Lexicost
AI voice agents / Costs, terms and calculators

HIPAA and BAAs for AI voice agents

Checked against its sources on

This page states what the US regulation and the vendors' own pages say. It is not legal advice.

A business associate agreement (BAA) is the written contract, or other written agreement or arrangement, that HIPAA requires with a business associate. A covered entity may disclose protected health information to one, or let one create, receive, maintain or transmit it on its behalf, if that writing documents satisfactory assurance that the business associate will appropriately safeguard it.

When HIPAA requires a BAA

The requirement sits in 45 CFR 164.502(e), in the eCFR text current to 10 November 2026. A covered entity may disclose protected health information (PHI) to a business associate, or let one create, receive, maintain or transmit it on its behalf, if it obtains "satisfactory assurance" that the business associate will appropriately safeguard the information, documented through a written contract or other written agreement or arrangement that meets the applicable requirements of 164.504(e). HHS's business associate FAQ, last reviewed 21 October 2026, names the covered entities: health plans, health care clearinghouses and health care providers who transmit health information electronically in connection with a covered transaction.

One of the FAQ's examples of a business associate is a "third-party vendor super intelligence (SI) chatbot" on a provider's patient portal that provides services involving the patient's PHI, such as symptom assessment, medical reminders and appointment scheduling.

Under 164.504(e)(2) the contract must provide, among other things, that the business associate will use appropriate safeguards, comply where applicable with the Security Rule for electronic PHI, report any use or disclosure the contract does not provide for that it becomes aware of, including breaches of unsecured PHI, and ensure that subcontractors handling PHI on its behalf agree to the same restrictions and conditions. Signing does not keep the promises: a covered entity that knew of a pattern of activity or practice by its business associate that was a material breach or violation of the contract is not in compliance unless it took reasonable steps to cure the breach or end the violation and, if those failed, terminated the contract or arrangement where feasible (164.504(e)(1)(ii)).

Who signs, on which plan, at what price

All seven vendors on this page say they sign a BAA in some form.

No added fee, signed online: Retell AI. Its compliance docs: Yes, self-signed online. No fee to sign the BAA. The pricing table checks "HIPAA / BAA" under both Pay-as-you-go and Enterprise and keeps "Custom BAA" for Enterprise. Terms: Retell is not a business associate unless a BAA is agreed.

A fixed monthly fee: Vapi. Yes, as a $2,000 per month add-on, on any package including Usage only, charged per organization. Signing: BAA emailed on enabling HIPAA in the Dashboard.

On an Enterprise plan: Bland, ElevenLabs and Ultravox. Bland: BAA on Enterprise; price custom. ElevenLabs: Enterprise plan only; price not published. Ultravox: BAA on an Enterprise plan, while its trust center lists HIPAA: in progress. Its FAQ sends BAA requests to an inworld.ai address; the terms name the other party: The contract is with Theai, Inc. dba Inworld AI (terms effective October 1, 2026).

Conditions, and pages that disagree: Synthflow and Telnyx. Synthflow: Yes, for customers using the HIPAA Setting. The BAA is executed at contract signing; no price or plan requirement for it is published. Synthflow's own pages disagree on self-serve. The pricing page: Enterprise contract for every new deployment. Its support pages describe self-serve plans alongside Enterprise, and none of them says whether new self-serve sign-ups are accepted today.

Telnyx: BAA offered; who qualifies differs by page. Its contact-center page says a BAA is available on every plan. A help-center article sets two conditions: meeting Telnyx's commercial thresholds and architecting use of the platform in line with its HIPAA architecture guide. A page on SOC 2 says Telnyx does not publish those thresholds and signs the BAA through sales. The Voice AI pricing page: Regulated-industry readiness on every plan, including pay as you go.

What vendors call their own HIPAA status

This is how the vendors describe themselves. Retell's compliance docs: HIPAA compliant; a signed BAA is required before sending health data. Vapi's home page: States SOC 2, HIPAA and PCI compliance. ElevenLabs picks a different word: ElevenLabs Agents is a HIPAA-eligible service. Synthflow's pricing page gives its Trust Center's list as SOC 2 Type 2 plus the following, with HIPAA marked self-attested. Trust Center list, as given on the pricing page: SOC 2 Type 2, ISO/IEC 27001, GDPR, HIPAA (self-attested), PCI DSS v4.0.1; ISO/IEC 42001, DORA and the EU AI Act shown as in progress.

Synthflow's HIPAA switch is off by default. HIPAA Setting: protected health information not logged, recorded or stored persistently. For PHI, ElevenLabs requires a BAA and Zero Retention Mode: no PII logged or stored after a call. Vapi goes the other way: HIPAA mode and Zero Data Retention cannot be on together.

Who else handles the call

The subcontractor clause, 164.504(e)(2)(ii)(D), covers subcontractors that create, receive, maintain or transmit PHI on the business associate's behalf. In a voice agent call the AI model, speech-to-text, the voice and the phone line can each come from a different company. Vapi's hosting fee includes: None: speech, model, voice, transport extra. The keys can also be the buyer's own: Bring your own provider keys; that provider then bills you directly.

At ElevenLabs the AI model can come from a third party, and on the Free to Business plans the phone line comes from the buyer. Model: Passed through at provider rates, no markup. Phone line: No ElevenLabs rate; your carrier bills you. Retell: Bring your own AI model (custom LLM over WebSocket); Bring your own carrier and numbers via SIP. For the providers it uses itself: Zero data retention agreements with model, speech and voice providers.

Telnyx's HIPAA architecture page sets a rule: Under a BAA, AI features handling PHI must use Telnyx-hosted models. Its Voice AI price list also offers models and voices from other companies: Anthropic, OpenAI: at provider list rates; ElevenLabs voices with your own API key.

Other platforms take a carrier the buyer already has: Bland (Your own Twilio account or SIP trunks), Synthflow (Bring your own Twilio numbers) and Ultravox (Bring your own telephony: SIP trunking, Twilio or other providers).

Among the situations in which HHS's FAQ says a BAA is not required is transmitting PHI through a person that acts only as a conduit for it, for example the US Postal Service, certain private couriers and their electronic equivalents. The FAQ limits this conduit exception to entities that only provide transmission services for PHI, including any temporary storage of PHI. Entities that access PHI on a regular or frequent basis to perform a service on behalf of a covered entity are not conduits.

Often confused with

  • Data processing agreement (DPA). A contract on how a vendor processes personal data in general. The BAA is the written arrangement HIPAA requires for protected health information handled by a business associate.
  • SOC 2 report. An independent auditor's report on a company's security controls. It is a separate thing from a signed BAA: Ultravox's trust center lists SOC 2 Type I: compliant beside HIPAA: in progress.
  • Zero data retention. A promise or setting about whether call data is kept after it is processed. A BAA governs how PHI may be used, disclosed and protected while the vendor holds it.

What each compared vendor publishes about a BAA

Bland AI
Cartesia Managed Agents
ElevenLabs Agents (ElevenAgents)
LiveKit Cloud
Pipecat Cloud
PolyAI
Retell AI
Smallest.ai Atoms
Synthflow AI
Telnyx Voice AI Agents
Ultravox
Vapi

The monthly bill on each vendor's BAA plan, with any HIPAA charge the plan adds.

Vendors cited on this page

Bland AI, ElevenLabs Agents (ElevenAgents), Retell AI, Synthflow AI, Telnyx Voice AI Agents, Ultravox, Vapi. Each profile lists everything that vendor publishes, with its sources. All of them are side by side in the comparison.

Sources

Checked against its sources on 14 Nov 2026. Vendor figures on this page open their source when clicked. Lexicost has no commercial relationship with any vendor named on this site.

AI voice agent cost per minuteAdds up the five parts of a minute from each vendor's own published rates, with a box for any part a vendor does not price, and shows which parts each vendor's headline price leaves out.OpenAI Realtime API cost per minuteWorks out what OpenAI's per-token audio prices come to for a whole call and per minute, which OpenAI does not publish, and shows why a long call costs more per minute than a short one.TCPA rules for AI voice callsStates what the FCC's own documents say about AI voices and consent, with document numbers and dates, and separates the rules in force from those only proposed or not yet effective.
Source for every vendor figure on this page (48)
  1. Retell AI, hIPAA agreement (BAA): Yes, self-signed online (The compliance page names no plan; the pricing page comparison table shows a check mark for "HIPAA / BAA" under both Pay-as-you-go and Enterprise).Retell’s Business Associate Agreement (BAA) and Data Processing Addendum (DPA, including EU Standard Contractual Clauses) are available for self-signing at click-agreements.retellai.com. docs.retellai.com/general/compliance Read 14 Nov 2026.
  2. Retell AI, hIPAA agreement (BAA): No fee to sign the BAA.There is no additional fee to sign these agreements. docs.retellai.com/general/compliance Read 14 Nov 2026.
  3. Retell AI, hIPAA agreement (BAA): Terms: Retell is not a business associate unless a BAA is agreed.Unless otherwise expressly agreed in writing, Retell AI does not act as a “Business Associate” as defined under HIPAA and disclaims any such obligations, and you will not use the Services to process HIPAA regulated personal health information unless we have expressly agreed to enter into a business associate agreement with you. retellai.com/legal/terms-of-service Read 14 Nov 2026.
  4. Vapi, hIPAA agreement (BAA): Yes, as a $2,000 per month add-on (Any package, including Usage only. monthly. Per organization).HIPAA-eligible data handling is a $2,000/month add-on per organization and comes with a standard DPA and BAA. vapi.ai/pricing Read 14 Nov 2026.
  5. Vapi, hIPAA agreement (BAA): BAA emailed on enabling HIPAA in the Dashboard.To enable HIPAA, select Enable HIPAA and enter the signatory name and legal entity name. Vapi emails a Business Associate Agreement (BAA) to your billing email address. docs.vapi.ai/billing/manage-packages-and-add-ons Read 14 Nov 2026.
  6. Bland AI, hIPAA agreement (BAA): BAA on Enterprise; price custom (Enterprise).BAA, SSO, data residency bland.ai/pricing Read 14 Nov 2026.
  7. ElevenLabs Agents (ElevenAgents), hIPAA agreement (BAA): Enterprise plan only; price not published (Enterprise).Execution of a BAA, as may be required by HIPAA, is only available for Enterprise tier subscriptions. elevenlabs.io/docs/eleven-agents/legal/hipaa Read 14 Nov 2026.
  8. Ultravox, hIPAA agreement (BAA): BAA on an Enterprise plan (Enterprise).We sign Business Associate Agreements (BAAs) for customers with HIPAA needs, on an Enterprise plan. You can also remove call data after each call (see below). Contact support@inworld.ai to discuss your requirements. docs.ultravox.ai/gettingstarted/faq Read 14 Nov 2026.
  9. Ultravox, other compliance statements: HIPAA: in progress.HIPAA In Progress trust.delve.co/ultravox Read 14 Nov 2026.
  10. Ultravox, other compliance statements: The contract is with Theai, Inc. dba Inworld AI (terms effective October 1, 2026).These Terms of Service ("Terms") form a legally binding agreement between you ("Customer," "you," or "your") and Theai, Inc. dba Inworld AI ("Inworld AI," "we," "our," or "us"). ultravox.ai/terms Read 14 Nov 2026.
  11. Synthflow AI, hIPAA agreement (BAA): Yes, for customers using the HIPAA Setting (customers using the HIPAA Setting to process protected health information; executed at contract signing).The BAA is executed between Synthflow and Customer at contract signing for customers using the HIPAA Setting to process Protected Health Information (PHI). docs.synthflow.ai/baa Read 14 Nov 2026.
  12. Synthflow AI, sign up without sales: Enterprise contract for every new deployment.Synthflow is built for mid-market and enterprise teams deploying AI voice agents for customer calls, and every new deployment starts on an Enterprise contract. Also: Synthflow support has two paths: one for self-serve plans and one for Enterprise. Each has its own ticket form, so start with your plan. docs.synthflow.ai/getting-support Also: Version 1.0 | Last updated May 13, 2026 | Applicable to: Self-serve subscribers via synthflow.ai docs.synthflow.ai/terms-conditions Also: In some cases, new accounts may be reviewed before full workspace access is enabled. While your account is being reviewed, you may see a holding page confirming that your access request has been received. docs.synthflow.ai/account-access-login synthflow.ai/pricing Read 14 Nov 2026.
  13. Telnyx Voice AI Agents, hIPAA agreement (BAA): BAA offered; who qualifies differs by page (All plans (Pay as you go, Growth, Enterprise)).HIPAA and a BAA are available on every plan, alongside SOC 2 Type II, PCI, GDPR and ISO 27001, under one DPA. Also: Telnyx offers a BAA to customers who meet its commercial thresholds and who architect their use of the platform in line with Architecting HIPAA on Telnyx. support.telnyx.com/en/articles/3347891-hipaa-baas-and-the-conduit-exception Also: Telnyx signs a BAA with customers who meet its commercial thresholds, which it does not publish, through sales rather than self-serve. telnyx.com/ai-agents/soc-2-compliance telnyx.com/solutions/contact-center Read 14 Nov 2026.
  14. Telnyx Voice AI Agents, other compliance statements: Regulated-industry readiness on every plan, including pay as you go (All plans (Pay as you go, Growth, Enterprise)).On Telnyx, regulated-industry readiness is standard on every account, on every plan, including pay as you go. telnyx.com/pricing/voice-ai-agents Read 14 Nov 2026.
  15. Retell AI, other compliance statements: HIPAA compliant; a signed BAA is required before sending health data.HIPAA — compliant for handling protected health information (PHI). A signed BAA is required before transmitting PHI through Retell. docs.retellai.com/general/compliance Read 14 Nov 2026.
  16. Vapi, other compliance statements: States SOC 2, HIPAA and PCI compliance.SOC 2, HIPAA, and PCI compliant vapi.ai Read 14 Nov 2026.
  17. ElevenLabs Agents (ElevenAgents), other compliance statements: ElevenLabs Agents is a HIPAA-eligible service.ElevenLabs Agents is one of ElevenLabs’ HIPAA-eligible services, and we offer Business Associate Agreements (BAAs) to eligible customers. elevenlabs.io/docs/eleven-agents/legal/hipaa Read 14 Nov 2026.
  18. Synthflow AI, other compliance statements: Trust Center list, as given on the pricing page: SOC 2 Type 2, ISO/IEC 27001, GDPR, HIPAA (self-attested), PCI DSS v4.0.1; ISO/IEC 42001, DORA and the EU AI Act shown as in progress.Synthflow's Trust Center lists SOC 2 Type 2, ISO/IEC 27001, GDPR, HIPAA (self-attested) and PCI DSS v4.0.1, and shows ISO/IEC 42001:2023, DORA and the EU AI Act as in progress. synthflow.ai/pricing Read 14 Nov 2026.
  19. Synthflow AI, other compliance statements: HIPAA Setting: protected health information not logged, recorded or stored persistently (HIPAA Setting switched on (off by default)).With the HIPAA Setting on, Synthflow does not log, record, or persistently store protected health information. synthflow.ai/security Read 14 Nov 2026.
  20. ElevenLabs Agents (ElevenAgents), other compliance statements: Zero Retention Mode: no PII logged or stored after a call.Zero Retention Mode (ZRM) enhances data privacy by ensuring that no Personally Identifiable Information (PII) is logged during or stored after a call. elevenlabs.io/docs/eleven-agents/customization/privacy/zrm Read 14 Nov 2026.
  21. Vapi, other compliance statements: HIPAA mode and Zero Data Retention cannot be on together.HIPAA mode and Zero Data Retention (ZDR) are mutually exclusive. Disable one before enabling the other. docs.vapi.ai/security-and-privacy/hipaa Read 14 Nov 2026.
  22. Vapi, what that fee includes: None: speech, model, voice, transport extra (All packages).Four components: speech-to-text, the language model, text-to-speech, and transport. Each is billed at the provider's listed price with no markup. Vapi's $0.05/min hosting fee is added on top. vapi.ai/pricing Read 14 Nov 2026.
  23. Vapi, bring your own model, voice or carrier: Bring your own provider keys; that provider then bills you directly.Once your API key is validated, you won’t be charged when using that provider through Vapi. Instead, you’ll be charged directly by the provider. docs.vapi.ai/customization/provider-keys Read 14 Nov 2026.
  24. ElevenLabs Agents (ElevenAgents), how the AI model is charged: Passed through at provider rates, no markup.Pass-through pricing: ElevenLabs passes through third-party LLM costs at the provider’s published rate, with no markup. elevenlabs.io/docs/eleven-agents/customization/llm Read 14 Nov 2026.
  25. ElevenLabs Agents (ElevenAgents), other phone rates: No ElevenLabs rate; your carrier bills you (Free, Starter, Creator, Pro, Scale, Business).You connect your own provider, such as Twilio or a SIP trunk, and that provider bills you directly for the carrier side of the call at whatever rate you have with them. elevenlabs.io/pricing/agents Read 14 Nov 2026.
  26. Retell AI, bring your own model, voice or carrier: Bring your own AI model (custom LLM over WebSocket).With a custom LLM, you own response generation. Retell handles the call itself (telephony, transcription, turn-taking, speech synthesis) and opens a WebSocket to your server for each call. docs.retellai.com/integrate-llm/overview Read 14 Nov 2026.
  27. Retell AI, bring your own model, voice or carrier: Bring your own carrier and numbers via SIP.This guide shows how to integrate Retell agents with your telephony provider and use your own numbers. docs.retellai.com/deploy/custom-telephony Read 14 Nov 2026.
  28. Retell AI, other compliance statements: Zero data retention agreements with model, speech and voice providers.Retell has Zero Data Retention (ZDR) agreements with its LLM, speech recognition, and text-to-speech subprocessors, so these providers don’t retain your call data after they process it. docs.retellai.com/general/compliance Read 14 Nov 2026.
  29. Telnyx Voice AI Agents, other compliance statements: Under a BAA, AI features handling PHI must use Telnyx-hosted models (Customers with a Telnyx BAA).Any AI-powered features or services currently available through Telnyx must only be used in workflows that process PHI via Telnyx-hosted models (e.g. llama and qwen) and store any such retained data on Telnyx-hosted infrastructure. telnyx.com/resources/architecting-hipaa-telnyx Read 14 Nov 2026.
  30. Telnyx Voice AI Agents, how the AI model is charged: Anthropic, OpenAI: at provider list rates (All plans (Pay as you go, Growth, Enterprise). Managed frontier models).Managed frontier models from Anthropic and OpenAI are billed at provider list rates on the same Telnyx invoice. telnyx.com/pricing/voice-ai-agents Read 14 Nov 2026.
  31. Telnyx Voice AI Agents, bring your own model, voice or carrier: ElevenLabs voices with your own API key.ElevenLabs: BYO API key telnyx.com/pricing/voice-ai-agents Read 14 Nov 2026.
  32. Bland AI, bring your own model, voice or carrier: Your own Twilio account or SIP trunks.Yes. Bland integrates with your existing Twilio account, with SIP trunks from any contact-center or telephony provider, or you can use Bland's built-in Twilio at pass-through cost. BYOT customers do not pay transfer fees. bland.ai/pricing Read 14 Nov 2026.
  33. Synthflow AI, bring your own model, voice or carrier: Bring your own Twilio numbers.Bring your Twilio numbers: Keep numbers in your Twilio account and route them through Synthflow. docs.synthflow.ai/phone-numbers Read 14 Nov 2026.
  34. Ultravox, bring your own model, voice or carrier: Bring your own telephony: SIP trunking, Twilio or other providers.Ultravox is designed as a bring-your-own-telephony platform, giving you complete flexibility in how you connect voice AI to your users (inbound or outbound). Whether you’re using SIP trunking, Twilio, or any other telephony provider, Ultravox seamlessly integrates with your existing infrastructure. docs.ultravox.ai/gettingstarted/how-ultravox-works Read 14 Nov 2026.
  35. Ultravox, sOC 2: SOC 2 Type I: compliant.SOC 2 Type I Compliant trust.delve.co/ultravox Read 14 Nov 2026.
  36. Cartesia Managed Agents, hIPAA agreement (BAA): On the Enterprise plan; price not published (Enterprise. Enterprise pricing is custom ("Contact us")).DPAs and BAAs for compliance cartesia.ai/pricing Read 14 Nov 2026.
  37. Cartesia Managed Agents, hIPAA agreement (BAA): Signs BAAs with healthcare customers (Healthcare customers; this page names no plan).Yes. Cartesia is HIPAA compliant and SOC 2 Type II certified, and signs business associate agreements with healthcare customers. Details are in the Trust Center. cartesia.ai/use-cases/healthcare Read 14 Nov 2026.
  38. LiveKit Cloud, hIPAA agreement (BAA): BAA on Scale and Enterprise (Scale, Enterprise).BAAs available for Scale and Enterprise customers handling protected health information. livekit.com/security Read 14 Nov 2026.
  39. LiveKit Cloud, hIPAA agreement (BAA): Scale card lists "Security reports / HIPAA" (Scale).Everything in Ship, plus: Role-based access Metrics export APIs Region pinning Private links Security reports / HIPAA Inference discounts livekit.com/pricing Read 14 Nov 2026.
  40. LiveKit Cloud, hIPAA agreement (BAA): Signed on request after review; not guaranteed (Scale, Enterprise, Startup program).LiveKit signs a BAA upon request and review. Being on an eligible plan doesn't guarantee approval. docs.livekit.io/deploy/admin/hipaa Read 14 Nov 2026.
  41. LiveKit Cloud, hIPAA agreement (BAA): Startup program: eligible for a BAA (Startup program).Startup program Free for eligible startups Apply online  docs.livekit.io/deploy/admin/hipaa Read 14 Nov 2026.
  42. LiveKit Cloud, hIPAA agreement (BAA): Speech, model and voice providers your agent calls directly through a plugin: not covered; you need your own BAA with each.Providers your agent calls directly through a plugin aren't covered. You need your own BAA with each one. docs.livekit.io/deploy/admin/hipaa Read 14 Nov 2026.
  43. LiveKit Cloud, hIPAA agreement (BAA): Models run through LiveKit Inference: covered only for the models it lists.LiveKit Inference is HIPAA-compliant when the following models are used: livekit.com/legal/hipaa Read 14 Nov 2026.
  44. LiveKit Cloud, hIPAA agreement (BAA): Build and Ship: no HIPAA BAA (Build, Ship).| HIPAA compliance | No | No | Yes | Yes | livekit.com/pricing.md Read 14 Nov 2026.
  45. Pipecat Cloud, hIPAA agreement (BAA): Daily can sign a BAA covering Pipecat Cloud (Not tied to a named plan. HIPAA controls turned on and the BAA signed only after you contact help@daily.co; the page gives no price).Daily can sign a Business Associate Agreement covering: Pipecat Cloud Daily WebRTC infrastructure Daily transcription services A single BAA covers all these services. docs.pipecat.ai/pipecat-cloud/security/hipaa Read 14 Nov 2026.
  46. PolyAI, hIPAA agreement (BAA): Enterprise only; not on Essentials to Scale (Enterprise (not Essentials, Plus or Scale)).Every plan runs on SOC 2 and ISO 27001 certified infrastructure. Enterprise adds HIPAA with a BAA, SSO, PCI card capture, data storage in your region and an uptime SLA. poly.ai/pricing Read 14 Nov 2026.
  47. PolyAI, hIPAA agreement (BAA): BAA available; no plan named (Not named (Dialog-RSN-1 model page)).Independent guardrails at every layer of the conversation, strict data residency and retention controls, and the certifications enterprise security teams expect — ISO/IEC 27001:2022, SOC 2+ Type 2, HIPAA (BAA available), PCI DSS, Cyber Essentials Plus, and GDPR-ready EU residency. poly.ai/dialog-rsn-1 Read 14 Nov 2026.
  48. Smallest.ai Atoms, hIPAA agreement (BAA): Enterprise plans, with Zero Data Retention (Enterprise. Zero Data Retention enabled).Yes, on Enterprise plans with Zero Data Retention enabled. Contact sales@smallest.ai. docs.smallest.ai/voice-agents/resources/faq Read 14 Nov 2026.