Is Vapi HIPAA Compliant? Vapi vs Retell vs Bland vs Synthflow for Clinics
Vapi, Retell AI, Bland AI, and Synthflow are the platforms developers use to build AI phone agents. All four can be used for healthcare calls, but HIPAA works differently on each, and on most of them it costs extra. Here is what we found as of October 2026. Pricing and terms change often, so confirm with each vendor in writing.
Disclosure: PhiClaw's phone calls run on Retell AI, under a BAA. We picked it for exactly the reasons below, but we have tried to be fair to everyone.
Quick comparison
- Vapi: HIPAA mode requires an Enterprise plan or a separately purchased HIPAA add-on (community support threads cite about $1,000 a month), and a signed BAA before you turn it on. In HIPAA mode, call logs, recordings, and transcripts are not stored by default. Vapi's own docs and support replies note that third-party pieces such as your phone carrier (Twilio, Telnyx) or model provider may need their own BAAs.
- Retell AI: offers a BAA, and Retell's own comparison pages describe a self-serve BAA option. Usage starts around $0.07 a minute before model and phone costs; HIPAA may add a per-minute premium or require Enterprise depending on plan.
- Bland AI: public plans run from about $0.11 to $0.14 a minute. Third-party reviews disagree on whether the BAA is available below Enterprise; most list HIPAA as an Enterprise feature.
- Synthflow: a no-code builder. Third-party reviews say HIPAA support arrived in early 2026 at roughly a 30% premium on the per-minute rate.
What HIPAA actually requires
Under HIPAA, a medical practice can only hand protected health information (PHI) to a vendor that has signed a Business Associate Agreement (BAA). A BAA is the contract where the vendor promises to protect PHI, report breaches, and accept HIPAA obligations. Two details trip practices up: the BAA has to cover the exact product and plan you use, and it does not make you compliant by itself. You still need the right settings, access controls, and staff habits.
The hidden part: you are building a product
These are toolkits. Signing up gives you a voice and a phone number, not a receptionist. To answer patient calls safely you still have to:
- Write and test the call scripts, including what to say when a caller describes an emergency.
- Connect it to your EHR for real availability, booking, and rescheduling.
- Make sure every layer (voice platform, phone carrier, AI model, storage) is under a BAA.
- Decide where recordings and transcripts live, and who can see them.
- Keep it working when your schedule, providers, or insurance list change.
That is weeks of engineering plus ongoing upkeep. It makes sense for a health-tech company. It rarely makes sense for a clinic.
PhiClaw signs a Business Associate Agreement (BAA) with your practice and runs on HIPAA-eligible infrastructure, with BAAs in place with our subprocessors AWS (including Amazon Bedrock) and Convex. HIPAA-compliant calls run through our voice partner Retell AI, also under BAA.
The no-build option
PhiClaw's HIPAA AI receptionist is the finished version: built on Retell AI under BAA, already connected to your EHR, and signed under PhiClaw's own BAA with your practice. It is $50 a month for your own local number, $0.19 a minute for calls, and 1¢ per text, as an add-on to the PhiClaw AI employee ($1,500 a month flat (4,320 questions/tasks included, unlimited users and locations, month-to-month), with a BAA on every plan). The same AI that answers the phone also texts patients back, runs intake, scribes the visit, e-prescribes, and bills.
When to build on Vapi, Retell, Bland, or Synthflow
Build your own if you are a software company selling to healthcare, need a fully custom call flow, and have engineers to own it. Buy a finished receptionist if you are a practice that just wants the phone answered and booked.
Key takeaway: All four voice-AI platforms can be used for HIPAA calls with a BAA, but HIPAA usually costs extra and you still have to build and maintain the receptionist. PhiClaw gives a practice a finished HIPAA AI receptionist on Retell for $50/month plus $0.19/minute.
Frequently asked questions
Is Vapi HIPAA compliant?
Vapi can be used for HIPAA workloads if you are on Enterprise or buy its HIPAA add-on (support threads cite about $1,000 a month) and sign its BAA. Carriers like Twilio or Telnyx and some model providers may need separate BAAs.
Is Retell AI HIPAA compliant?
Retell offers a BAA for HIPAA use. PhiClaw runs its calls on Retell under a BAA. Confirm the plan and any per-minute HIPAA premium with Retell directly.
Is Bland AI HIPAA compliant?
Bland lists HIPAA support, but most public reviews place the signed BAA on its Enterprise plan. Ask Bland which plan includes a BAA before using it with patients.
Is Synthflow HIPAA compliant?
Third-party reviews report that Synthflow added HIPAA support in early 2026 at roughly a 30% per-minute premium. Confirm current terms and the BAA with Synthflow.
Should a medical practice build its own voice AI?
Usually not. A finished HIPAA AI receptionist that already books into your EHR is faster and cheaper than building, securing, and maintaining one on a developer platform.
Want the phone answered without building a voice-AI app?
PhiClaw signs a Business Associate Agreement (BAA) with your practice and runs on HIPAA-eligible infrastructure, with BAAs in place with our subprocessors AWS (including Amazon Bedrock) and Convex. HIPAA-compliant inbound and outbound calls are handled by our voice partner Retell AI, which is also under BAA.
Book a 20-min demo