Conditional Nextiva makes a BAA available only on HC service offerings designated on the quote, and its HIPAA Use Guidelines bar PHI from SMS/MMS and email (last verified 2026-10-20, source: Nextiva HIPAA Use Guidelines). Standard offerings get no BAA, and several convenience features are disabled on HC accounts.
Short answer
A BAA is available on Nextiva's HC offerings (NextivaONE, Nextiva Contact Center, NEXT, XBert AI, and Core/Engage/Power Suite under NextivaCx), obtained through Nextiva sales. Standard non-HC offerings are excluded. HC accounts disable visual voicemail, voicemail-to-email and sending faxes from email.
On the fax question: the guidelines list vFax as covered when faxes are received through a secure link or portal. Sending faxes from email is disabled.
For other tools, see all vendor HIPAA checks.
Which plans include a BAA
New to the terms? The HIPAA glossary (BAA, PHI) defines both.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Nextiva HC service offerings designated on the quote (NextivaONE, Nextiva Contact Center, NEXT, XBert AI, Core/Engage/Power Suite (NextivaCx)) | Available | Through sales: get an HC offering on the quote and enter into a BAA | Not published by the vendor |
| Standard (non-HC) service offerings | No | Not applicable | Not applicable |
Minimum seats and pricing: Not published by the vendor.
A clinic that already runs a standard Nextiva account cannot simply sign a BAA against it. The service has to be an HC offering on the quote.
What the BAA covers and what it excludes
Covered under HC offerings, per the guidelines:
- Voice calls
- Call recording
- Nextiva Analytics
- Virtual fax (vFax), receiving via secure link or portal
- Video conferencing
- Nextiva Contact Center
- NEXT customer experience platform
- XBert AI
Excluded or disabled for PHI:
- PHI sent via SMS/MMS
- PHI sent via email
- Visual voicemail
- Voicemail to email or text
- Listening to voicemails in the Nextiva app
- Sending faxes from email
- PHI in contacts, calendar fields, surveys, SmartTopics and social media messaging
In practice, a front desk that forwards voicemails to a shared inbox or texts appointment details with diagnoses needs a different workflow on an HC account. The verbatim SMS/MMS restriction is quoted in the Sources section.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
The HIPAA Use Guidelines and the blog page list none of these. That is not a finding that the controls do not exist. Request documentation from Nextiva before approving the service.
How to use Nextiva with PHI
- Confirm the HC offering is on the quote, not a standard offering.
- Sign the BAA before any PHI enters the account.
- Do not send PHI by SMS/MMS or email.
- Keep PHI out of contacts, calendar fields, surveys, SmartTopics and social media messaging.
- Receive faxes through the vFax secure link or portal, and do not send faxes from email.
- Train staff on the disabled features, such as voicemail-to-email and visual voicemail, so they do not look for workarounds.
Compliance depends on the signed BAA, configuration and the organization's own policies. More checklists are in the HIPAA guides.
Alternatives with a BAA
Verdicts are conditional for each, and each depends on the plan and a signed agreement.
- Dialpad: conditional. BAA on all paid accounts (Connect Standard, Pro, Enterprise; Support; Sell).
- Google Voice: conditional. Google Voice for Workspace (Starter, Standard, Premier) on an account whose admin accepted the Workspace BAA.
- RingCentral: conditional. Paid RingEX plans, all tiers.
- Vonage Business Communications: conditional. Vonage Communications APIs on Enterprise accounts.
For video meetings, see Is Zoom HIPAA compliant?. Browse phone systems and other types in HIPAA-compliant software by category.
Sources
- Nextiva HIPAA Use Guidelines — Terms, checked 2026-10-20. "In order to use NextivaONE in a HIPAA-compliant environment, you must obtain a Nextiva HIPAA-compliant service offering. These service offerings are designated as HIPAA-compliant or “HC” on your quote. You must also enter into a Business Associate Agreement or BAA with Nextiva."
- Nextiva HIPAA Use Guidelines – use restrictions — Terms, checked 2026-10-20. "SMS and MMS messages are not encrypted and not recallable. As such, you acknowledge and agree that you will not send any Protected Health Information (PHI) via the NextivaONE SMS or MMS function."
- Is Nextiva HIPAA Compliant? [Updated for Healthcare Providers] — Vendor page, checked 2026-10-20. "Nextiva requires that customers using its HIPAA products sign a comprehensive Business Associate Agreement (BAA)"
- Is Nextiva HIPAA Compliant? – disabled features — Vendor page, checked 2026-10-20. "Visual voicemail: Disabled. Nextiva App: Disabled listening to voicemails. Voicemail to email or text: Disabled. vFAX: Disabled sending faxes from an email."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Is Nextiva fax HIPAA compliant?
The guidelines list virtual fax (vFax) as covered on HC offerings when faxes are received through a secure link or portal. Sending faxes from email is disabled on HC accounts. Standard offerings have no BAA.
Does Nextiva sign a BAA, and how do I get one?
Yes, on HC service offerings designated on the quote. Get an HC offering on the quote through Nextiva sales and enter into a BAA. Extra cost: Not published by the vendor.
Can I send PHI by text message or email with Nextiva?
No. The HIPAA Use Guidelines prohibit PHI via SMS/MMS and via email.
Which Nextiva features are disabled on HIPAA-compliant accounts?
Visual voicemail, voicemail to email or text, listening to voicemails in the Nextiva app, and sending faxes from email. PHI is also excluded from contacts, calendar fields, surveys, SmartTopics and social media messaging.