openai/twilio-security-compliance-hipaa

Overview

HIPAA compliance on Twilio is a shared responsibility — Twilio provides eligible services and configuration tools, but your application must architect correctly. Getting this wrong means PHI exposure and compliance violations.

Sequence: Execute BAA → Designate HIPAA Project(s) → Use only eligible services → Follow per-product requirements

---

Step 1: Execute a BAA

• Contact your Twilio Account Representative to execute a Business Associate Addendum
• Purchase a Twilio Editions package that includes HIPAA Accounts
• BAA is required before any PHI touches Twilio infrastructure

---

Step 2: Designate HIPAA Project(s)

Self-Service (BAA initiated after June 6, 2024)

1. Create an Organization in Twilio Console
2. Link accounts/projects/subaccounts to the Organization
3. Console → Twilio Admin → Accounts → Select account → Enable HIPAA flag
4. Save

Support Ticket (BAA initiated before June 6, 2024)

Open a Support ticket through Console to request HIPAA designation for specific accounts/projects/subaccounts.

Subaccount Behavior

• Existing subaccounts are NOT auto-designated — Must be individually flagged
• New subaccounts created AFTER designation DO auto-inherit HIPAA status
• Verify each subaccount's HIPAA flag — don't assume inheritance

What Changes When HIPAA Is Enabled

• Console auto-logoff after 15 minutes of inactivity
• Account exempt from certain content moderation (but still subject to carrier complaint review)
• No PHI in support tickets — use SIDs (CallSid, MessageSid) instead of phone numbers

---

HIPAA Eligible Services

Eligible (use these for PHI workflows)

| Category | Services | |----------|----------| | Voice | Programmable Voice, Recordings*, Transcription*, Media Streams*, ConversationRelay*, Conversational Intelligence for Voice*, SIP Interface*, Elastic SIP Trunking*, Voice Insights, AMD, <Pay>, Conference, Coaching, Transfers | | SMS | Programmable SMS, MMS, Long Codes, Toll-Free, Short Codes, Messaging Services (opt-out, fallback, geomatch, sticky sender, scheduling, link shortening) | | Identity | Verify (SMS + Voice + Push only), Lookup | | Conversations | Chat, SMS, MMS, Group Texting (NOT WhatsApp) | | Flex | Voice, SMS, Chat, Conversations, Webchat 3.x.x*, TaskRouter, Proxy, Flex Insights* | | Segment | Connections (Sources, Destinations*, Functions*), Reverse ETL*, Unify, Engage Foundations*, Protocols, Privacy Portal* | | Runtime | Studio*, Functions, Debugger, API Explorer, Sync, Private Assets*, TwiML Bin* | | Data | Event Streams |

Items marked with * require additional configuration per "Architecting for HIPAA on Twilio" guidance.

NOT Eligible (do NOT use for PHI)

• WhatsApp — Meta does not offer a BAA
• SendGrid Email (including Email in Flex and Verify Email channel)
• AI Assistants (including Voice for AI Assistants)
• Verify Fraud Guard
• Conversational Intelligence for Conversations (only Voice channel is eligible)
• Agent Copilot, Unified Profiles in Flex
• Engage Premier, Generative Audiences, Campaigns
• Twilio Marketplace add-ons — even with third-party BAA
• Autopilot
• Flex Webchat 2.x.x (must migrate to 3.x.x)

Geographic restriction: Only US area codes for Voice and SMS HIPAA traffic.

---

Per-Product Requirements

Voice & Recordings

• HTTP auth required for recording URLs — Enable in Console → Voice Settings. Recording URLs are public by default.
• Voice Recording Encryption recommended — Encrypts with your public key before cloud storage
• ConversationRelay: Your AI Provider must have their own BAA. Cannot use for clinical/medical decision-making.
• Conversation Intelligence for Voice: Only Azure OpenAI for generative operators. No PHI in operator prompts. Data use auto-disabled for HIPAA accounts. PII Redaction recommended (auto-redacts 21 PHI field types).

SMS & MMS

• HTTP auth required for MMS Media URLs — Enable in Console → Messaging → Settings → General
• Message Redaction recommended — Redacts message bodies and phone numbers from Console/API/support
• No PHI in Message Tags — custom attributes in Message Tagging must not contain PHI
• Message Redaction prerequisites:
  1. Disable Sticky Sender and Fallback to Long Code on Messaging Services
  2. Contact Support to disable built-in STOP filtering (then implement custom STOP handling)
  3. Set all webhooks to POST (GET logs params for 7 days, defeating redaction)
  4. Incompatible with Studio, Flex, and Conversations

Verify

• Only SMS, Voice, and Push channels — Email channel is NOT eligible
• Fraud Guard is NOT eligible — do not enable for HIPAA workflows

Flex

• Flex Insights: Twilio auto-redacts PII from TaskRouter attributes (names, phone, email). Visual waveform and speech metrics disabled.
• Customer must: Ensure no PHI in preserved Attribute fields, Comments, or Assessments. Implement session timeout (Flex has no built-in timeout). Secure Flex Plugins for HIPAA.
• No WhatsApp, Facebook Messenger, or SendGrid Email in Flex HIPAA workflows

Event Streams

• Customer responsible for HIPAA-compliant sink configuration (e.g., AWS Kinesis requires Amazon's HIPAA architecture)
• Non-eligible product event types must not process PHI

---

CANNOT

• Cannot use WhatsApp for HIPAA workflows — Meta does not offer a BAA. Applies to all Twilio products (Conversations, Flex, Frontline).
• Cannot use SendGrid Email — Not HIPAA eligible in any context (Verify, Flex, standalone).
• Cannot use Verify Fraud Guard or Email channel — Not eligible. Only SMS, Voice, Push.
• Cannot use AI Assistants — Even with ConversationRelay, AI Assistants integration is not eligible.
• Cannot use non-US area codes — Voice and SMS HIPAA traffic limited to US area codes.
• Cannot put PHI in support tickets — Use SIDs for troubleshooting. Use Console chat, email, or Support Center.
• Cannot assume subaccount HIPAA inheritance — Existing subaccounts must be individually flagged.
• Cannot use GET webhooks with Message Redaction — GET parameters are logged for 7 days.
• Cannot use Marketplace add-ons — Even with a third-party BAA, Marketplace is not eligible.
• Cannot use Conversation Intelligence for Conversations — Only Voice channel is HIPAA eligible.

---

Next Steps

• Authentication setup: twilio-security-api-auth
• Account structure for HIPAA isolation: twilio-account-setup
• Credential security: twilio-security-hardening
• Traffic compliance (TCPA, GDPR, PCI): twilio-compliance-traffic

Official docs: HIPAA Eligible Services (PDF) | Architecting for HIPAA (PDF) | HIPAA account flag | Message Redaction