T
On some plansIs Twilio HIPAA compliant?
Checked 6 Nov 2026 from 4 vendor sources
Twilio signs a BAA only with customers on Security Edition or Enterprise Edition, and PHI workflows may use only products on its HIPAA Eligible list. So the answer depends on your plan. Check yours below before any patient data goes in.
| Plan or product | BAA |
|---|---|
| Accounts without Security Edition or Enterprise Edition | Not covered |
| Security Edition | Covered |
| Enterprise Edition | Covered |
What the BAA leaves out
- SendGrid email, including Verify email and Flex email
- WhatsApp and Facebook Messenger
- Marketplace add-ons and third-party APIs
- Autopilot
- Verify Fraud Guard
- Unified Profiles and Agent Copilot in Flex
- Engage Premier campaigns and Generative Audiences
- AI providers used with Conversation Relay need their own BAA; Twilio’s BAA does not cover them
- Conversation Relay must not be used for clinical decisions, medical advice or claims decisions
- PHI must not go in support tickets
- Next-generation Conversation Intelligence, and classic Conversation Intelligence for Conversations
- Voice for AI Assistants
- Flex Webchat 2.x and earlier
- Segment Engage email and SMS Campaigns
How to get the BAA
Contact your Twilio account representative or Twilio Sales.
What the vendor says to do
- Buy a Twilio Editions package that includes HIPAA Accounts
- Execute the Business Associate Addendum with your Twilio account manager
- Designate HIPAA Projects in the Console or through Support
- Use only HIPAA Eligible Services for PHI workflows
- Use HTTPS and verify signed webhooks
- Secure SIP traffic with TLS and SRTP or use Twilio Interconnect
- Limit voice and SMS traffic to US area codes
- Use Message Body Redaction and protect MMS media and recordings with HTTP basic auth
Proof from the vendor
- Twilio and HIPAASecurity or Enterprise Edition required; shared responsibility; how to contact
- HIPAA Accounts, Twilio docsSetup steps and eligibility rule
- HIPAA Eligible ServicesLists SMS, MMS, Voice, Video, Verify, Flex and others (June 30, 2026); SendGrid absent
- Architecting for HIPAA on TwilioNot-eligible list, AI and support limits, customer steps (June 30, 2026)
This isn’t legal advice. A BAA is one requirement. Your clinic still has to set the tool up correctly and control who has access. Vendors change their terms, so confirm with the vendor before you sign. PHI means protected health information, which includes patient data.