### Answer Retell AI is fully HIPAA-compliant across all plans, including pay-as-you-go. [(1) ]() [(2) ]() All interactions are encrypted in transit and at rest, with role-based access control (RBAC) , multi-factor authentication, and audit logging to prevent unauthorized access. [(1) ]() [(3) ]() To enhance HIPAA compliance for your use case, you can enable PII Redaction to automatically remove sensitive information from transcripts and recordings: [(4) ]() 1. Open your agent's Security & Fallback Settings 2. Under Personal Info Redaction, select which PII types to redact (names, DOBs, SSNs, passwords, emails, etc.) 3. Check the boxes for the sensitive information you want redacted and save The redacted information will automatically be replaced in transcripts, while administrators and developers can still access it for auditing purposes if needed. Retell AI also offers Business Associate Agreements (BAAs) at no additional cost under the pay-as-you-go plan. [(1) ]() [(2) ]() The platform integrates with HIPAA-compliant EHR systems like Epic, OpenDental, and eClinicalWorks. [(1) ]() [(3) ]()

​ To learn more, see the sources I considered: [[1] Retell AI’s Voice Agents: HIPAA Compliance and BAAs | Retell AI](https://www.retellai.com/blog/do-retell-ais-voice-agents-have-hipaa-compliance-and-baas) [[2] I need a quote on HIPAA compliance](https://discord.com/channels/1186424376300679209/1354587257335451708) [[3] AI voice agent for Healthcare | healthcare AI calls](https://www.retellai.com/healthcare) [[4] Secure AI Conversations with Retell AI PII Redaction Tool | Retell AI | Retell AI](https://www.retellai.com/blog/introducing-retell-ai-pii-redaction-data-security-made-easy) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer Yes, if you're handling Protected Health Information (PHI) , signing a Business Associate Agreement (BAA) with Retell is mandatory before handling PHI. [(1) ]() This applies regardless of whether you're a developer or organization. [(2) ]() The good news is that Retell offers BAAs at no additional cost on the pay-as-you-go plan. [(2) ]() [(3) ]() You can sign the BAA here: [(3) ]() Alternatively, you can request a BAA by emailing support@retellai.com with the signer name and email address. [(4) ]() Once you sign the BAA, you should keep the "Opt-out of sensitive data storage" toggle OFF to store call logs, transcripts, recordings, and metadata in Retell's encrypted systems. [(1) ]() All stored data remains encrypted both in transit and at rest, with access controls and audit logging according to HIPAA and SOC 2 standards. For additional compliance questions, you can contact compliance@retellai.com. [(3) ]()

​ To learn more, see the sources I considered: [[1] HIPPA question](https://discord.com/channels/1186424376300679209/1394351588180758660) [[2] Retell AI’s Voice Agents: HIPAA Compliance and BAAs | Retell AI](https://www.retellai.com/blog/do-retell-ais-voice-agents-have-hipaa-compliance-and-baas) [[3] Discord message from @nabokov0482 on 2026-01-28](https://discord.com/channels/1186424376300679209/1186462578310910112/1466157836168990852) [[4] BAA for HIPAA Compliance](https://discord.com/channels/1186424376300679209/1328413653992476805) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer No, you cannot build a healthcare application that handles Protected Health Information (PHI) without signing a Business Associate Agreement (BAA) . [(1) ]() Signing a BAA with Retell is mandatory before handling PHI. This is a legal requirement under HIPAA regulations, not an optional feature. [(2) ]() You can build and test your application without a BAA, but you cannot use it to handle actual patient data or PHI until the BAA is signed. [(3) ]() The BAA ensures that both you and Retell have the proper legal safeguards in place for handling sensitive healthcare information. The good news is that Retell offers BAAs at no additional cost. [(2) ]() You can sign one at or request it by emailing support@retellai.com with the signer name and email address. [(3) ]()

​ To learn more, see the sources I considered: [[1] HIPPA question](https://discord.com/channels/1186424376300679209/1394351588180758660) [[2] Retell AI’s Voice Agents: HIPAA Compliance and BAAs | Retell AI](https://www.retellai.com/blog/do-retell-ais-voice-agents-have-hipaa-compliance-and-baas) [[3] BAA for HIPAA Compliance](https://discord.com/channels/1186424376300679209/1328413653992476805) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer Yes, you're correct that there's a Personal Info Redaction option in Security & Fallback Settings. [(1) ]() [(2) ]() [(3) ]() This PII redaction feature automatically detects and removes sensitive information like names, addresses, dates of birth, passwords, and PINs from both transcripts and recordings. However, PII redaction is a technical safeguard, not a replacement for the BAA. The BAA is a legal requirement under HIPAA when handling Protected Health Information. PII redaction is an additional layer of protection that helps you comply with HIPAA's technical safeguard requirements, but it doesn't eliminate the need for the legal agreement. [(1) ]() To configure PII redaction: [(1) ]() [(2) ]() [(3) ]() 1. Go to your agent's Security & Fallback Settings 2. Under Personal Info Redaction, click Setup 3. Select which PII types to redact (names, DOBs, passwords, PINs, etc.) 4. Check the boxes for what you want redacted and save This feature is available on all pricing plans at $0.01/min. [(2) ]() [(3) ]() Admins and developers can still view redacted information if needed for auditing purposes. [(1) ]() [(2) ](

​ To learn more, see the sources I considered: [[1] Secure AI Conversations with Retell AI PII Redaction Tool | Retell AI | Retell AI](https://www.retellai.com/blog/introducing-retell-ai-pii-redaction-data-security-made-easy) [[2] Retell PII Redaction | Remove personal info from audio and transcription]() [[3] GPT-5s, SMS Agents, PII Redaction & More](https://www.retellai.com/changelog/gpt-5s-sms-agents-pii-redaction-more) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

GA3k)

### Answer The process to configure a BAA with Retell AI is straightforward: *Option 1: Self-Service (Recommended) * Sign the BAA directly at [) [(1) ]() Option 2: Email Request Send an email to support@retellai.com with the signer name and email address. [(2) ]() After Signing the BAA: Keep the "Opt-out of sensitive data storage" toggle OFF to ensure call logs, transcripts, recordings, and metadata are stored in Retell's encrypted systems. [(3) ]() All stored data remains encrypted both in transit and at rest, with access controls and audit logging according to HIPAA and SOC 2 standards. Additional Configuration: For enhanced protection, enable PII Redaction in your agent's Security & Fallback Settings to automatically remove sensitive information from transcripts and recordings. [(4) ]() For compliance questions, contact compliance@retellai.com. [(1) ]()

​ To learn more, see the sources I considered: [[1] Discord message from @nabokov0482 on 2026-01-28](https://discord.com/channels/1186424376300679209/1186462578310910112/1466157836168990852) [[2] BAA for HIPAA Compliance](https://discord.com/channels/1186424376300679209/1328413653992476805) [[3] HIPPA question](https://discord.com/channels/1186424376300679209/1394351588180758660) [[4] Retell AI’s Voice Agents: HIPAA Compliance and BAAs | Retell AI](https://www.retellai.com/blog/do-retell-ais-voice-agents-have-hipaa-compliance-and-baas) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

Thanks for the follow-up, @AK. I'll get back to you soon.

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer Based on the available sources, I don't have specific information about adding custom PII types like "insurance provider name" to Retell's PII redaction feature. The PII redaction feature allows you to select from predefined PII types such as names, addresses, dates of birth, passwords, and PINs. [(1) ]() [(2) ]() [(3) ]() However, the sources don't indicate whether you can add custom PII categories beyond these standard options. If you need to redact insurance provider names specifically, you might want to contact support@retellai.com or compliance@retellai.com to inquire about custom PII redaction options or whether this falls under one of the existing categories like "names." Alternatively, if insurance provider names need special handling during transcription rather than redaction, you could use Boosted Keywords to improve recognition accuracy for specific insurance provider names. [(4) ]() [(5) ]() [(6) ]() This helps the transcription model better recognize these terms, though it doesn't redact them.

### Answer Signing a BAA with Retell AI is necessary but not sufficient for full HIPAA compliance when using Twilio SIP trunking. You'll also need to configure Twilio's Secure Trunking feature. [(1) ]() What you need: 1. Sign BAA with Retell AI - You've already done this or plan to 2. Sign BAA with Twilio - Required since Twilio handles PHI during call routing 3. Enable Secure Trunking in Twilio - This is mandatory for HIPAA compliance Configuration steps for Secure Trunking: - Enable TLS in Twilio's SIP Domain (use

sips:yourdomain.pstn.twilio.com:5061

) - Allow port 5061 in your firewall rules - Test TLS connectivity with:

openssl s_client -connect yourdomain.pstn.twilio.com:5061

Important note: Without Secure Trunking enabled, you can still be compliant if you're using SRTP and have signed BAAs with both providers. However, for full compliance, enabling Secure Trunking is recommended. Retell's SIP server supports: [(2) ]() - TLS transport (use

sip:sip.retellai.com;transport=tls

) - SRTP media encryption (requires TLS transport) After signing the BAA with Retell, keep the "Opt-out of sensitive data storage" toggle OFF so call logs, transcripts, and recordings remain encrypted in Retell's systems with proper access controls and audit logging. [(3) ]()

​ To learn more, see the sources I considered: [[1] Twilio Secure Trunking Prevents Calls](https://discord.com/channels/1186424376300679209/1368909691211747419) [[2] Custom Telephony Overview](https://docs.retellai.com/deploy/custom-telephony) [[3] HIPPA question](https://discord.com/channels/1186424376300679209/1394351588180758660) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer Yes, using a Retell AI phone number will be HIPAA compliant once you've signed the BAA with Retell AI. [(1) ]() Retell AI is fully HIPAA-compliant across all plans, including pay-as-you-go. All interactions are encrypted in transit and at rest, with role-based access control (RBAC) , multi-factor authentication, and audit logging to prevent unauthorized access. What you need to do: 1. Sign the BAA with Retell AI - You can sign at or email support@retellai.com [(2) ]() 2. Keep "Opt-out of sensitive data storage" toggle OFF - This ensures call logs, transcripts, recordings, and metadata are stored in Retell's encrypted systems with proper access controls and audit logging according to HIPAA and SOC 2 standards [(3) ]() 3. Optionally enable PII Redaction - For additional protection, configure PII redaction in Security & Fallback Settings to automatically remove sensitive information from transcripts and recordings [(1) ]() Using Retell AI's phone numbers is simpler than using custom SIP trunking because you don't need to manage separate BAAs with telephony providers or configure secure trunking settings. The entire call flow stays within Retell AI's HIPAA-compliant infrastructure.

​ To learn more, see the sources I considered: [[1] Retell AI’s Voice Agents: HIPAA Compliance and BAAs | Retell AI](https://www.retellai.com/blog/do-retell-ais-voice-agents-have-hipaa-compliance-and-baas) [[2] BAA for HIPAA Compliance](https://discord.com/channels/1186424376300679209/1328413653992476805) [[3] HIPPA question](https://discord.com/channels/1186424376300679209/1394351588180758660) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer Based on the available sources, this issue occurs because PII Redaction and Post-Call Analysis don't work together when data storage is disabled. [(1) ]() When you enable PII Redaction, sensitive information gets replaced with placeholders like

[person name]

in transcripts and recordings. [(2) ]() [(3) ]() However, if you have "Opt-out of sensitive data storage" enabled, Post-Call Analysis won't run automatically because Retell cannot store or process the data post-call. [(1) ]() To fix this: You need to disable the "Opt-out of sensitive data storage" toggle to allow Post-Call Analysis to run and capture the actual data before PII redaction is applied. This means: 1. Keep the data storage toggle OFF (disabled) so Retell can store and analyze calls 2. The Post-Call Analysis will extract the actual values (like real names) 3. PII Redaction will still protect the transcripts and recordings by replacing sensitive info with placeholders Important consideration for HIPAA compliance: Since you've signed the BAA with Retell AI, keeping data storage enabled is actually the recommended approach. All stored data remains encrypted both in transit and at rest, with access controls and audit logging according to HIPAA and SOC 2 standards. If you absolutely need to opt out of data storage, you would need to receive the transcript via webhook and run your own analysis externally, as Retell cannot process the data for Post-Call Analysis when storage is disabled.

​ To learn more, see the sources I considered: [[1] Post-Call Analysis](https://discord.com/channels/1186424376300679209/1339583616665255968) [[2] Secure AI Conversations with Retell AI PII Redaction Tool | Retell AI | Retell AI](https://www.retellai.com/blog/introducing-retell-ai-pii-redaction-data-security-made-easy) [[3] Retell PII Redaction | Remove personal info from audio and transcription]() ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer Yes, changing from "Everything except PII" to "Everything" will still be HIPAA-compliant as long as you've signed the BAA with Retell AI. [(1) ]() Under the Data Storage Settings, you have three options: [(2) ]() 1. Everything — store transcripts, recordings, and logs 2. Everything except PII — store content, excluding PII when possible 3. Basic Attributes Only — store only metadata (no transcripts/recordings/logs) When you select "Everything," all stored data remains encrypted both in transit and at rest, access-controlled, and audit-logged according to HIPAA and SOC 2 standards. [(1) ]() The key requirement for HIPAA compliance is having the signed BAA in place, not which storage setting you choose. The difference between the options: - "Everything except PII" automatically scrubs categories like person_name, address, email, phone_number, SSN, passport, driver_license, credit_card, bank_account, password, pin, medical_id, and date_of_birth from your transcripts and recordings [(2) ]() - "Everything" stores all artifacts (transcripts, recordings, logs) without automatic PII scrubbing Both options maintain HIPAA compliance when you have a signed BAA because Retell's infrastructure provides the required encryption, access controls, and audit logging. [(1) ]() The "Everything except PII" option adds an additional layer of protection by automatically removing sensitive information, but it's not mandatory for compliance. For your use case where you need actual names in Post-Call Analysis data sent to your CRM, selecting "Ever

ything" is the appropriate choice and remains fully HIPAA-compliant.

​ To learn more, see the sources I considered: [[1] HIPPA question](https://discord.com/channels/1186424376300679209/1394351588180758660) [[2] Data Storage Settings - Retell AI](https://docs.retellai.com/accounts/privacy-disable) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer Yes, when you use Retell AI's default infrastructure without your own API keys, all components—including the LLM (such as OpenAI) , STT (Speech-to-Text) , and TTS (Text-to-Speech) —will be HIPAA-compliant as long as you've signed the BAA with Retell AI. [(1) ]() [(2) ]() Retell AI supports HIPAA-ready deployments along with SOC 2 and GDPR security frameworks. [(2) ]() [(3) ]() The platform ensures that all interactions are encrypted in transit and at rest, with role-based access control (RBAC) , multi-factor authentication, and audit logging to prevent unauthorized access. [(1) ]() Key points: - Retell AI handles the HIPAA compliance for all the underlying providers (LLM, STT, TTS) when you use their infrastructure [(1) ]() [(2) ]() - You don't need to sign separate BAAs with OpenAI or other providers when using Retell's default setup [(1) ]() - All data remains encrypted and access-controlled according to HIPAA standards [(1) ]() [(4) ]() What you need: 1. Sig

n the BAA with Retell AI at [(4) ]() 2. Keep the data storage settings configured appropriately (as discussed in your previous question) 3. Retell AI manages the compliance for all underlying services For additional compliance questions, you can contact compliance@retellai.com.

​ To learn more, see the sources I considered: [[1] Retell AI’s Voice Agents: HIPAA Compliance and BAAs | Retell AI](https://www.retellai.com/blog/do-retell-ais-voice-agents-have-hipaa-compliance-and-baas) [[2] 5 Voice AI Platforms Compliant With HIPAA & Healthcare Regulations | Retell AI](https://www.retellai.com/blog/5-voice-ai-platforms-compliant-with-hipaa-healthcare-regulations) [[3] 10 Best HIPAA-Compliant AI Voice Agents for Healthcare & Clinics in 2026 | Retell AI](https://www.retellai.com/blog/10-best-hipaa-compliant-ai-voice-agents-for-healthcare-clinics) [[4] Discord message from @nabokov0482 on 2026-01-28](https://discord.com/channels/1186424376300679209/1186462578310910112/1466157836168990852) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.

### Answer I don't have specific information in the available sources about whether Retell AI's BAA covers third-party integrations like Cal.com. Here's what you need to understand about HIPAA compliance with third-party integrations: When your Retell AI agent calls external services (like Cal.com) that will handle or store Protected Health Information (PHI) , those third-party services typically need their own HIPAA compliance measures in place. [(1) ]() General HIPAA principle: Each entity that handles PHI needs to be HIPAA-compliant independently. Retell AI's BAA covers the data flowing through Retell's infrastructure, but when you integrate with external services, you're creating a new data flow that falls outside Retell's direct control. What this likely means for Cal.com: If patient names, appointment details, or any other PHI will be transmitted to and stored in Cal.com, you would typically need: - A HIPAA-compliant Cal.com plan - A signed BAA with Cal.com Recommendation: Contact support@retellai.com or compliance@retellai.com to confirm whether third-party calendar integrations require separate HIPAA compliance arrangements. [(2) ]() They can provide definitive guidance on your specific use case.

​ To learn more, see the sources I considered: [[1] Retell AI’s Voice Agents: HIPAA Compliance and BAAs | Retell AI](https://www.retellai.com/blog/do-retell-ais-voice-agents-have-hipaa-compliance-and-baas) [[2] BAA for HIPAA Compliance](https://discord.com/channels/1186424376300679209/1328413653992476805) ​

Feel free to tag @AI Evy with additional questions. I also appreciate feedback, it helps me improve.