Hi — I’m evaluating Retell for a HIPAA-compliant m...
# ❓・ai-evy-supportj
Joe
03/31/2026, 1:28 PM@AI Evy Hi — I’m evaluating Retell for a HIPAA-compliant medical spa voice agent and had a question specifically about the LLM layer.
If I use Retell’s built-in GPT/LLM, is that component fully covered under your HIPAA compliance and BAA?
More specifically:
Is all data sent to and from the LLM included within the scope of your BAA?
Is PHI processed by the LLM stored, logged, or retained in any way?
Is the LLM provider itself covered under your compliance framework (e.g., subcontractor BAAs)?
Can LLM data retention be disabled or configured (e.g., zero retention)?
I want to confirm whether using the built-in LLM is compliant, or if I need to route requests through my own HIPAA-enabled LLM endpoint.
Appreciate any documentation or clarification you can share.
a
AI Evy
03/31/2026, 1:28 PMThanks for tagging me @Joe. I'll look through relevant sources and get back to you shortly.
AI Evy
03/31/2026, 1:29 PM### Answer
Retell AI offers HIPAA compliance through Business Associate Agreements (BAAs) that you can sign at no additional cost. [(1) ]() [(2) ]() The platform includes comprehensive safeguards including end-to-end encryption for all calls and data, and data retention controls. [(3) ]()
For PHI handling specifically, you can opt out of data storage after the call ends so it won't be stored on Retell's systems. [(2) ]() This is configured through the privacy settings documented at
Regarding your specific questions about LLM coverage under the BAA and whether LLM providers have subcontractor BAAs in place, I don't have detailed documentation that explicitly addresses these technical implementation details. For comprehensive information about compliance controls and how the LLM layer specifically is covered, you can check the [trust center]() or email compliance@retellai.com.
To get started with HIPAA compliance for your medical spa voice agent:
1. Sign the BAA at
2. Configure data retention settings to opt out of storing PHI on Retell's systems
3. Contact compliance@retellai.com for specific questions about LLM provider coverage and subcontractor agreements
AI Evy
03/31/2026, 1:29 PM
To learn more, see the sources I considered:
[[1] Retell AI’s Voice Agents: HIPAA Compliance and BAAs | Retell AI](https://www.retellai.com/blog/do-retell-ais-voice-agents-have-hipaa-compliance-and-baas)
[[2] Discord message from @omar.13. on 2026-01-28](https://discord.com/channels/1186424376300679209/1186462578310910112/1466180363058544713)
[[3] Health Care Use Case](https://community.retellai.com/t/health-care-use-case/746)
AI Evy
03/31/2026, 1:29 PMFeel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.