Last verified: October 2026, against Twilio's HIPAA page, its HIPAA Eligible Services list and its "Architecting for HIPAA" guide. General information, not legal advice — confirm with your compliance officer or attorney.
Is there a Twilio BAA? Yes: Twilio signs a Business Associate Addendum, its name for a BAA, only for customers on its Security or Enterprise Edition, and only for products on its HIPAA-eligible list. Most practices never sign it themselves: they meet Twilio inside a texting, reminder or phone app. Whether you're covered usually depends on that app's BAA with you, not on Twilio's.
Twilio BAA: the short answer from Twilio's documentation
Short answer (verified October 2026): Twilio's HIPAA page (opens in a new tab) says "Customers wishing to sign a BAA with Twilio must have our Security Edition or Enterprise Edition," that the BAA is added to Twilio's Terms of Service through an account representative or sales, and that customers handling PHI "should only use HIPAA Eligible Products and Services." Twilio's eligible services list (opens in a new tab) (last updated June 30, 2026) adds that covered entities agree "not to use the HIPAA Eligible Services for any purpose or in any manner involving Protected Health Information without first entering into a Twilio Business Associate Agreement."
Twilio describes HIPAA compliance as "a shared responsibility between the customer and Twilio." Its Architecting for HIPAA guide (opens in a new tab) spells out the customer's half.
For context: "twilio baa" gets about 110 searches a month in the US, at a CPC of $27.51 (Google Ads Keyword Planner data via DataForSEO, US, 12-month average to Sep 2026).
What HIPAA requires before patient information goes in
Every message Twilio carries is a "transmit" in HIPAA's "create, receive, maintain, or transmit protected health information" test (45 CFR 164.502(e) (opens in a new tab)). Before a vendor does that for a practice, HIPAA wants "satisfactory assurance" of safeguards in writing, under the contract terms listed in 45 CFR 164.504(e) (opens in a new tab). Our guide to business associate agreements explains them.
A Twilio BAA is necessary but not sufficient. Twilio's guide lists requirements the customer must build, such as HTTPS for every request, validating Twilio's signed webhooks, and keeping PHI out of support tickets.
This is general information, not legal advice. Confirm how it applies to your practice with a qualified advisor.
Which Twilio plans a BAA can cover
At Twilio, the BAA attaches to an Edition and to specific projects, not to a plan name.
| Twilio setup | BAA possible? | What Twilio's documents say |
|---|---|---|
| Free trial account | No | Messages only to verified numbers; expires after 30 days (Twilio Docs (opens in a new tab)) |
| Account without an Edition | No | BAA requires Security or Enterprise Edition |
| Security or Enterprise Edition | Yes | Accounts must be designated as "HIPAA Project(s)" |
The Editions page (opens in a new tab) lists "HIPAA Accounts" and sends buyers to sales; no price is published. Once a project is designated, Twilio's guide says the console logs users off after "15 minutes of inactivity."
What's eligible, per the June 2026 list:
- Eligible: Programmable Voice (calls, recordings, transcription), Programmable SMS and MMS, Twilio phone numbers, Verify, Lookup, Conversations (classic), Studio, Flex and parts of Segment.
- Limited: "Only SMS and MMS traffic to/from US area codes" is HIPAA-eligible, and the same applies to voice.
- Not eligible: WhatsApp and Facebook Messenger, Email in Flex through SendGrid, Marketplace add-ons, and the newer Conversation Intelligence and AI Assistants.
Two defaults to change: recording URLs and MMS media URLs "are public and do not require authentication" until you enforce HTTP basic auth, which Twilio says is required for HIPAA workflows. Twilio also offers Message Redaction to hide message bodies in the console.
Platforms built on Twilio: whose BAA covers you
When a reminder app, patient texting tool or marketing CRM sends your texts over Twilio, the chain looks like this:
| Link in the chain | Relationship | Contract that matters to you |
|---|---|---|
| Your practice | Covered entity | — |
| The platform you pay | Your business associate | Its BAA with your practice |
| Twilio | The platform's subcontractor | The platform's BAA with Twilio |
HIPAA puts the obligation on each link. A practice "is not required to obtain such satisfactory assurances from a business associate that is a subcontractor" (45 CFR 164.502(e)), but the platform's contract with you must make its subcontractors "agree to the same restrictions and conditions" (45 CFR 164.504(e)). So ask your vendor, in writing: will you sign a BAA with us, and do your messaging providers, Twilio included, sit under a BAA with you?
A Twilio BAA signed by your vendor doesn't cover your practice directly. Marketing platforms such as gohighlevel raise the same question; check that vendor's own BAA terms. For what belongs in a patient text at all, see texting.
Safe uses and unsafe uses for a practice
| Use | Safe? | Condition |
|---|---|---|
| Developer testing with fake data on a trial | Yes | No real patients |
| Staff on-call alerts with no patient details | Yes | No PHI in the message |
| Appointment reminders through a vendor | Yes | Vendor signs a BAA with you |
| Your own Twilio build sending reminders | Yes | Security or Enterprise Edition, BAA, HIPAA Projects |
| Patient messages over WhatsApp via Twilio | No | Not HIPAA-eligible |
| Patient emails through SendGrid in Flex | No | Not HIPAA-eligible |
| Call recordings left at default URLs | No | Enforce HTTP basic auth first |
Safer setup or alternatives
- List every tool that texts or calls patients, and ask each vendor for its BAA.
- If you build on Twilio, buy the right Edition, sign the BAA, designate HIPAA Projects and follow the Architecting guide line by line.
- Lock down media: HTTP basic auth on recordings and MMS, and consider Message Redaction.
- Keep texts to logistics. No results, diagnoses or treatment details.
- Keep PHI out of support tickets; Twilio asks for call or message SIDs instead.
For the other tools a practice uses, start at HIPAA and everyday tools.
Medfy doesn't sell texting or phone tools and doesn't send SMS marketing, so it isn't one of the links in the chain above. Its website forms and chat store patient data in separate, encrypted HIPAA databases in the US or Canada, covered by the BAA Medfy signs with each practice; see how Medfy handles patient data. A free marketing audit flags privacy risks on your site, such as pixels on patient forms.
Frequently asked questions
Will Twilio sign a BAA?
Yes, with conditions. As of October 2026, Twilio's HIPAA page says customers who want a BAA "must have our Security Edition or Enterprise Edition," and the BAA is arranged through an account representative or Twilio sales. It covers only the products on Twilio's HIPAA Eligible Services list, and accounts must be designated as HIPAA Projects. Most practices meet Twilio through a vendor instead, so confirm whose BAA applies with your compliance officer.
Is the free version of Twilio HIPAA compliant?
No. Twilio's free trial accounts can message only verified numbers, expire after 30 days and use Twilio-provided templates, and a BAA requires the Security or Enterprise Edition. Without that edition and a signed BAA, nothing sent through Twilio should contain patient information. A trial is for developers testing with made-up data, not for appointment reminders to real patients.
Can a practice use Twilio without patient information?
Yes. A developer can use Twilio for things like staff alerts, marketing opt-in confirmations or a test environment with fake data, without a BAA, as long as there's no realistic chance PHI flows through it. Twilio's own guidance allows non-eligible products only where there is no potential for PHI to be exchanged in violation of HIPAA. Appointment and billing texts to patients don't meet that bar.
What is a HIPAA-compliant alternative to Twilio?
For most practices, it isn't another programmable API but a finished tool whose vendor signs a BAA with the practice: your EHR's patient messaging, a patient texting service, or a business phone system that covers texting in its BAA. If a developer is building on Twilio for you, the alternative is doing it properly: Security or Enterprise Edition, a signed BAA and HIPAA Projects.