Skip to main content

​
LumisReach’s HIPAA posture

If your business handles Protected Health Information (PHI), you sign one Business Associate Agreement — with LumisReach. We’ve already executed BAAs with the subprocessors in our stack that require them. You don’t need to chase individual provider BAAs; we handle that upstream. Once your BAA is on file, we set hipaa_enabled on your workspace. That flag activates the runtime controls described below, not just a contractual posture — and it cannot be set before the BAA is recorded.

​
Our subprocessor BAA status

We use several third-party services to deliver LumisReach. Here’s where each one stands today — informational only; you don’t act on this list. If you need documentation of any individual subprocessor BAA for your own compliance audit, email compliance@lumisreach.com and we’ll provide it.

​
How to request a BAA from LumisReach

  1. Email support@lumisreach.com with subject “HIPAA BAA Request”.
  2. Include:
    • Your legal entity name
    • The workspace or team that will handle PHI
    • Your primary compliance contact (name + email)
  3. What happens next:
    • We respond within 2 business days with our standard BAA.
    • For customers who can sign as-is: same-day workspace activation once the BAA is countersigned.
    • For customers needing legal markup: we route through our counsel; typical close in 5–10 business days.
  4. After signing: We record execution on your workspace (baaSignedAt) and flip hipaa_enabled = true. The runtime controls below take effect immediately.
If you’re a partner with consistent healthcare volume, ask us about platform-wide HIPAA: a single agreement that covers your entire downstream customer base. Details on the HIPAA add-on page.

​
What hipaa_enabled does

A workspace with hipaa_enabled: true enforces the following at runtime:
  1. Voice AI provider HIPAA mode — assistants are provisioned with the upstream provider’s HIPAA setting enabled, and calls are refused outright if the configured voice provider has no BAA covering it. Both telephony stacks enforce this: the web tier refuses to serve the agent configuration, and the voice worker independently refuses to open a session.
  2. Recording disclosure required — you cannot save an assistant greeting that omits the “this call is recorded” disclosure. Recognized in English plus the major supported languages.
  3. Recording retention capped — recordingRetentionDays cannot exceed 30, and recordingEnabled cannot be turned off. A nightly job deletes recordings and their transcripts once retention expires.
  4. LLM and voice routing restricted to providers with an executed BAA. Note the granularity: Google’s BAA covers Gemini on Vertex AI, not the Gemini Developer API, so the two are treated as different providers.
  5. Integration installs gated — third-party apps that could receive PHI without a subprocessor BAA on file are blocked from installation on the workspace. Apps with no PHI classification are blocked by default rather than assumed safe.
  6. Audit log — every compliance-relevant event (flag flips, BAA recording, retention changes, blocked installs, blocked provider routing) is recorded, including denied attempts.
Flipping the flag off is reversible and we don’t mass-delete historical data. Flipping it on requires baaSignedAt to be set — a fully executed BAA on our side — and that precondition is enforced by the server, not by process.

​
Security baseline LumisReach always provides

Regardless of whether hipaa_enabled is set:
  • TLS 1.3 in transit, AES-256 at rest.
  • Encrypted credential storage (LUMISREACH_ENCRYPTION_KEY).
  • Row-level access control — every API query runs through buildOwnershipFilter which scopes results to the authenticated principal’s org/team visibility.
  • Audit log on every mutation via tRPC middleware.
  • Breach notification procedures per § 164.410.
Missing something your compliance officer needs? Email compliance@lumisreach.com.