> ## Documentation Index
> Fetch the complete documentation index at: https://docs.lumisreach.com/llms.txt
> Use this file to discover all available pages before exploring further.

# HIPAA & BAA coverage

> How LumisReach supports HIPAA workloads, what our BAA covers, and how to request one.

## LumisReach's HIPAA posture

If your business handles Protected Health Information (PHI), you sign **one** Business Associate Agreement — with LumisReach. We've already executed BAAs with the subprocessors in our stack that require them. You don't need to chase individual provider BAAs; we handle that upstream.

Once your BAA is on file, we set `hipaa_enabled` on your workspace. That flag activates real runtime controls (described below), not just a contractual posture.

## Our subprocessor BAA status

We use several third-party services to deliver LumisReach. Here's where each one stands today — informational only; you don't act on this list.

| Service                                            | Role                 | LumisReach's BAA status                                                                                                                                                                         |
| -------------------------------------------------- | -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Tier-1 carrier (voice, SMS, SIP trunking)          | Carrier              | **Conduit Exception** — the carrier transmits PHI but doesn't access message content, so no BAA is required. Encryption in transit and at rest, access controls, and audit logging still apply. |
| LiveKit (real-time audio)                          | Media transport      | **Executed.**                                                                                                                                                                                   |
| Vapi (voice AI orchestration)                      | AI assistant runtime | **Executed** under Vapi's enterprise HIPAA tier. We pass `hipaaEnabled=true` to every assistant owned by a HIPAA-enabled workspace.                                                             |
| Vercel (hosting) + Vercel Blob (recording storage) | Platform             | **Executed** under Enterprise BAA.                                                                                                                                                              |
| Managed Postgres                                   | Data store           | **Executed** with our managed Postgres provider.                                                                                                                                                |
| OpenAI / Anthropic (LLM)                           | AI inference         | **BAA-eligible enterprise tier** — we route HIPAA workspaces to BAA-covered model paths and block fallback to non-BAA providers.                                                                |
| Deepgram (STT)                                     | Transcription        | **Executed.**                                                                                                                                                                                   |
| Stripe                                             | Billing              | **Executed.** We avoid putting PHI in invoice descriptions or metadata regardless.                                                                                                              |

If you need documentation of any individual subprocessor BAA for your own compliance audit, email `compliance@lumisreach.com` and we'll provide it.

## How to request a BAA from LumisReach

1. **Email `support@lumisreach.com`** with subject "HIPAA BAA Request".
2. **Include:**
   * Your legal entity name
   * The workspace or team that will handle PHI
   * Your primary compliance contact (name + email)
3. **What happens next:**
   * We respond within 2 business days with our standard BAA.
   * For customers who can sign as-is: same-day workspace activation once the BAA is countersigned.
   * For customers needing legal markup: we route through our counsel; typical close in 5–10 business days.
4. **After signing:** We record execution on your workspace (`baaSignedAt`) and flip `hipaa_enabled = true`. The runtime controls below take effect immediately.

If you're a partner with consistent healthcare volume, ask us about platform-wide HIPAA — a single agreement that covers your entire downstream customer base. Details on the [HIPAA add-on page](/integrations/hipaa).

## What `hipaa_enabled` does

A workspace with `hipaa_enabled: true` enforces the following at runtime:

1. **Voice AI provider HIPAA mode** — every AI assistant we create on your behalf is provisioned with the upstream provider's HIPAA setting enabled, routing inference through BAA-covered paths only.
2. **Recording disclosure locked on** — you cannot save a custom assistant greeting that omits the "this call is recorded" disclosure. Our default greetings include it in 40+ languages.
3. **Recording retention capped** — `recordingRetentionDays` cannot exceed 30, and `recordingEnabled` cannot be turned off.
4. **LLM routing** prefers BAA-covered model providers; fallback to non-BAA providers is blocked.
5. **Integration installs gated** — third-party apps that handle PHI but don't have a subprocessor BAA on file (e.g., certain CRM and messaging integrations) are blocked from being installed on the workspace. The full list is shown in the integrations directory with a HIPAA notice.
6. **Audit log** — every compliance-relevant mutation (flag flips, BAA recording, retention changes, blocked installs) is recorded.

Flipping the flag is reversible — we don't mass-delete historical data — but the flag itself can only be enabled when `baaSignedAt` is set, which requires a fully executed BAA on our side.

## Security baseline LumisReach always provides

Regardless of whether `hipaa_enabled` is set:

* TLS 1.3 in transit, AES-256 at rest.
* Encrypted credential storage (`LUMISREACH_ENCRYPTION_KEY`).
* Row-level access control — every API query runs through `buildOwnershipFilter` which scopes results to the authenticated principal's org/team visibility.
* Audit log on every mutation via tRPC middleware.
* Breach notification procedures per § 164.410.

Missing something your compliance officer needs? Email `compliance@lumisreach.com`.