuZGluZyBISVBBQSBDb21wbGlhbmNlIEJhc2ljcwoKVGhlIEhlYWx0aCBJbnN1cmFuY2UgUG9ydGFiaWxpdHkgYW5kIEFjY291bnRhYmlsaXR5IEFjdCAoSElQQUEpIGlzIGEgVW5pdGVkIFN0YXRlcyBsZWdpc2xhdGlvbiB0aGF0IHByb3ZpZGVzIGRhdGEgcHJpdmFjeSBhbmQgc2VjdXJpdHkgcHJvdmlzaW9ucyBmb3Igc2FmZWd1YXJkaW5nIG1lZGljYWwgaW5mb3JtYXRpb24uIEhJUEFBIGNvbXBsaWFuY2UgaXMgY3J1Y2lhbCBmb3IgYW55IGVudGl0eSB0aGF0IGRlYWxzIHdpdGggcHJvdGVjdGVkIGhlYWx0aCBpbmZvcm1hdGlvbiAoUEhJKSwgZW5zdXJpbmcgdGhhdCBzZW5zaXRpdmUgcGF0aWVudCBkYXRhIGlzIGhhbmRsZWQsIHN0b3JlZCwgYW5kIHRyYW5zbWl0dGVkIHdpdGggdGhlIGhpZ2hlc3Qgc3RhbmRhcmRzIG9mIHNlY3VyaXR5IGFuZCBjb25maWRlbnRpYWxpdHkuIFRoZSBrZXkgY29uY2VwdHMgb2YgSElQQUEgY29tcGxpYW5jZSBpbmNsdWRlIHRoZSBQcml2YWN5IFJ1bGUsIHdoaWNoIHByb3RlY3RzIHRoZSBwcml2YWN5IG9mIGluZGl2aWR1YWxseSBpZGVudGlmaWFibGUgaGVhbHRoIGluZm9ybWF0aW9uOyB0aGUgU2VjdXJpdHkgUnVsZSwgd2hpY2ggc2V0cyBzdGFuZGFyZHMgZm9yIHRoZSBzZWN1cml0eSBvZiBlbGVjdHJvbmljIHByb3RlY3RlZCBoZWFsdGggaW5mb3JtYXRpb24gKGUtUEhJKTsgYW5kIHRoZSBCcmVhY2ggTm90aWZpY2F0aW9uIFJ1bGUsIHdoaWNoIHJlcXVpcmVzIGNvdmVyZWQgZW50aXRpZXMgdG8gbm90aWZ5IGluZGl2aWR1YWxzLCBISFMsIGFuZCBpbiBzb21lIGNhc2VzLCB0aGUgbWVkaWEgb2YgYSBicmVhY2ggb2YgdW5zZWN1cmVkIFBISS4gQ29tcGxpYW5jZSB3aXRoIHRoZXNlIHJ1bGVzIGlzIG5vdCBqdXN0IGFib3V0IGFkaGVyaW5nIHRvIGxlZ2FsIHJlcXVpcmVtZW50cyBidXQgYWxzbyBhYm91dCBidWlsZGluZyB0cnVzdCB3aXRoIHlvdXIgY3VzdG9tZXJzIGJ5IGRlbW9uc3RyYXRpbmcgeW91ciBjb21taXRtZW50IHRvIHByb3RlY3RpbmcgdGhlaXIgc2Vuc2l0aXZlIGRhdGEuCgojIyBVbmRlcnN0YW5kaW5nIERlZmF1bHQgU2V0dGluZ3MKCkJ5IGRlZmF1bHQsIFZhcGkgcmVjb3JkcyB5b3VyIGNhbGxzIGFuZCBzdG9yZXMgbG9ncyBhbmQgdHJhbnNjcmlwdGlvbnMuIFRoaXMgcHJhY3RpY2UgaXMgYWltZWQgYXQgY29udGludW91c2x5IGltcHJvdmluZyB0aGUgcXVhbGl0eSBvZiBvdXIgc2VydmljZSwgZW5zdXJpbmcgdGhhdCB5b3UgcmVjZWl2ZSB0aGUgYmVzdCBwb3NzaWJsZSBleHBlcmllbmNlLiBIb3dldmVyLCB3ZSByZWNvZ25pemUgdGhlIGltcG9ydGFuY2Ugb2YgcHJpdmFjeSBhbmQgcHJvdmlkZSBvcHRpb25zIGZvciB1c2VycyB3aG8gcHJlZmVyIG1vcmUgY29udHJvbCBvdmVyIHRoZWlyIGRhdGEuIAoKIyMgT3B0aW5nIGZvciBQcml2YWN5OiBUaGUgSElQQUEgQ29tcGxpYW5jZSBPcHRpb24KCkZvciB1c2VycyBwcmlvcml0aXppbmcgcHJpdmFjeSwgcGFydGljdWxhcmx5IGluIGNvbXBsaWFuY2Ugd2l0aCB0aGUgSGVhbHRoIEluc3VyYW5jZSBQb3J0YWJpbGl0eSBhbmQgQWNjb3VudGFiaWxpdHkgQWN0IChISVBBQSkuIENob29zaW5nIEhJUEFBIGNvbXBsaWFuY2UgdGhyb3VnaCBvdXIgcGxhdGZvcm0gZW5zdXJlcyB0aGF0IHlvdSBjYW4gc3RpbGwgdXNlIG91ciB2b2ljZSBhc3Npc3RhbnQgc2VydmljZXMgd2l0aG91dCBjb21wcm9taXNpbmcgb24gcHJpdmFjeSByZXF1aXJlbWVudHMuCgojIyBFbmFibGluZyBISVBBQSBDb21wbGlhbmNlCgpISVBBQSBtb2RlIGlzIGFuIG9yZ2FuaXphdGlvbi13aWRlIHNldHRpbmcgdGhhdCBjaGFuZ2VzIGhvdyBWYXBpIGhhbmRsZXMgY2FsbCBsb2dzLCByZWNvcmRpbmdzLCBhbmQgdHJhbnNjcmlwdHMuIEl0IGFsc28gbGltaXRzIHRoZSBvcmdhbml6YXRpb24gdG8gY29tcGF0aWJsZSBtb2RlbCwgdm9pY2UsIGFuZCB0cmFuc2NyaWJlciBwcm92aWRlcnMuCgpUbyBlbmFibGUgSElQQUEgY29tcGxpYW5jZToKCjxTdGVwcz4KICA8U3RlcCB0aXRsZT0iQ29uZmlybSBlbGlnaWJpbGl0eSI+CiAgICBISVBBQSBpcyBhdmFpbGFibGUgYXMgYSBwYWlkIGNvbXBsaWFuY2UgYWRkLW9uIHdpdGggVXNhZ2Ugb25seSBvciBhbnkgU3VjY2VzcyBQYWNrYWdlLiBTZWUgW0J1eSBjb21wbGlhbmNlIGFuZCBkYXRhIGFkZC1vbnNdKC9iaWxsaW5nL21hbmFnZS1wYWNrYWdlcy1hbmQtYWRkLW9ucyNidXktY29tcGxpYW5jZS1hbmQtZGF0YS1hZGQtb25zKSB0byBhZGQgaXQuCgogIDwvU3RlcD4KCiAgPFN0ZXAgdGl0bGU9IlN0YXJ0IGluIHRoZSBEYXNoYm9hcmQiPgogICAgSW4gKipQYWNrYWdlcyAmIGFkZC1vbnMqKiwgc2VsZWN0ICoqSElQQUEgY29tcGxpYW5jZSoqLCB0aGVuIGVudGVyIHRoZSBCQUEgcmVjaXBpZW50J3MgbmFtZSBhbmQgb3JnYW5pemF0aW9uLiBUaGUgRGFzaGJvYXJkIGxldHMgeW91IGtub3cgdGhhdCBWYXBpIHdpbGwgZW1haWwgdGhlIEJBQSBmb3Igc2lnbmF0dXJlLgoKICA8L1N0ZXA+CgogIDxTdGVwIHRpdGxlPSJTaWduIHRoZSBCdXNpbmVzcyBBc3NvY2lhdGUgQWdyZWVtZW50IChCQUEpIj4KICAgIFJldmlldyBhbmQgc2lnbiB0aGUgQkFBIHNlbnQgYnkgZW1haWwsIHRoZW4gY29tcGxldGUgdGhlIHJlbWFpbmluZyBEYXNoYm9hcmQgcHJvbXB0cyB0byBhY3RpdmF0ZSAqKkhJUEFBIGNvbXBsaWFuY2UqKi4gSElQQUEgaXMgYW4gb3JnYW5pemF0aW9uLWxldmVsIHNldHRpbmc6IGl0IGFwcGxpZXMgdG8gZXZlcnkgYXNzaXN0YW50IGluIHlvdXIgb3JnYW5pemF0aW9uLCB3aXRoIG5vIHBlci1hc3Npc3RhbnQgZXhjZXB0aW9uLCBhbmQgaXQgY2Fubm90IGJlIGVuYWJsZWQgdGhyb3VnaCB0aGUgQVBJLgoKICA8L1N0ZXA+CgogIDxTdGVwIHRpdGxlPSJTd2l0Y2ggdG8gY29tcGxpYW50IHByb3ZpZGVycyI+CiAgICBVcGRhdGUgYW55IGFzc2lzdGFudCB1c2luZyBhIG5vbi1jb21wbGlhbnQgTExNLCB2b2ljZSwgb3IgdHJhbnNjcmliZXIgcHJvdmlkZXIuIFNlZSBbSElQQUEgY29tcGxpYW50IHByb3ZpZGVyc10oL3NlY3VyaXR5LWFuZC1wcml2YWN5L2hpcGFhI2hpcGFhLWNvbXBsaWFudC1wcm92aWRlcnMpIGZvciB0aGUgZnVsbCBsaXN0LiBWYXBpIHJlamVjdHMgY29uZmlndXJhdGlvbiBjaGFuZ2VzIHRoYXQgc2VsZWN0IGEgbm9uLWNvbXBsaWFudCBwcm92aWRlciB3aGlsZSBISVBBQSBtb2RlIGlzIG9uLiBZb3VyIGNhbGwgcmVjb3JkcywgdHJhbnNjcmlwdHMsIGFuZCBsb2dzIGFyZSB0aGVuIHN0b3JlZCBpbiBhIEhJUEFBIGNvbXBsaWFudCBtYW5uZXIuCiAgPC9TdGVwPgo8L1N0ZXBzPgoKPFdhcm5pbmc+CkhJUEFBIG1vZGUgYW5kIFplcm8gRGF0YSBSZXRlbnRpb24gKFpEUikgYXJlIG11dHVhbGx5IGV4Y2x1c2l2ZS4gRGlzYWJsZSBvbmUgYmVmb3JlIGVuYWJsaW5nIHRoZSBvdGhlci4gU2VlIFtaZXJvIERhdGEgUmV0ZW50aW9uIChaRFIpXSgvc2VjdXJpdHktYW5kLXByaXZhY3kvemVyby1kYXRhLXJldGVudGlvbikuCjwvV2FybmluZz4KCiMjIEhJUEFBIENvbXBsaWFudCBwcm92aWRlcnMKCldoZW4gZW5hYmxpbmcgSElQQUEgY29tcGxpYW5jZSwgb25seSBISVBBQSBjb21wbGlhbnQgcHJvdmlkZXJzIG1heSBiZSBjaG9zZW4uIFNlZSB0aGUgY3VycmVudCBsaXN0IG9mIEhJUEFBLWNvbXBsaWFudCBtb2RlbCwgdm9pY2UsIGFuZCB0cmFuc2NyaXB0aW9uIHByb3ZpZGVycyBvbiB0aGUgW1RydXN0IENlbnRlcl0oaHR0cHM6Ly9zZWN1cml0eS52YXBpLmFpL2l0ZW0vaGlwYWEpLgoKIyBGQVFzCgo8QWNjb3JkaW9uR3JvdXA+CiAgPEFjY29yZGlvbiB0aXRsZT0iV2lsbCBlbmFibGluZyBISVBBQSBjb21wbGlhbmNlIGFmZmVjdCB0aGUgcXVhbGl0eSBvZiBWYXBpJ3Mgc2VydmljZT8iPgogICAgRW5hYmxpbmcgSElQQUEgY29tcGxpYW5jZSBkb2VzIG5vdCBkZWdyYWRlIHRoZSBxdWFsaXR5IG9mIHRoZSB2b2ljZSBhc3Npc3RhbnQgc2VydmljZXMuIEhvd2V2ZXIsIGl0IGxpbWl0cyBhY2Nlc3MgdG8gY2VydGFpbiBmZWF0dXJlcywgc3VjaCBhcyByZXZpZXdpbmcgY2FsbCBsb2dzIG9yIHRyYW5zY3JpcHRpb25zLCB0aGF0IHNvbWUgdXNlcnMgbWF5IGZpbmQgdmFsdWFibGUgZm9yIHF1YWxpdHkgaW1wcm92ZW1lbnQgcHVycG9zZXMuCiAgPC9BY2NvcmRpb24+CiAgPEFjY29yZGlvbiB0aXRsZT0iV2hvIHNob3VsZCB1c2UgdGhlIEhJUEFBIGNvbXBsaWFuY2UgZmVhdHVyZT8iPgogICAgVGhpcyBmZWF0dXJlIGlzIHBhcnRpY3VsYXJseSB1c2VmdWwgZm9yIGJ1c2luZXNzZXMgYW5kIG9yZ2FuaXphdGlvbnMgaW4gdGhlIGhlYWx0aGNhcmUgc2VjdG9yIG9yIGFueSBlbnRpdHkgdGhhdCBoYW5kbGVzIHNlbnNpdGl2ZSBoZWFsdGggaW5mb3JtYXRpb24gYW5kIG11c3QgY29tcGx5IHdpdGggSElQQUEgcmVndWxhdGlvbnMuCiAgPC9BY2NvcmRpb24+CiAgPEFjY29yZGlvbiB0aXRsZT0iQ2FuIEkgc3dpdGNoIGJldHdlZW4gZGVmYXVsdCBhbmQgSElQQUEtY29tcGxpYW50IHNldHRpbmdzPyI+CiAgICBZZXMsIHlvdXIgb3JnYW5pemF0aW9uIGNhbiB0b2dnbGUgSElQQUEgbW9kZSBvbiBvciBvZmYgZnJvbSB0aGUgRGFzaGJvYXJkIGFzIG5lZWRlZC4gQ29uc2lkZXIgdGhlIGltcGxpY2F0aW9ucyBjYXJlZnVsbHkgZmlyc3Q6IHR1cm5pbmcgSElQQUEgbW9kZSBvZmYgYXBwbGllcyB0byB5b3VyIGVudGlyZSBvcmdhbml6YXRpb24sIG5vdCBqdXN0IG9uZSBhc3Npc3RhbnQuCiAgPC9BY2NvcmRpb24+CjwvQWNjb3JkaW9uR3JvdXA+CgojIyBXaGVyZSBjYW4gUEhJIGJlIHVzZWQgd2l0aCBWYXBpPwoKPEFjY29yZGlvbkdyb3VwPgogIDxBY2NvcmRpb24gdGl0bGU9IldoaWNoIGVuZHBvaW50cyBjYW4gY29udGFpbiBQcm90ZWN0ZWQgSGVhbHRoIEluZm9ybWF0aW9uIChQSEkpPyI+CiAgICBXaGVuIHVzaW5nIFZhcGkgd2l0aCBQSEksIHlvdSBtYXkgb25seSBwYXNzIFBISSB0aHJvdWdoIHRoZSBgL2NhbGxgIGVuZHBvaW50LiBBbGwgb3RoZXIgZW5kcG9pbnRzIGluIHRoZSBBUEkgUmVmZXJlbmNlIHNob3VsZCBub3QgY29udGFpbiBQSEkuIEZvciBleGFtcGxlLCB5b3Ugc2hvdWxkIG5vdCBwdXQgUEhJIGluIGFuIGAvYXNzaXN0YW50YCBwcm9tcHQgb3IgaW4gYSBgL3Bob25lLW51bWJlcmAgbGFiZWwuIFRoZSByZXN0cmljdGlvbiBhcHBsaWVzIHRvIGFsbCBjb25maWd1cmF0aW9uIGVuZHBvaW50cyB3aGVyZSBkYXRhIHdvdWxkIGJlIHN0b3JlZCBvbiBWYXBpJ3MgcGxhdGZvcm0uCiAgPC9BY2NvcmRpb24+CiAgPEFjY29yZGlvbiB0aXRsZT0iQXJlIHRoZXJlIHNwZWNpZmljIEhJUEFBLXNhZmUgZW5kcG9pbnRzIEkgc2hvdWxkIHVzZT8iPgogICAgTm8sIHRoZXJlIGFyZSBubyBkZXNpZ25hdGVkICJISVBBQS1zYWZlIGVuZHBvaW50cy4iIEluc3RlYWQsIHdoZW4gSElQQUEgbW9kZSBpcyB0dXJuZWQgb24sIFZhcGkgd2lsbCBvbmx5IHVzZSBISVBBQS1jb21wbGlhbnQgc2VydmljZXMgKHN1Y2ggYXMgQXp1cmUgT3BlbkFJKSBmb3IgcHJvY2Vzc2luZyBQSEkgdGhyb3VnaCB0aGUgcGlwZWxpbmUuIFRoZSB2b2ljZSBwaXBlbGluZSAoU1RUIOKGkiBMTE0g4oaSIFRUUykgY2FuIHByb2Nlc3MgUEhJIHdoZW4gcHJvcGVybHkgY29uZmlndXJlZCwgYnV0IFZhcGkgZG9lcyBub3Qgc3RvcmUgdGhpcyBkYXRhIG91dHNpZGUgaXRzIEhJUEFBLWNvbXBsaWFudCBzdG9yYWdlLgogIDwvQWNjb3JkaW9uPgo8L0FjY29yZGlvbkdyb3VwPgoKIyMgSElQQUEgQ29tcGxpYW5jZSBDb25maWd1cmF0aW9uCgo8QWNjb3JkaW9uR3JvdXA+CiAgPEFjY29yZGlvbiB0aXRsZT0iSG93IGRvIEkgZW5hYmxlIEhJUEFBIGNvbXBsaWFuY2Ugd2l0aCBWYXBpPyI+CiAgICBFbmFibGUgSElQQUEgbW9kZSBhdCB0aGUgb3JnYW5pemF0aW9uIGxldmVsLCBmcm9tIHRoZSBWYXBpIERhc2hib2FyZC4gVGhpcyBpcyB0aGUgb25seSB3YXkgdG8gZW5hYmxlIEhJUEFBIGNvbXBsaWFuY2UsIGFuZCBpdCBhcHBsaWVzIHRvIGV2ZXJ5IGFzc2lzdGFudCBpbiB5b3VyIG9yZ2FuaXphdGlvbi4gVGhlcmUgaXMgbm8gcGVyLWFzc2lzdGFudCBISVBBQSBzZXR0aW5nLgogIDwvQWNjb3JkaW9uPgogIDxBY2NvcmRpb24gdGl0bGU9IklmIEkgYnJpbmcgbXkgb3duIEhJUEFBLWNvbXBsaWFudCBwcm92aWRlciBrZXlzLCBkb2VzIHRoYXQgbWFrZSBldmVyeXRoaW5nIGNvbXBsaWFudD8iPgogICAgTm8uIEV2ZW4gd2hlbiB1c2luZyB5b3VyIG93biBISVBBQS1jb21wbGlhbnQgcHJvdmlkZXIga2V5cywgaXQgcmVtYWlucyB5b3VyIHJlc3BvbnNpYmlsaXR5IG5vdCB0byBzdG9yZSBQSEkgdmlhIFZhcGkncyBlbmRwb2ludHMuIFRoZSBtb2RlbCBrZXlzIGFyZSBhIHNlcGFyYXRlIGNvbmNlcm4gZnJvbSB0aGUgc3RvcmFnZSBvZiBQSEkgb24gVmFwaSdzIHBsYXRmb3JtLiBZb3UgbXVzdCBib3RoIHVzZSBISVBBQS1jb21wbGlhbnQga2V5cyBBTkQgZW5zdXJlIHlvdSdyZSBub3Qgc3RvcmluZyBQSEkgb24gVmFwaS4KICA8L0FjY29yZGlvbj4KPC9BY2NvcmRpb25Hcm91cD4KCiMjIFN0cnVjdHVyZWQgT3V0cHV0cyB3aXRoIEhJUEFBIE1vZGUKCldoZW4gSElQQUEgbW9kZSBpcyBlbmFibGVkLCBWYXBpIGRvZXMgbm90IHN0b3JlIHN0cnVjdHVyZWQgb3V0cHV0cyBieSBkZWZhdWx0LiBUaGlzIHByb3RlY3RzIHByaXZhY3kgYnV0IGxpbWl0cyB5b3VyIGFiaWxpdHkgdG8gdXNlIHN0cnVjdHVyZWQgb3V0cHV0cyBpbiBJbnNpZ2h0cyBhbmQgQ2FsbCBMb2dzLiBGb3Igbm9uLXNlbnNpdGl2ZSBvdXRwdXRzLCB5b3UgY2FuIG92ZXJyaWRlIHRoaXMgYmVoYXZpb3IuCgo8QWNjb3JkaW9uR3JvdXA+CiAgPEFjY29yZGlvbiB0aXRsZT0iSG93IGRvIHN0cnVjdHVyZWQgb3V0cHV0cyB3b3JrIHdpdGggSElQQUEgbW9kZSBlbmFibGVkPyI+CiAgICBCeSBkZWZhdWx0LCB3aGVuIEhJUEFBIG1vZGUgaXMgb24sIFZhcGkgZG9lc24ndCBzdG9yZSBzdHJ1Y3R1cmVkIG91dHB1dHMuIFRoaXMga2VlcHMgZGF0YSBwcml2YXRlIGJ1dCBsaW1pdHMgeW91ciBhYmlsaXR5IHRvIHVzZSBzdHJ1Y3R1cmVkIG91dHB1dHMgaW4gSW5zaWdodHMgYW5kIENhbGwgTG9ncy4KCiAgICBZb3UgY2FuIGVuYWJsZSBzdG9yYWdlIGZvciBzcGVjaWZpYyBzdHJ1Y3R1cmVkIG91dHB1dHMgdXNpbmcgdGhlIGBjb21wbGlhbmNlUGxhbi5mb3JjZVN0b3JlT25IaXBhYUVuYWJsZWRgIHNldHRpbmcuIFRoaXMgYWxsb3dzIHlvdSB0byBzdG9yZSBub24tc2Vuc2l0aXZlIG91dHB1dHMgZXZlbiB3aGVuIEhJUEFBIG1vZGUgaXMgYWN0aXZlLgoKICAgICoqSW1wb3J0YW50OioqIFlvdXIgb3JnYW5pemF0aW9uIGlzIHJlc3BvbnNpYmxlIGZvciBlbnN1cmluZyB0aGF0IGFueSBzdHJ1Y3R1cmVkIG91dHB1dCB3aXRoIHN0b3JhZ2UgZW5hYmxlZCBkb2VzIE5PVCBleHRyYWN0IG9yIGdlbmVyYXRlIFBISSBvciBzZW5zaXRpdmUgZGF0YS4gT25seSB1c2UgdGhpcyBmb3Igbm9uLXNlbnNpdGl2ZSBpbmZvcm1hdGlvbi4KICA8L0FjY29yZGlvbj4KCiAgPEFjY29yZGlvbiB0aXRsZT0iV2hlbiBzaG91bGQgSSBlbmFibGUgc3RvcmFnZSBmb3Igc3RydWN0dXJlZCBvdXRwdXRzIGluIEhJUEFBIG1vZGU/Ij4KICAgIEVuYWJsZSBzdG9yYWdlIE9OTFkgZm9yIHN0cnVjdHVyZWQgb3V0cHV0cyB0aGF0IGV4dHJhY3Qgbm9uLXNlbnNpdGl2ZSwgbm9uLVBISSBpbmZvcm1hdGlvbi4KCiAgICAqKlNhZmUgdXNlIGNhc2VzOioqCiAgICAtIEJvb2xlYW4gb3V0Y29tZXM6IGBhcHBvaW50bWVudEJvb2tlZDogdHJ1ZS9mYWxzZWAKICAgIC0gQ2FsbCBzdWNjZXNzIGluZGljYXRvcnM6IGBpc3N1ZVJlc29sdmVkOiB0cnVlL2ZhbHNlYAogICAgLSBHZW5lcmFsIGNhdGVnb3JpZXM6IGBpc3N1ZUNhdGVnb3J5OiAiYmlsbGluZyIgfCAidGVjaG5pY2FsIiB8ICJnZW5lcmFsImAKICAgIC0gU2F0aXNmYWN0aW9uIHNjb3JlczogYGNzYXRTY29yZTogMS0xMGAKICAgIC0gQ2FsbCBzZW50aW1lbnQ6IGBzZW50aW1lbnQ6ICJwb3NpdGl2ZSIgfCAibmV1dHJhbCIgfCAibmVnYXRpdmUiYAoKICAgICoqTmV2ZXIgZW5hYmxlIHN0b3JhZ2UgZm9yOioqCiAgICAtIFBhdGllbnQgZGlhZ25vc2lzIGluZm9ybWF0aW9uCiAgICAtIE1lZGljYWwgcmVjb3JkIG51bWJlcnMKICAgIC0gU29jaWFsIHNlY3VyaXR5IG51bWJlcnMKICAgIC0gQ3JlZGl0IGNhcmQgZGV0YWlscwogICAgLSBQYXRpZW50IG5hbWVzLCBkYXRlcyBvZiBiaXJ0aCwgb3IgY29udGFjdCBpbmZvcm1hdGlvbgogICAgLSBUcmVhdG1lbnQgcGxhbnMgb3IgbWVkaWNhdGlvbiBpbmZvcm1hdGlvbgoKICAgICoqV2FybmluZzoqKiBFbmFibGluZyBzdG9yYWdlIGZvciBvdXRwdXRzIGNvbnRhaW5pbmcgUEhJIHZpb2xhdGVzIEhJUEFBIGNvbXBsaWFuY2UgYW5kIHlvdXIgQkFBIHdpdGggVmFwaS4KICA8L0FjY29yZGlvbj4KCiAgPEFjY29yZGlvbiB0aXRsZT0iSG93IGRvIEkgY29uZmlndXJlIHN0cnVjdHVyZWQgb3V0cHV0IHN0b3JhZ2UgaW4gSElQQUEgbW9kZT8iPgogICAgWW91IGNhbiBlbmFibGUgc3RvcmFnZSBmb3Igc3BlY2lmaWMgc3RydWN0dXJlZCBvdXRwdXRzIHZpYSB0aGUgRGFzaGJvYXJkIG9yIEFQSS4KCiAgICAqKlZpYSBEYXNoYm9hcmQ6KioKICAgIDEuIE5hdmlnYXRlIHRvICoqU3RydWN0dXJlZCBPdXRwdXRzKiogaW4gdGhlIGxlZnQgc2lkZWJhcgogICAgMi4gQ3JlYXRlIG9yIGVkaXQgYSBzdHJ1Y3R1cmVkIG91dHB1dAogICAgMy4gRXhwYW5kIHRoZSAqKkNvbXBsaWFuY2UgU2V0dGluZ3MqKiBzZWN0aW9uCiAgICA0LiBFbmFibGUgdGhlIHRvZ2dsZSBmb3IgIkVuYWJsZSBTdG9yYWdlIG9mIFN0cnVjdHVyZWQgT3V0cHV0cyB3aGlsZSBvbiBISVBBQSBNb2RlIgogICAgNS4gT25seSBlbmFibGUgaWYgeW91ciBvdXRwdXQgZG9lcyBub3QgZXh0cmFjdCBzZW5zaXRpdmUgaW5mb3JtYXRpb24KCiAgICAqKlZpYSBBUEk6KioKCiAgICBXaGVuIGNyZWF0aW5nIGEgc3RydWN0dXJlZCBvdXRwdXQ6CmBgYGpzb24KICAgIHsKICAgICAgIm5hbWUiOiAiQXBwb2ludG1lbnQgQm9va2VkIiwKICAgICAgInR5cGUiOiAiYWkiLAogICAgICAic2NoZW1hIjogewogICAgICAgICJ0eXBlIjogImJvb2xlYW4iLAogICAgICAgICJkZXNjcmlwdGlvbiI6ICJXaGV0aGVyIGFuIGFwcG9pbnRtZW50IHdhcyBzdWNjZXNzZnVsbHkgYm9va2VkIgogICAgICB9LAogICAgICAiY29tcGxpYW5jZVBsYW4iOiB7CiAgICAgICAgImZvcmNlU3RvcmVPbkhpcGFhRW5hYmxlZCI6IHRydWUKICAgICAgfQogICAgfQpgYGAKCiAgICBXaGVuIHVwZGF0aW5nIGEgc3RydWN0dXJlZCBvdXRwdXQ6CmBgYGpzb24KICAgIHsKICAgICAgImNvbXBsaWFuY2VQbGFuIjogewogICAgICAgICJmb3JjZVN0b3JlT25IaXBhYUVuYWJsZWQiOiB0cnVlCiAgICAgIH0KICAgIH0KYGBgCgogICAgKipJTVBPUlRBTlQ6KiogT25seSBzZXQgYGZvcmNlU3RvcmVPbkhpcGFhRW5hYmxlZDogdHJ1ZWAgaWYgeW91IGFyZSBjZXJ0YWluIHlvdXIgc3RydWN0dXJlZCBvdXRwdXQgZG9lcyBOT1QgZXh0cmFjdCBQSEkgb3Igc2Vuc2l0aXZlIGRhdGEuIFlvdXIgb3JnYW5pemF0aW9uIGlzIHJlc3BvbnNpYmxlIGZvciBlbnN1cmluZyBjb21wbGlhbmNlLiBNaXN1c2UgY291bGQgcmVzdWx0IGluIEJBQSB2aW9sYXRpb25zLgogIDwvQWNjb3JkaW9uPgo8L0FjY29yZGlvbkdyb3VwPgoKIyMgQmVzdCBQcmFjdGljZXMKCjxBY2NvcmRpb25Hcm91cD4KICA8QWNjb3JkaW9uIHRpdGxlPSJXaGF0IGFyZSBiZXN0IHByYWN0aWNlcyBmb3IgZW5zdXJpbmcgSElQQUEgY29tcGxpYW5jZSB3aXRoIFZhcGk/Ij4KICAgIC0gRW5hYmxlIEhJUEFBIG1vZGUgYXQgdGhlIG9yZ2FuaXphdGlvbiBsZXZlbCwgZnJvbSB0aGUgRGFzaGJvYXJkCiAgICAtIEVuc3VyZSB0aGF0IFBISSBvbmx5IHBhc3NlcyB0aHJvdWdoIHRoZSBjYWxsIHBpcGVsaW5lIGFuZCBpcyBub3Qgc3RvcmVkIGluIGNvbmZpZ3VyYXRpb24KICAgIC0gVXNlIEhJUEFBLWNvbXBsaWFudCBhY2NvdW50cyB3aXRoIGFsbCB0aGlyZC1wYXJ0eSBwcm92aWRlcnMgKFNUVCwgTExNLCBUVFMpCiAgICAtIE5ldmVyIHVzZSByZWFsIFBISSBpbiBhbiBvcmdhbml6YXRpb24gdGhhdCBoYXMgbm90IGVuYWJsZWQgSElQQUEgbW9kZSwgaW5jbHVkaW5nIGZvciB0ZXN0aW5nIG9yIGRlbW9zCiAgICAtIFJlbWVtYmVyIHRoYXQgY2FsbCByZWNvcmRpbmdzLCB0cmFuc2NyaXB0cywgYW5kIGxvZ3MgYXJlIHN0aWxsIHN0b3JlZCwgaW4gVmFwaSdzIHByaXZhdGUgSElQQUEtY29tcGxpYW50IHN0b3JhZ2UsIHVubGVzcyB5b3UgY29uZmlndXJlIHlvdXIgb3duIHN0b3JhZ2UKICA8L0FjY29yZGlvbj4KICA8QWNjb3JkaW9uIHRpdGxlPSJDYW4gSSBoYXZlIGJvdGggSElQQUEtY29tcGxpYW50IGFuZCBub24tSElQQUEtY29tcGxpYW50IGFzc2lzdGFudHM/Ij4KICAgIE5vLiBISVBBQSBtb2RlIGlzIGVuYWJsZWQgYXQgdGhlIG9yZ2FuaXphdGlvbiBsZXZlbCBhbmQgYXBwbGllcyB0byBldmVyeSBhc3Npc3RhbnQgaW4gdGhhdCBvcmdhbml6YXRpb24uIFRoZXJlIGlzIG5vIHdheSB0byBleGNsdWRlIGEgc3BlY2lmaWMgYXNzaXN0YW50LiBJZiB5b3VyIG9yZ2FuaXphdGlvbiBoYXMgbm90IGVuYWJsZWQgSElQQUEgbW9kZSwgbm9uZSBvZiB5b3VyIGFzc2lzdGFudHMgYXJlIEhJUEFBLWNvbXBsaWFudCwgcmVnYXJkbGVzcyBvZiBhbnkgb3RoZXIgY29uZmlndXJhdGlvbi4gTmV2ZXIgdXNlIHJlYWwgUEhJIHVudGlsIEhJUEFBIG1vZGUgaXMgZW5hYmxlZCBmb3IgeW91ciBvcmdhbml6YXRpb24uCiAgPC9BY2NvcmRpb24+CiAgPEFjY29yZGlvbiB0aXRsZT0iV2hhdCBpcyBteSByZXNwb25zaWJpbGl0eSB1bmRlciB0aGUgQkFBIHdpdGggVmFwaT8iPgogICAgVW5kZXIgdGhlIEJ1c2luZXNzIEFzc29jaWF0ZSBBZ3JlZW1lbnQgKEJBQSksIHlvdSBhZ3JlZToKICAgIDEuIE5vdCB0byBpbnRyb2R1Y2UgUEhJIG9udG8gVmFwaSdzIHBsYXRmb3JtIHRocm91Z2ggaXRzIEFQSSBvciBkYXNoYm9hcmQgZXhjZXB0IGFzIHBlcm1pdHRlZAogICAgMi4gVG8gdXNlIEhJUEFBLWNvbXBsaWFudCBhY2NvdW50cyB3aXRoIGV4dGVybmFsIHByb3ZpZGVycyB3aGVuIHByb3ZpZGluZyBrZXlzCiAgICAzLiBUbyBvbmx5IHVzZSBISVBBQS1jb21wbGlhbnQgcHJvdmlkZXJzIHRoYXQgVmFwaSBoYXMgc2lnbmVkIGEgQkFBIHdpdGggd2hlbiBub3QgcHJvdmlkaW5nIGtleXMuIFNlZSBbSElQQUEgY29tcGxpYW50IHByb3ZpZGVyc10oI2hpcGFhLWNvbXBsaWFudC1wcm92aWRlcnMpIGZvciB0aGUgY3VycmVudCBsaXN0LgogICAgNC4gVG8gdXNlIHRoZSBwbGF0Zm9ybSBpbiBhY2NvcmRhbmNlIHdpdGggYWxsIEJBQSByZXF1aXJlbWVudHMKICA8L0FjY29yZGlvbj4KPC9BY2NvcmRpb25Hcm91cD4KCiMjIFJldHJpZXZpbmcgQ2FsbCBBcnRpZmFjdHMgZnJvbSBQcml2YXRlIFN0b3JhZ2UKCkZvciBISVBBQS1lbmFibGVkIG9yZ2FuaXphdGlvbnMsIGNhbGwgcmVjb3JkaW5ncyBhbmQgbG9ncyBhcmUgc3RvcmVkIGluIGEgcHJpdmF0ZSBidWNrZXQgYW5kIGNhbm5vdCBiZSBkb3dubG9hZGVkIGRpcmVjdGx5IGZyb20gdGhlIFVSTHMgcmV0dXJuZWQgaW4gd2ViaG9va3Mgb3IgQVBJIHJlc3BvbnNlcy4gVG8gcmV0cmlldmUgcmVjb3JkaW5ncywgY2FsbCBsb2dzLCBvciBvdGhlciBhcnRpZmFjdHMsIGNhbGwgdGhlIFZhcGkgQVBJIHdpdGggeW91ciBQcml2YXRlIEFQSSBLZXksIHNlZSBbUmV0cmlldmUgY2FsbCBhcnRpZmFjdHNdKC9hc3Npc3RhbnRzL3JldHJpZXZlLWNhbGwtYXJ0aWZhY3RzKSBmb3IgdGhlIGZ1bGwgbGlzdCBvZiBlbmRwb2ludHMgYW5kIGV4YW1wbGUgcmVxdWVzdHMuIFRoaXMgcmV0cmlldmFsIG1ldGhvZCBpcyB0aGUgc2FtZSBmb3IgSElQQUEgYW5kIG5vbi1ISVBBQSBvcmdhbml6YXRpb25zIGFsaWtlLgoKIyMgTmVlZCBGdXJ0aGVyIEFzc2lzdGFuY2U/CgpJZiB5b3UgaGF2ZSBtb3JlIHF1ZXN0aW9ucyBhYm91dCBwcml2YWN5LCBISVBBQSBjb21wbGlhbmNlLCBvciBob3cgdG8gY29uZmlndXJlIHlvdXIgVmFwaSBhc3Npc3RhbnQsIG91ciBzdXBwb3J0IHRlYW0gaXMgaGVyZSB0byBoZWxwLiBDb250YWN0IHVzIGF0IHNlY3VyaXR5QHZhcGkuYWkgZm9yIHBlcnNvbmFsaXplZCBhc3Npc3RhbmNlIGFuZCBtb3JlIGluZm9ybWF0aW9uIG9uIGhvdyB0byBtYWtlIHRoZSBtb3N0IG9mIFZhcGkncyB2b2ljZSBhc3Npc3RhbnQgcGxhdGZvcm0gd2hpbGUgZW5zdXJpbmcgeW91ciBkYXRhIHJlbWFpbnMgcHJvdGVjdGVkLgo= \ No newline at end of file From 044e45eb3f322091c45e36c4d95d7eeb8dcfa934 Mon Sep 17 00:00:00 2001 From: Stephen Smith Date: Fri, 18 Sep 2026 09:38:02 -0700 Subject: [PATCH 2/2] Update HIPAA compliant providers section Co-Authored-By: Claude Opus 4.8 --- fern/security-and-privacy/hipaa.mdx | 198 +++++++++++++++++++++++++++- 1 file changed, 197 insertions(+), 1 deletion(-) diff --git a/fern/security-and-privacy/hipaa.mdx b/fern/security-and-privacy/hipaa.mdx index eff1a560e..462b10173 100644 --- a/fern/security-and-privacy/hipaa.mdx +++ b/fern/security-and-privacy/hipaa.mdx @@ -1 +1,197 @@ -LS0tCnRpdGxlOiBISVBBQSBDb21wbGlhbmNlCnN1YnRpdGxlOiBMZWFybiBob3cgdG8gZW5zdXJlIHByaXZhY3kgd2hlbiB1c2luZyBWYXBpJ3Mgdm9pY2UgYXNzaXN0YW50IHBsYXRmb3JtCmRlc2NyaXB0aW9uOiBISVBBQSBvbiBWYXBpLiBFbmFibGUgb3JnYW5pemF0aW9uLXdpZGUgY29tcGxpYW5jZSBtb2RlLCB1c2UgYXBwcm92ZWQgTExNLCB2b2ljZSwgYW5kIHRyYW5zY3JpYmVyIHByb3ZpZGVycywgYW5kIGNvbnRyb2wgaG93IGNhbGwgcmVjb3JkaW5ncyBhbmQgbG9ncyBhcmUgc3RvcmVkLgpzbHVnOiBzZWN1cml0eS1hbmQtcHJpdmFjeS9oaXBhYQotLS0KCiMjIEludHJvZHVjdGlvbiB0byBQcml2YWN5IGF0IFZhcGkKCkF0IFZhcGksIHdlIGFyZSBjb21taXR0ZWQgdG8gZGVsaXZlcmluZyBleGNlcHRpb25hbCB2b2ljZSBhc3Npc3RhbnQgc2VydmljZXMgd2hpbGUgdXBob2xkaW5nIHRoZSBoaWdoZXN0IHN0YW5kYXJkcyBvZiBwcml2YWN5IGFuZCBkYXRhIHByb3RlY3Rpb24gZm9yIG91ciB1c2Vycy4gV2UgdW5kZXJzdGFuZCB0aGUgaW1wb3J0YW5jZSBvZiBiYWxhbmNpbmcgc2VydmljZSBxdWFsaXR5IHdpdGggdGhlIG5lZWQgdG8gcmVzcGVjdCBhbmQgcHJvdGVjdCBwZXJzb25hbCBhbmQgc2Vuc2l0aXZlIGluZm9ybWF0aW9uLiBPdXIgcHJpdmFjeSBwb2xpY2llcyBhbmQgcHJhY3RpY2VzIGFyZSBkZXNpZ25lZCB0byBnaXZlIHlvdSBjb250cm9sIG92ZXIgeW91ciBkYXRhIHdoaWxlIGJlbmVmaXRpbmcgZnJvbSB0aGUgZnVsbCBjYXBhYmlsaXRpZXMgb2Ygb3VyIHBsYXRmb3JtLgoKIyMgVW5kZXJzdGFuZGluZyBISVBBQSBDb21wbGlhbmNlIEJhc2ljcwoKVGhlIEhlYWx0aCBJbnN1cmFuY2UgUG9ydGFiaWxpdHkgYW5kIEFjY291bnRhYmlsaXR5IEFjdCAoSElQQUEpIGlzIGEgVW5pdGVkIFN0YXRlcyBsZWdpc2xhdGlvbiB0aGF0IHByb3ZpZGVzIGRhdGEgcHJpdmFjeSBhbmQgc2VjdXJpdHkgcHJvdmlzaW9ucyBmb3Igc2FmZWd1YXJkaW5nIG1lZGljYWwgaW5mb3JtYXRpb24uIEhJUEFBIGNvbXBsaWFuY2UgaXMgY3J1Y2lhbCBmb3IgYW55IGVudGl0eSB0aGF0IGRlYWxzIHdpdGggcHJvdGVjdGVkIGhlYWx0aCBpbmZvcm1hdGlvbiAoUEhJKSwgZW5zdXJpbmcgdGhhdCBzZW5zaXRpdmUgcGF0aWVudCBkYXRhIGlzIGhhbmRsZWQsIHN0b3JlZCwgYW5kIHRyYW5zbWl0dGVkIHdpdGggdGhlIGhpZ2hlc3Qgc3RhbmRhcmRzIG9mIHNlY3VyaXR5IGFuZCBjb25maWRlbnRpYWxpdHkuIFRoZSBrZXkgY29uY2VwdHMgb2YgSElQQUEgY29tcGxpYW5jZSBpbmNsdWRlIHRoZSBQcml2YWN5IFJ1bGUsIHdoaWNoIHByb3RlY3RzIHRoZSBwcml2YWN5IG9mIGluZGl2aWR1YWxseSBpZGVudGlmaWFibGUgaGVhbHRoIGluZm9ybWF0aW9uOyB0aGUgU2VjdXJpdHkgUnVsZSwgd2hpY2ggc2V0cyBzdGFuZGFyZHMgZm9yIHRoZSBzZWN1cml0eSBvZiBlbGVjdHJvbmljIHByb3RlY3RlZCBoZWFsdGggaW5mb3JtYXRpb24gKGUtUEhJKTsgYW5kIHRoZSBCcmVhY2ggTm90aWZpY2F0aW9uIFJ1bGUsIHdoaWNoIHJlcXVpcmVzIGNvdmVyZWQgZW50aXRpZXMgdG8gbm90aWZ5IGluZGl2aWR1YWxzLCBISFMsIGFuZCBpbiBzb21lIGNhc2VzLCB0aGUgbWVkaWEgb2YgYSBicmVhY2ggb2YgdW5zZWN1cmVkIFBISS4gQ29tcGxpYW5jZSB3aXRoIHRoZXNlIHJ1bGVzIGlzIG5vdCBqdXN0IGFib3V0IGFkaGVyaW5nIHRvIGxlZ2FsIHJlcXVpcmVtZW50cyBidXQgYWxzbyBhYm91dCBidWlsZGluZyB0cnVzdCB3aXRoIHlvdXIgY3VzdG9tZXJzIGJ5IGRlbW9uc3RyYXRpbmcgeW91ciBjb21taXRtZW50IHRvIHByb3RlY3RpbmcgdGhlaXIgc2Vuc2l0aXZlIGRhdGEuCgojIyBVbmRlcnN0YW5kaW5nIERlZmF1bHQgU2V0dGluZ3MKCkJ5IGRlZmF1bHQsIFZhcGkgcmVjb3JkcyB5b3VyIGNhbGxzIGFuZCBzdG9yZXMgbG9ncyBhbmQgdHJhbnNjcmlwdGlvbnMuIFRoaXMgcHJhY3RpY2UgaXMgYWltZWQgYXQgY29udGludW91c2x5IGltcHJvdmluZyB0aGUgcXVhbGl0eSBvZiBvdXIgc2VydmljZSwgZW5zdXJpbmcgdGhhdCB5b3UgcmVjZWl2ZSB0aGUgYmVzdCBwb3NzaWJsZSBleHBlcmllbmNlLiBIb3dldmVyLCB3ZSByZWNvZ25pemUgdGhlIGltcG9ydGFuY2Ugb2YgcHJpdmFjeSBhbmQgcHJvdmlkZSBvcHRpb25zIGZvciB1c2VycyB3aG8gcHJlZmVyIG1vcmUgY29udHJvbCBvdmVyIHRoZWlyIGRhdGEuIAoKIyMgT3B0aW5nIGZvciBQcml2YWN5OiBUaGUgSElQQUEgQ29tcGxpYW5jZSBPcHRpb24KCkZvciB1c2VycyBwcmlvcml0aXppbmcgcHJpdmFjeSwgcGFydGljdWxhcmx5IGluIGNvbXBsaWFuY2Ugd2l0aCB0aGUgSGVhbHRoIEluc3VyYW5jZSBQb3J0YWJpbGl0eSBhbmQgQWNjb3VudGFiaWxpdHkgQWN0IChISVBBQSkuIENob29zaW5nIEhJUEFBIGNvbXBsaWFuY2UgdGhyb3VnaCBvdXIgcGxhdGZvcm0gZW5zdXJlcyB0aGF0IHlvdSBjYW4gc3RpbGwgdXNlIG91ciB2b2ljZSBhc3Npc3RhbnQgc2VydmljZXMgd2l0aG91dCBjb21wcm9taXNpbmcgb24gcHJpdmFjeSByZXF1aXJlbWVudHMuCgojIyBFbmFibGluZyBISVBBQSBDb21wbGlhbmNlCgpISVBBQSBtb2RlIGlzIGFuIG9yZ2FuaXphdGlvbi13aWRlIHNldHRpbmcgdGhhdCBjaGFuZ2VzIGhvdyBWYXBpIGhhbmRsZXMgY2FsbCBsb2dzLCByZWNvcmRpbmdzLCBhbmQgdHJhbnNjcmlwdHMuIEl0IGFsc28gbGltaXRzIHRoZSBvcmdhbml6YXRpb24gdG8gY29tcGF0aWJsZSBtb2RlbCwgdm9pY2UsIGFuZCB0cmFuc2NyaWJlciBwcm92aWRlcnMuCgpUbyBlbmFibGUgSElQQUEgY29tcGxpYW5jZToKCjxTdGVwcz4KICA8U3RlcCB0aXRsZT0iQ29uZmlybSBlbGlnaWJpbGl0eSI+CiAgICBISVBBQSBpcyBhdmFpbGFibGUgYXMgYSBwYWlkIGNvbXBsaWFuY2UgYWRkLW9uIHdpdGggVXNhZ2Ugb25seSBvciBhbnkgU3VjY2VzcyBQYWNrYWdlLiBTZWUgW0J1eSBjb21wbGlhbmNlIGFuZCBkYXRhIGFkZC1vbnNdKC9iaWxsaW5nL21hbmFnZS1wYWNrYWdlcy1hbmQtYWRkLW9ucyNidXktY29tcGxpYW5jZS1hbmQtZGF0YS1hZGQtb25zKSB0byBhZGQgaXQuCgogIDwvU3RlcD4KCiAgPFN0ZXAgdGl0bGU9IlN0YXJ0IGluIHRoZSBEYXNoYm9hcmQiPgogICAgSW4gKipQYWNrYWdlcyAmIGFkZC1vbnMqKiwgc2VsZWN0ICoqSElQQUEgY29tcGxpYW5jZSoqLCB0aGVuIGVudGVyIHRoZSBCQUEgcmVjaXBpZW50J3MgbmFtZSBhbmQgb3JnYW5pemF0aW9uLiBUaGUgRGFzaGJvYXJkIGxldHMgeW91IGtub3cgdGhhdCBWYXBpIHdpbGwgZW1haWwgdGhlIEJBQSBmb3Igc2lnbmF0dXJlLgoKICA8L1N0ZXA+CgogIDxTdGVwIHRpdGxlPSJTaWduIHRoZSBCdXNpbmVzcyBBc3NvY2lhdGUgQWdyZWVtZW50IChCQUEpIj4KICAgIFJldmlldyBhbmQgc2lnbiB0aGUgQkFBIHNlbnQgYnkgZW1haWwsIHRoZW4gY29tcGxldGUgdGhlIHJlbWFpbmluZyBEYXNoYm9hcmQgcHJvbXB0cyB0byBhY3RpdmF0ZSAqKkhJUEFBIGNvbXBsaWFuY2UqKi4gSElQQUEgaXMgYW4gb3JnYW5pemF0aW9uLWxldmVsIHNldHRpbmc6IGl0IGFwcGxpZXMgdG8gZXZlcnkgYXNzaXN0YW50IGluIHlvdXIgb3JnYW5pemF0aW9uLCB3aXRoIG5vIHBlci1hc3Npc3RhbnQgZXhjZXB0aW9uLCBhbmQgaXQgY2Fubm90IGJlIGVuYWJsZWQgdGhyb3VnaCB0aGUgQVBJLgoKICA8L1N0ZXA+CgogIDxTdGVwIHRpdGxlPSJTd2l0Y2ggdG8gY29tcGxpYW50IHByb3ZpZGVycyI+CiAgICBVcGRhdGUgYW55IGFzc2lzdGFudCB1c2luZyBhIG5vbi1jb21wbGlhbnQgTExNLCB2b2ljZSwgb3IgdHJhbnNjcmliZXIgcHJvdmlkZXIuIFNlZSBbSElQQUEgY29tcGxpYW50IHByb3ZpZGVyc10oL3NlY3VyaXR5LWFuZC1wcml2YWN5L2hpcGFhI2hpcGFhLWNvbXBsaWFudC1wcm92aWRlcnMpIGZvciB0aGUgZnVsbCBsaXN0LiBWYXBpIHJlamVjdHMgY29uZmlndXJhdGlvbiBjaGFuZ2VzIHRoYXQgc2VsZWN0IGEgbm9uLWNvbXBsaWFudCBwcm92aWRlciB3aGlsZSBISVBBQSBtb2RlIGlzIG9uLiBZb3VyIGNhbGwgcmVjb3JkcywgdHJhbnNjcmlwdHMsIGFuZCBsb2dzIGFyZSB0aGVuIHN0b3JlZCBpbiBhIEhJUEFBIGNvbXBsaWFudCBtYW5uZXIuCiAgPC9TdGVwPgo8L1N0ZXBzPgoKPFdhcm5pbmc+CkhJUEFBIG1vZGUgYW5kIFplcm8gRGF0YSBSZXRlbnRpb24gKFpEUikgYXJlIG11dHVhbGx5IGV4Y2x1c2l2ZS4gRGlzYWJsZSBvbmUgYmVmb3JlIGVuYWJsaW5nIHRoZSBvdGhlci4gU2VlIFtaZXJvIERhdGEgUmV0ZW50aW9uIChaRFIpXSgvc2VjdXJpdHktYW5kLXByaXZhY3kvemVyby1kYXRhLXJldGVudGlvbikuCjwvV2FybmluZz4KCiMjIEhJUEFBIENvbXBsaWFudCBwcm92aWRlcnMKCldoZW4gZW5hYmxpbmcgSElQQUEgY29tcGxpYW5jZSwgb25seSBISVBBQSBjb21wbGlhbnQgcHJvdmlkZXJzIG1heSBiZSBjaG9zZW4uIFNlZSB0aGUgY3VycmVudCBsaXN0IG9mIEhJUEFBLWNvbXBsaWFudCBtb2RlbCwgdm9pY2UsIGFuZCB0cmFuc2NyaXB0aW9uIHByb3ZpZGVycyBvbiB0aGUgW1RydXN0IENlbnRlcl0oaHR0cHM6Ly9zZWN1cml0eS52YXBpLmFpL2l0ZW0vaGlwYWEpLgoKIyBGQVFzCgo8QWNjb3JkaW9uR3JvdXA+CiAgPEFjY29yZGlvbiB0aXRsZT0iV2lsbCBlbmFibGluZyBISVBBQSBjb21wbGlhbmNlIGFmZmVjdCB0aGUgcXVhbGl0eSBvZiBWYXBpJ3Mgc2VydmljZT8iPgogICAgRW5hYmxpbmcgSElQQUEgY29tcGxpYW5jZSBkb2VzIG5vdCBkZWdyYWRlIHRoZSBxdWFsaXR5IG9mIHRoZSB2b2ljZSBhc3Npc3RhbnQgc2VydmljZXMuIEhvd2V2ZXIsIGl0IGxpbWl0cyBhY2Nlc3MgdG8gY2VydGFpbiBmZWF0dXJlcywgc3VjaCBhcyByZXZpZXdpbmcgY2FsbCBsb2dzIG9yIHRyYW5zY3JpcHRpb25zLCB0aGF0IHNvbWUgdXNlcnMgbWF5IGZpbmQgdmFsdWFibGUgZm9yIHF1YWxpdHkgaW1wcm92ZW1lbnQgcHVycG9zZXMuCiAgPC9BY2NvcmRpb24+CiAgPEFjY29yZGlvbiB0aXRsZT0iV2hvIHNob3VsZCB1c2UgdGhlIEhJUEFBIGNvbXBsaWFuY2UgZmVhdHVyZT8iPgogICAgVGhpcyBmZWF0dXJlIGlzIHBhcnRpY3VsYXJseSB1c2VmdWwgZm9yIGJ1c2luZXNzZXMgYW5kIG9yZ2FuaXphdGlvbnMgaW4gdGhlIGhlYWx0aGNhcmUgc2VjdG9yIG9yIGFueSBlbnRpdHkgdGhhdCBoYW5kbGVzIHNlbnNpdGl2ZSBoZWFsdGggaW5mb3JtYXRpb24gYW5kIG11c3QgY29tcGx5IHdpdGggSElQQUEgcmVndWxhdGlvbnMuCiAgPC9BY2NvcmRpb24+CiAgPEFjY29yZGlvbiB0aXRsZT0iQ2FuIEkgc3dpdGNoIGJldHdlZW4gZGVmYXVsdCBhbmQgSElQQUEtY29tcGxpYW50IHNldHRpbmdzPyI+CiAgICBZZXMsIHlvdXIgb3JnYW5pemF0aW9uIGNhbiB0b2dnbGUgSElQQUEgbW9kZSBvbiBvciBvZmYgZnJvbSB0aGUgRGFzaGJvYXJkIGFzIG5lZWRlZC4gQ29uc2lkZXIgdGhlIGltcGxpY2F0aW9ucyBjYXJlZnVsbHkgZmlyc3Q6IHR1cm5pbmcgSElQQUEgbW9kZSBvZmYgYXBwbGllcyB0byB5b3VyIGVudGlyZSBvcmdhbml6YXRpb24sIG5vdCBqdXN0IG9uZSBhc3Npc3RhbnQuCiAgPC9BY2NvcmRpb24+CjwvQWNjb3JkaW9uR3JvdXA+CgojIyBXaGVyZSBjYW4gUEhJIGJlIHVzZWQgd2l0aCBWYXBpPwoKPEFjY29yZGlvbkdyb3VwPgogIDxBY2NvcmRpb24gdGl0bGU9IldoaWNoIGVuZHBvaW50cyBjYW4gY29udGFpbiBQcm90ZWN0ZWQgSGVhbHRoIEluZm9ybWF0aW9uIChQSEkpPyI+CiAgICBXaGVuIHVzaW5nIFZhcGkgd2l0aCBQSEksIHlvdSBtYXkgb25seSBwYXNzIFBISSB0aHJvdWdoIHRoZSBgL2NhbGxgIGVuZHBvaW50LiBBbGwgb3RoZXIgZW5kcG9pbnRzIGluIHRoZSBBUEkgUmVmZXJlbmNlIHNob3VsZCBub3QgY29udGFpbiBQSEkuIEZvciBleGFtcGxlLCB5b3Ugc2hvdWxkIG5vdCBwdXQgUEhJIGluIGFuIGAvYXNzaXN0YW50YCBwcm9tcHQgb3IgaW4gYSBgL3Bob25lLW51bWJlcmAgbGFiZWwuIFRoZSByZXN0cmljdGlvbiBhcHBsaWVzIHRvIGFsbCBjb25maWd1cmF0aW9uIGVuZHBvaW50cyB3aGVyZSBkYXRhIHdvdWxkIGJlIHN0b3JlZCBvbiBWYXBpJ3MgcGxhdGZvcm0uCiAgPC9BY2NvcmRpb24+CiAgPEFjY29yZGlvbiB0aXRsZT0iQXJlIHRoZXJlIHNwZWNpZmljIEhJUEFBLXNhZmUgZW5kcG9pbnRzIEkgc2hvdWxkIHVzZT8iPgogICAgTm8sIHRoZXJlIGFyZSBubyBkZXNpZ25hdGVkICJISVBBQS1zYWZlIGVuZHBvaW50cy4iIEluc3RlYWQsIHdoZW4gSElQQUEgbW9kZSBpcyB0dXJuZWQgb24sIFZhcGkgd2lsbCBvbmx5IHVzZSBISVBBQS1jb21wbGlhbnQgc2VydmljZXMgKHN1Y2ggYXMgQXp1cmUgT3BlbkFJKSBmb3IgcHJvY2Vzc2luZyBQSEkgdGhyb3VnaCB0aGUgcGlwZWxpbmUuIFRoZSB2b2ljZSBwaXBlbGluZSAoU1RUIOKGkiBMTE0g4oaSIFRUUykgY2FuIHByb2Nlc3MgUEhJIHdoZW4gcHJvcGVybHkgY29uZmlndXJlZCwgYnV0IFZhcGkgZG9lcyBub3Qgc3RvcmUgdGhpcyBkYXRhIG91dHNpZGUgaXRzIEhJUEFBLWNvbXBsaWFudCBzdG9yYWdlLgogIDwvQWNjb3JkaW9uPgo8L0FjY29yZGlvbkdyb3VwPgoKIyMgSElQQUEgQ29tcGxpYW5jZSBDb25maWd1cmF0aW9uCgo8QWNjb3JkaW9uR3JvdXA+CiAgPEFjY29yZGlvbiB0aXRsZT0iSG93IGRvIEkgZW5hYmxlIEhJUEFBIGNvbXBsaWFuY2Ugd2l0aCBWYXBpPyI+CiAgICBFbmFibGUgSElQQUEgbW9kZSBhdCB0aGUgb3JnYW5pemF0aW9uIGxldmVsLCBmcm9tIHRoZSBWYXBpIERhc2hib2FyZC4gVGhpcyBpcyB0aGUgb25seSB3YXkgdG8gZW5hYmxlIEhJUEFBIGNvbXBsaWFuY2UsIGFuZCBpdCBhcHBsaWVzIHRvIGV2ZXJ5IGFzc2lzdGFudCBpbiB5b3VyIG9yZ2FuaXphdGlvbi4gVGhlcmUgaXMgbm8gcGVyLWFzc2lzdGFudCBISVBBQSBzZXR0aW5nLgogIDwvQWNjb3JkaW9uPgogIDxBY2NvcmRpb24gdGl0bGU9IklmIEkgYnJpbmcgbXkgb3duIEhJUEFBLWNvbXBsaWFudCBwcm92aWRlciBrZXlzLCBkb2VzIHRoYXQgbWFrZSBldmVyeXRoaW5nIGNvbXBsaWFudD8iPgogICAgTm8uIEV2ZW4gd2hlbiB1c2luZyB5b3VyIG93biBISVBBQS1jb21wbGlhbnQgcHJvdmlkZXIga2V5cywgaXQgcmVtYWlucyB5b3VyIHJlc3BvbnNpYmlsaXR5IG5vdCB0byBzdG9yZSBQSEkgdmlhIFZhcGkncyBlbmRwb2ludHMuIFRoZSBtb2RlbCBrZXlzIGFyZSBhIHNlcGFyYXRlIGNvbmNlcm4gZnJvbSB0aGUgc3RvcmFnZSBvZiBQSEkgb24gVmFwaSdzIHBsYXRmb3JtLiBZb3UgbXVzdCBib3RoIHVzZSBISVBBQS1jb21wbGlhbnQga2V5cyBBTkQgZW5zdXJlIHlvdSdyZSBub3Qgc3RvcmluZyBQSEkgb24gVmFwaS4KICA8L0FjY29yZGlvbj4KPC9BY2NvcmRpb25Hcm91cD4KCiMjIFN0cnVjdHVyZWQgT3V0cHV0cyB3aXRoIEhJUEFBIE1vZGUKCldoZW4gSElQQUEgbW9kZSBpcyBlbmFibGVkLCBWYXBpIGRvZXMgbm90IHN0b3JlIHN0cnVjdHVyZWQgb3V0cHV0cyBieSBkZWZhdWx0LiBUaGlzIHByb3RlY3RzIHByaXZhY3kgYnV0IGxpbWl0cyB5b3VyIGFiaWxpdHkgdG8gdXNlIHN0cnVjdHVyZWQgb3V0cHV0cyBpbiBJbnNpZ2h0cyBhbmQgQ2FsbCBMb2dzLiBGb3Igbm9uLXNlbnNpdGl2ZSBvdXRwdXRzLCB5b3UgY2FuIG92ZXJyaWRlIHRoaXMgYmVoYXZpb3IuCgo8QWNjb3JkaW9uR3JvdXA+CiAgPEFjY29yZGlvbiB0aXRsZT0iSG93IGRvIHN0cnVjdHVyZWQgb3V0cHV0cyB3b3JrIHdpdGggSElQQUEgbW9kZSBlbmFibGVkPyI+CiAgICBCeSBkZWZhdWx0LCB3aGVuIEhJUEFBIG1vZGUgaXMgb24sIFZhcGkgZG9lc24ndCBzdG9yZSBzdHJ1Y3R1cmVkIG91dHB1dHMuIFRoaXMga2VlcHMgZGF0YSBwcml2YXRlIGJ1dCBsaW1pdHMgeW91ciBhYmlsaXR5IHRvIHVzZSBzdHJ1Y3R1cmVkIG91dHB1dHMgaW4gSW5zaWdodHMgYW5kIENhbGwgTG9ncy4KCiAgICBZb3UgY2FuIGVuYWJsZSBzdG9yYWdlIGZvciBzcGVjaWZpYyBzdHJ1Y3R1cmVkIG91dHB1dHMgdXNpbmcgdGhlIGBjb21wbGlhbmNlUGxhbi5mb3JjZVN0b3JlT25IaXBhYUVuYWJsZWRgIHNldHRpbmcuIFRoaXMgYWxsb3dzIHlvdSB0byBzdG9yZSBub24tc2Vuc2l0aXZlIG91dHB1dHMgZXZlbiB3aGVuIEhJUEFBIG1vZGUgaXMgYWN0aXZlLgoKICAgICoqSW1wb3J0YW50OioqIFlvdXIgb3JnYW5pemF0aW9uIGlzIHJlc3BvbnNpYmxlIGZvciBlbnN1cmluZyB0aGF0IGFueSBzdHJ1Y3R1cmVkIG91dHB1dCB3aXRoIHN0b3JhZ2UgZW5hYmxlZCBkb2VzIE5PVCBleHRyYWN0IG9yIGdlbmVyYXRlIFBISSBvciBzZW5zaXRpdmUgZGF0YS4gT25seSB1c2UgdGhpcyBmb3Igbm9uLXNlbnNpdGl2ZSBpbmZvcm1hdGlvbi4KICA8L0FjY29yZGlvbj4KCiAgPEFjY29yZGlvbiB0aXRsZT0iV2hlbiBzaG91bGQgSSBlbmFibGUgc3RvcmFnZSBmb3Igc3RydWN0dXJlZCBvdXRwdXRzIGluIEhJUEFBIG1vZGU/Ij4KICAgIEVuYWJsZSBzdG9yYWdlIE9OTFkgZm9yIHN0cnVjdHVyZWQgb3V0cHV0cyB0aGF0IGV4dHJhY3Qgbm9uLXNlbnNpdGl2ZSwgbm9uLVBISSBpbmZvcm1hdGlvbi4KCiAgICAqKlNhZmUgdXNlIGNhc2VzOioqCiAgICAtIEJvb2xlYW4gb3V0Y29tZXM6IGBhcHBvaW50bWVudEJvb2tlZDogdHJ1ZS9mYWxzZWAKICAgIC0gQ2FsbCBzdWNjZXNzIGluZGljYXRvcnM6IGBpc3N1ZVJlc29sdmVkOiB0cnVlL2ZhbHNlYAogICAgLSBHZW5lcmFsIGNhdGVnb3JpZXM6IGBpc3N1ZUNhdGVnb3J5OiAiYmlsbGluZyIgfCAidGVjaG5pY2FsIiB8ICJnZW5lcmFsImAKICAgIC0gU2F0aXNmYWN0aW9uIHNjb3JlczogYGNzYXRTY29yZTogMS0xMGAKICAgIC0gQ2FsbCBzZW50aW1lbnQ6IGBzZW50aW1lbnQ6ICJwb3NpdGl2ZSIgfCAibmV1dHJhbCIgfCAibmVnYXRpdmUiYAoKICAgICoqTmV2ZXIgZW5hYmxlIHN0b3JhZ2UgZm9yOioqCiAgICAtIFBhdGllbnQgZGlhZ25vc2lzIGluZm9ybWF0aW9uCiAgICAtIE1lZGljYWwgcmVjb3JkIG51bWJlcnMKICAgIC0gU29jaWFsIHNlY3VyaXR5IG51bWJlcnMKICAgIC0gQ3JlZGl0IGNhcmQgZGV0YWlscwogICAgLSBQYXRpZW50IG5hbWVzLCBkYXRlcyBvZiBiaXJ0aCwgb3IgY29udGFjdCBpbmZvcm1hdGlvbgogICAgLSBUcmVhdG1lbnQgcGxhbnMgb3IgbWVkaWNhdGlvbiBpbmZvcm1hdGlvbgoKICAgICoqV2FybmluZzoqKiBFbmFibGluZyBzdG9yYWdlIGZvciBvdXRwdXRzIGNvbnRhaW5pbmcgUEhJIHZpb2xhdGVzIEhJUEFBIGNvbXBsaWFuY2UgYW5kIHlvdXIgQkFBIHdpdGggVmFwaS4KICA8L0FjY29yZGlvbj4KCiAgPEFjY29yZGlvbiB0aXRsZT0iSG93IGRvIEkgY29uZmlndXJlIHN0cnVjdHVyZWQgb3V0cHV0IHN0b3JhZ2UgaW4gSElQQUEgbW9kZT8iPgogICAgWW91IGNhbiBlbmFibGUgc3RvcmFnZSBmb3Igc3BlY2lmaWMgc3RydWN0dXJlZCBvdXRwdXRzIHZpYSB0aGUgRGFzaGJvYXJkIG9yIEFQSS4KCiAgICAqKlZpYSBEYXNoYm9hcmQ6KioKICAgIDEuIE5hdmlnYXRlIHRvICoqU3RydWN0dXJlZCBPdXRwdXRzKiogaW4gdGhlIGxlZnQgc2lkZWJhcgogICAgMi4gQ3JlYXRlIG9yIGVkaXQgYSBzdHJ1Y3R1cmVkIG91dHB1dAogICAgMy4gRXhwYW5kIHRoZSAqKkNvbXBsaWFuY2UgU2V0dGluZ3MqKiBzZWN0aW9uCiAgICA0LiBFbmFibGUgdGhlIHRvZ2dsZSBmb3IgIkVuYWJsZSBTdG9yYWdlIG9mIFN0cnVjdHVyZWQgT3V0cHV0cyB3aGlsZSBvbiBISVBBQSBNb2RlIgogICAgNS4gT25seSBlbmFibGUgaWYgeW91ciBvdXRwdXQgZG9lcyBub3QgZXh0cmFjdCBzZW5zaXRpdmUgaW5mb3JtYXRpb24KCiAgICAqKlZpYSBBUEk6KioKCiAgICBXaGVuIGNyZWF0aW5nIGEgc3RydWN0dXJlZCBvdXRwdXQ6CmBgYGpzb24KICAgIHsKICAgICAgIm5hbWUiOiAiQXBwb2ludG1lbnQgQm9va2VkIiwKICAgICAgInR5cGUiOiAiYWkiLAogICAgICAic2NoZW1hIjogewogICAgICAgICJ0eXBlIjogImJvb2xlYW4iLAogICAgICAgICJkZXNjcmlwdGlvbiI6ICJXaGV0aGVyIGFuIGFwcG9pbnRtZW50IHdhcyBzdWNjZXNzZnVsbHkgYm9va2VkIgogICAgICB9LAogICAgICAiY29tcGxpYW5jZVBsYW4iOiB7CiAgICAgICAgImZvcmNlU3RvcmVPbkhpcGFhRW5hYmxlZCI6IHRydWUKICAgICAgfQogICAgfQpgYGAKCiAgICBXaGVuIHVwZGF0aW5nIGEgc3RydWN0dXJlZCBvdXRwdXQ6CmBgYGpzb24KICAgIHsKICAgICAgImNvbXBsaWFuY2VQbGFuIjogewogICAgICAgICJmb3JjZVN0b3JlT25IaXBhYUVuYWJsZWQiOiB0cnVlCiAgICAgIH0KICAgIH0KYGBgCgogICAgKipJTVBPUlRBTlQ6KiogT25seSBzZXQgYGZvcmNlU3RvcmVPbkhpcGFhRW5hYmxlZDogdHJ1ZWAgaWYgeW91IGFyZSBjZXJ0YWluIHlvdXIgc3RydWN0dXJlZCBvdXRwdXQgZG9lcyBOT1QgZXh0cmFjdCBQSEkgb3Igc2Vuc2l0aXZlIGRhdGEuIFlvdXIgb3JnYW5pemF0aW9uIGlzIHJlc3BvbnNpYmxlIGZvciBlbnN1cmluZyBjb21wbGlhbmNlLiBNaXN1c2UgY291bGQgcmVzdWx0IGluIEJBQSB2aW9sYXRpb25zLgogIDwvQWNjb3JkaW9uPgo8L0FjY29yZGlvbkdyb3VwPgoKIyMgQmVzdCBQcmFjdGljZXMKCjxBY2NvcmRpb25Hcm91cD4KICA8QWNjb3JkaW9uIHRpdGxlPSJXaGF0IGFyZSBiZXN0IHByYWN0aWNlcyBmb3IgZW5zdXJpbmcgSElQQUEgY29tcGxpYW5jZSB3aXRoIFZhcGk/Ij4KICAgIC0gRW5hYmxlIEhJUEFBIG1vZGUgYXQgdGhlIG9yZ2FuaXphdGlvbiBsZXZlbCwgZnJvbSB0aGUgRGFzaGJvYXJkCiAgICAtIEVuc3VyZSB0aGF0IFBISSBvbmx5IHBhc3NlcyB0aHJvdWdoIHRoZSBjYWxsIHBpcGVsaW5lIGFuZCBpcyBub3Qgc3RvcmVkIGluIGNvbmZpZ3VyYXRpb24KICAgIC0gVXNlIEhJUEFBLWNvbXBsaWFudCBhY2NvdW50cyB3aXRoIGFsbCB0aGlyZC1wYXJ0eSBwcm92aWRlcnMgKFNUVCwgTExNLCBUVFMpCiAgICAtIE5ldmVyIHVzZSByZWFsIFBISSBpbiBhbiBvcmdhbml6YXRpb24gdGhhdCBoYXMgbm90IGVuYWJsZWQgSElQQUEgbW9kZSwgaW5jbHVkaW5nIGZvciB0ZXN0aW5nIG9yIGRlbW9zCiAgICAtIFJlbWVtYmVyIHRoYXQgY2FsbCByZWNvcmRpbmdzLCB0cmFuc2NyaXB0cywgYW5kIGxvZ3MgYXJlIHN0aWxsIHN0b3JlZCwgaW4gVmFwaSdzIHByaXZhdGUgSElQQUEtY29tcGxpYW50IHN0b3JhZ2UsIHVubGVzcyB5b3UgY29uZmlndXJlIHlvdXIgb3duIHN0b3JhZ2UKICA8L0FjY29yZGlvbj4KICA8QWNjb3JkaW9uIHRpdGxlPSJDYW4gSSBoYXZlIGJvdGggSElQQUEtY29tcGxpYW50IGFuZCBub24tSElQQUEtY29tcGxpYW50IGFzc2lzdGFudHM/Ij4KICAgIE5vLiBISVBBQSBtb2RlIGlzIGVuYWJsZWQgYXQgdGhlIG9yZ2FuaXphdGlvbiBsZXZlbCBhbmQgYXBwbGllcyB0byBldmVyeSBhc3Npc3RhbnQgaW4gdGhhdCBvcmdhbml6YXRpb24uIFRoZXJlIGlzIG5vIHdheSB0byBleGNsdWRlIGEgc3BlY2lmaWMgYXNzaXN0YW50LiBJZiB5b3VyIG9yZ2FuaXphdGlvbiBoYXMgbm90IGVuYWJsZWQgSElQQUEgbW9kZSwgbm9uZSBvZiB5b3VyIGFzc2lzdGFudHMgYXJlIEhJUEFBLWNvbXBsaWFudCwgcmVnYXJkbGVzcyBvZiBhbnkgb3RoZXIgY29uZmlndXJhdGlvbi4gTmV2ZXIgdXNlIHJlYWwgUEhJIHVudGlsIEhJUEFBIG1vZGUgaXMgZW5hYmxlZCBmb3IgeW91ciBvcmdhbml6YXRpb24uCiAgPC9BY2NvcmRpb24+CiAgPEFjY29yZGlvbiB0aXRsZT0iV2hhdCBpcyBteSByZXNwb25zaWJpbGl0eSB1bmRlciB0aGUgQkFBIHdpdGggVmFwaT8iPgogICAgVW5kZXIgdGhlIEJ1c2luZXNzIEFzc29jaWF0ZSBBZ3JlZW1lbnQgKEJBQSksIHlvdSBhZ3JlZToKICAgIDEuIE5vdCB0byBpbnRyb2R1Y2UgUEhJIG9udG8gVmFwaSdzIHBsYXRmb3JtIHRocm91Z2ggaXRzIEFQSSBvciBkYXNoYm9hcmQgZXhjZXB0IGFzIHBlcm1pdHRlZAogICAgMi4gVG8gdXNlIEhJUEFBLWNvbXBsaWFudCBhY2NvdW50cyB3aXRoIGV4dGVybmFsIHByb3ZpZGVycyB3aGVuIHByb3ZpZGluZyBrZXlzCiAgICAzLiBUbyBvbmx5IHVzZSBISVBBQS1jb21wbGlhbnQgcHJvdmlkZXJzIHRoYXQgVmFwaSBoYXMgc2lnbmVkIGEgQkFBIHdpdGggd2hlbiBub3QgcHJvdmlkaW5nIGtleXMuIFNlZSBbSElQQUEgY29tcGxpYW50IHByb3ZpZGVyc10oI2hpcGFhLWNvbXBsaWFudC1wcm92aWRlcnMpIGZvciB0aGUgY3VycmVudCBsaXN0LgogICAgNC4gVG8gdXNlIHRoZSBwbGF0Zm9ybSBpbiBhY2NvcmRhbmNlIHdpdGggYWxsIEJBQSByZXF1aXJlbWVudHMKICA8L0FjY29yZGlvbj4KPC9BY2NvcmRpb25Hcm91cD4KCiMjIFJldHJpZXZpbmcgQ2FsbCBBcnRpZmFjdHMgZnJvbSBQcml2YXRlIFN0b3JhZ2UKCkZvciBISVBBQS1lbmFibGVkIG9yZ2FuaXphdGlvbnMsIGNhbGwgcmVjb3JkaW5ncyBhbmQgbG9ncyBhcmUgc3RvcmVkIGluIGEgcHJpdmF0ZSBidWNrZXQgYW5kIGNhbm5vdCBiZSBkb3dubG9hZGVkIGRpcmVjdGx5IGZyb20gdGhlIFVSTHMgcmV0dXJuZWQgaW4gd2ViaG9va3Mgb3IgQVBJIHJlc3BvbnNlcy4gVG8gcmV0cmlldmUgcmVjb3JkaW5ncywgY2FsbCBsb2dzLCBvciBvdGhlciBhcnRpZmFjdHMsIGNhbGwgdGhlIFZhcGkgQVBJIHdpdGggeW91ciBQcml2YXRlIEFQSSBLZXksIHNlZSBbUmV0cmlldmUgY2FsbCBhcnRpZmFjdHNdKC9hc3Npc3RhbnRzL3JldHJpZXZlLWNhbGwtYXJ0aWZhY3RzKSBmb3IgdGhlIGZ1bGwgbGlzdCBvZiBlbmRwb2ludHMgYW5kIGV4YW1wbGUgcmVxdWVzdHMuIFRoaXMgcmV0cmlldmFsIG1ldGhvZCBpcyB0aGUgc2FtZSBmb3IgSElQQUEgYW5kIG5vbi1ISVBBQSBvcmdhbml6YXRpb25zIGFsaWtlLgoKIyMgTmVlZCBGdXJ0aGVyIEFzc2lzdGFuY2U/CgpJZiB5b3UgaGF2ZSBtb3JlIHF1ZXN0aW9ucyBhYm91dCBwcml2YWN5LCBISVBBQSBjb21wbGlhbmNlLCBvciBob3cgdG8gY29uZmlndXJlIHlvdXIgVmFwaSBhc3Npc3RhbnQsIG91ciBzdXBwb3J0IHRlYW0gaXMgaGVyZSB0byBoZWxwLiBDb250YWN0IHVzIGF0IHNlY3VyaXR5QHZhcGkuYWkgZm9yIHBlcnNvbmFsaXplZCBhc3Npc3RhbmNlIGFuZCBtb3JlIGluZm9ybWF0aW9uIG9uIGhvdyB0byBtYWtlIHRoZSBtb3N0IG9mIFZhcGkncyB2b2ljZSBhc3Npc3RhbnQgcGxhdGZvcm0gd2hpbGUgZW5zdXJpbmcgeW91ciBkYXRhIHJlbWFpbnMgcHJvdGVjdGVkLgo= \ No newline at end of file +--- +title: HIPAA Compliance +subtitle: Learn how to ensure privacy when using Vapi's voice assistant platform +description: HIPAA on Vapi. Enable organization-wide compliance mode, use approved LLM, voice, and transcriber providers, and control how call recordings and logs are stored. +slug: security-and-privacy/hipaa +--- + +## Introduction to Privacy at Vapi + +At Vapi, we are committed to delivering exceptional voice assistant services while upholding the highest standards of privacy and data protection for our users. We understand the importance of balancing service quality with the need to respect and protect personal and sensitive information. Our privacy policies and practices are designed to give you control over your data while benefiting from the full capabilities of our platform. + +## Understanding HIPAA Compliance Basics + +The Health Insurance Portability and Accountability Act (HIPAA) is a United States legislation that provides data privacy and security provisions for safeguarding medical information. HIPAA compliance is crucial for any entity that deals with protected health information (PHI), ensuring that sensitive patient data is handled, stored, and transmitted with the highest standards of security and confidentiality. The key concepts of HIPAA compliance include the Privacy Rule, which protects the privacy of individually identifiable health information; the Security Rule, which sets standards for the security of electronic protected health information (e-PHI); and the Breach Notification Rule, which requires covered entities to notify individuals, HHS, and in some cases, the media of a breach of unsecured PHI. Compliance with these rules is not just about adhering to legal requirements but also about building trust with your customers by demonstrating your commitment to protecting their sensitive data. + +## Understanding Default Settings + +By default, Vapi records your calls and stores logs and transcriptions. This practice is aimed at continuously improving the quality of our service, ensuring that you receive the best possible experience. However, we recognize the importance of privacy and provide options for users who prefer more control over their data. + +## Opting for Privacy: The HIPAA Compliance Option + +For users prioritizing privacy, particularly in compliance with the Health Insurance Portability and Accountability Act (HIPAA). Choosing HIPAA compliance through our platform ensures that you can still use our voice assistant services without compromising on privacy requirements. + +## Enabling HIPAA Compliance + +HIPAA mode is an organization-wide setting that changes how Vapi handles call logs, recordings, and transcripts. It also limits the organization to compatible model, voice, and transcriber providers. + +To enable HIPAA compliance: + + + + HIPAA is available as a paid compliance add-on with Usage only or any Success Package. See [Buy compliance and data add-ons](/billing/manage-packages-and-add-ons#buy-compliance-and-data-add-ons) to add it. + + + + + In **Packages & add-ons**, select **HIPAA compliance**, then enter the BAA recipient's name and organization. The Dashboard lets you know that Vapi will email the BAA for signature. + + + + + Review and sign the BAA sent by email, then complete the remaining Dashboard prompts to activate **HIPAA compliance**. HIPAA is an organization-level setting: it applies to every assistant in your organization, with no per-assistant exception, and it cannot be enabled through the API. + + + + + Update any assistant using a non-compliant LLM, voice, or transcriber provider. See [HIPAA compliant providers](/security-and-privacy/hipaa#hipaa-compliant-providers) for the full list. Vapi rejects configuration changes that select a non-compliant provider while HIPAA mode is on. Your call records, transcripts, and logs are then stored in a HIPAA compliant manner. + + + + +HIPAA mode and Zero Data Retention (ZDR) are mutually exclusive. Disable one before enabling the other. See [Zero Data Retention (ZDR)](/security-and-privacy/zero-data-retention). + + +## HIPAA Compliant providers + +When enabling HIPAA compliance, only HIPAA compliant providers may be chosen. See the current list of HIPAA-compliant model, voice, and transcription providers on the [Trust Center](https://security.vapi.ai/item/hipaa). + +# FAQs + + + + Enabling HIPAA compliance does not degrade the quality of the voice assistant services. However, it limits access to certain features, such as reviewing call logs or transcriptions, that some users may find valuable for quality improvement purposes. + + + This feature is particularly useful for businesses and organizations in the healthcare sector or any entity that handles sensitive health information and must comply with HIPAA regulations. + + + Yes, your organization can toggle HIPAA mode on or off from the Dashboard as needed. Consider the implications carefully first: turning HIPAA mode off applies to your entire organization, not just one assistant. + + + +## Where can PHI be used with Vapi? + + + + When using Vapi with PHI, you may only pass PHI through the `/call` endpoint. All other endpoints in the API Reference should not contain PHI. For example, you should not put PHI in an `/assistant` prompt or in a `/phone-number` label. The restriction applies to all configuration endpoints where data would be stored on Vapi's platform. + + + No, there are no designated "HIPAA-safe endpoints." Instead, when HIPAA mode is turned on, Vapi will only use HIPAA-compliant services (such as Azure OpenAI) for processing PHI through the pipeline. The voice pipeline (STT → LLM → TTS) can process PHI when properly configured, but Vapi does not store this data outside its HIPAA-compliant storage. + + + +## HIPAA Compliance Configuration + + + + Enable HIPAA mode at the organization level, from the Vapi Dashboard. This is the only way to enable HIPAA compliance, and it applies to every assistant in your organization. There is no per-assistant HIPAA setting. + + + No. Even when using your own HIPAA-compliant provider keys, it remains your responsibility not to store PHI via Vapi's endpoints. The model keys are a separate concern from the storage of PHI on Vapi's platform. You must both use HIPAA-compliant keys AND ensure you're not storing PHI on Vapi. + + + +## Structured Outputs with HIPAA Mode + +When HIPAA mode is enabled, Vapi does not store structured outputs by default. This protects privacy but limits your ability to use structured outputs in Insights and Call Logs. For non-sensitive outputs, you can override this behavior. + + + + By default, when HIPAA mode is on, Vapi doesn't store structured outputs. This keeps data private but limits your ability to use structured outputs in Insights and Call Logs. + + You can enable storage for specific structured outputs using the `compliancePlan.forceStoreOnHipaaEnabled` setting. This allows you to store non-sensitive outputs even when HIPAA mode is active. + + **Important:** Your organization is responsible for ensuring that any structured output with storage enabled does NOT extract or generate PHI or sensitive data. Only use this for non-sensitive information. + + + + Enable storage ONLY for structured outputs that extract non-sensitive, non-PHI information. + + **Safe use cases:** + - Boolean outcomes: `appointmentBooked: true/false` + - Call success indicators: `issueResolved: true/false` + - General categories: `issueCategory: "billing" | "technical" | "general"` + - Satisfaction scores: `csatScore: 1-10` + - Call sentiment: `sentiment: "positive" | "neutral" | "negative"` + + **Never enable storage for:** + - Patient diagnosis information + - Medical record numbers + - Social security numbers + - Credit card details + - Patient names, dates of birth, or contact information + - Treatment plans or medication information + + **Warning:** Enabling storage for outputs containing PHI violates HIPAA compliance and your BAA with Vapi. + + + + You can enable storage for specific structured outputs via the Dashboard or API. + + **Via Dashboard:** + 1. Navigate to **Structured Outputs** in the left sidebar + 2. Create or edit a structured output + 3. Expand the **Compliance Settings** section + 4. Enable the toggle for "Enable Storage of Structured Outputs while on HIPAA Mode" + 5. Only enable if your output does not extract sensitive information + + **Via API:** + + When creating a structured output: +```json + { + "name": "Appointment Booked", + "type": "ai", + "schema": { + "type": "boolean", + "description": "Whether an appointment was successfully booked" + }, + "compliancePlan": { + "forceStoreOnHipaaEnabled": true + } + } +``` + + When updating a structured output: +```json + { + "compliancePlan": { + "forceStoreOnHipaaEnabled": true + } + } +``` + + **IMPORTANT:** Only set `forceStoreOnHipaaEnabled: true` if you are certain your structured output does NOT extract PHI or sensitive data. Your organization is responsible for ensuring compliance. Misuse could result in BAA violations. + + + +## Best Practices + + + + - Enable HIPAA mode at the organization level, from the Dashboard + - Ensure that PHI only passes through the call pipeline and is not stored in configuration + - Use HIPAA-compliant accounts with all third-party providers (STT, LLM, TTS) + - Never use real PHI in an organization that has not enabled HIPAA mode, including for testing or demos + - Remember that call recordings, transcripts, and logs are still stored, in Vapi's private HIPAA-compliant storage, unless you configure your own storage + + + No. HIPAA mode is enabled at the organization level and applies to every assistant in that organization. There is no way to exclude a specific assistant. If your organization has not enabled HIPAA mode, none of your assistants are HIPAA-compliant, regardless of any other configuration. Never use real PHI until HIPAA mode is enabled for your organization. + + + Under the Business Associate Agreement (BAA), you agree: + 1. Not to introduce PHI onto Vapi's platform through its API or dashboard except as permitted + 2. To use HIPAA-compliant accounts with external providers when providing keys + 3. To only use HIPAA-compliant providers that Vapi has signed a BAA with when not providing keys. See [HIPAA compliant providers](#hipaa-compliant-providers) for the current list. + 4. To use the platform in accordance with all BAA requirements + + + +## Retrieving Call Artifacts from Private Storage + +For HIPAA-enabled organizations, call recordings and logs are stored in a private bucket and cannot be downloaded directly from the URLs returned in webhooks or API responses. To retrieve recordings, call logs, or other artifacts, call the Vapi API with your Private API Key, see [Retrieve call artifacts](/assistants/retrieve-call-artifacts) for the full list of endpoints and example requests. This retrieval method is the same for HIPAA and non-HIPAA organizations alike. + +## Need Further Assistance? + +If you have more questions about privacy, HIPAA compliance, or how to configure your Vapi assistant, our support team is here to help. Contact us at security@vapi.ai for personalized assistance and more information on how to make the most of Vapi's voice assistant platform while ensuring your data remains protected.