Conditional RingCentral offers a Business Associate Agreement (BAA) to paying Covered Entity customers on paid RingEX tiers, Fax, RingCX, Contact Center and the Customer Engagement Bundle. Third-party channel communications and third-party products are excluded. Verified 2026-10-20. See also All vendor HIPAA checks.
HIPAA Compliant Wiki is published by Chanty, Inc. This page reports RingCentral's published terms and does not audit RingCentral.
Short answer
RingCentral states that a BAA covers RingEX, RingCentral Fax, RingCX, Contact Center, Engage Digital and its AI products (AI Receptionist, AIR Pro, AI Agent Assist and others). The BAA does not cover Engage Digital third-party channel communications, or third-party products unless their own terms say otherwise. Communication over the public switched telephone network (PSTN) is not encrypted in transit.
A signed BAA is the precondition for handling PHI. Terms such as BAA, Covered Entity and PHI are defined in the HIPAA glossary: BAA, Covered Entity, PHI.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Paid RingEX plans (all tiers) | Yes | Request through RingCentral sales or your account team; privacy contact: [email protected] | Not published by the vendor |
| RingCentral Fax | Yes | Same | Not published by the vendor |
| RingCX | Yes | Same | Not published by the vendor |
| RingCentral Contact Center | Yes | Same | Not published by the vendor |
| Customer Engagement Bundle | Yes | Same | Not published by the vendor |
| Free / non-paying accounts | No | Not available | Not applicable |
What the BAA covers and what it excludes
Covered:
- RingEX (phone, SMS, video, messaging)
- RingCentral Fax
- RingCX
- Contact Center
- Engage Digital
- AI Conversation Expert
- AI Quality Management
- AIR Pro
- AI Receptionist
- AI Supervisor Assist
- AI Agent Assist
- Customer Engagement Bundle
Excluded:
- Engage Digital third-party channel communications
- Third-party products, unless their own terms apply
- PSTN communication, which is not encrypted in transit
Excluded items need their own BAA with the relevant vendor, or they must not carry PHI. In a clinic, that means a patient message arriving through a social channel connected to Engage Digital sits outside RingCentral's BAA, and so does a call leg that crosses the PSTN.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Yes |
| ISO 27001 | Not published by the vendor |
SOC 2 and HITRUST are listed as RingCentral states them on its Trust Center. This page does not independently confirm scope.
How to use RingCentral with PHI
- Sign the BAA before any PHI is handled, not after a pilot.
- Confirm your plan and each service you use appear on the covered list, for example Fax and the AI Receptionist separately from RingEX.
- Keep PHI out of Engage Digital third-party channels and other third-party products unless you hold a BAA with that provider.
- Account for unencrypted PSTN legs. Calls to and from ordinary phone numbers cross the PSTN, so decide what staff may say on them.
- Configure access and audit logging, and review the logs. Access controls are not detailed in RingCentral's published documents, so confirm them with your account team.
- Train staff and set written policies on what may be sent by SMS, voice and fax.
- If video is handled separately, compare it with Is Zoom HIPAA compliant?.
Compliance depends on the signed BAA, your configuration and your policies, not on the product alone. For the wider topic, see the HIPAA phone systems guide on chanty.health and HIPAA guides.
Alternatives with a BAA
Listed alphabetically, not ranked. Each verdict follows the vendor's published BAA scope.
- Dialpad: conditional; BAA on all paid accounts.
- eFax: conditional; BAA on eFax Business.
- Fax.Plus: conditional; BAA on Enterprise.
- Google Voice: conditional; Workspace licenses on an account with an accepted Workspace BAA. See Is Google Workspace HIPAA compliant?.
- iFax: conditional; BAA on Plus.
Compare these by category: HIPAA-compliant phone systems and HIPAA-compliant fax services.
Sources
- RingCentral and HIPAA (March 2026) — Trust center, checked 2026-10-20. "RingCentral makes available a business associate agreement (BAA) for our paying Covered Entity customers in alignment with HIPAA requirements."
- RingCentral and HIPAA (March 2026) – covered services — Trust center, checked 2026-10-20. "The following services are covered by the RingCentral BAA: RingCentral Fax, RingEX, RingCX, RingCentral Contact Center, RingCentral Engage Digital (third party channel communications excluded), RingCentral AI Conversation Expert, RingCentral AI Quality Management, RingCentral AIR Pro, RingCentral AI Receptionist, RingCentral AI Supervisor Assist, RingCentral AI Agent Assist"
- RingEX and HIPAA (April 2024) — Trust center, checked 2026-10-20. "RingEX and the RingCentral App have earned Certified status for information security by HITRUST. […] Additionally, RingCentral annually undergoes a third-party SOC 2+ audit, which includes an assessment of controls mapped to the HIPAA Security Rule requirements"
- RingEX and HIPAA (April 2024) – safeguards — Trust center, checked 2026-10-20. "RingCentral ensures encryption of protected data in electronic form in transit over all public wired networks (e.g., internet) and wireless networks (excluding communication over public switched telephone networks)."
- RingCentral Trust Center — Trust center, checked 2026-10-20. "RingCentral is built on a secure cloud platform with a robust portfolio of security and compliance certifications."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-20. Updates across vendors are listed in Recent changes in vendor HIPAA status.
Does RingCentral sign a BAA?
Yes, for paying Covered Entity customers on the services listed above (vendor HIPAA document). Request it through RingCentral sales or your account team.
Is a free or non-paying RingCentral account covered by the BAA?
No. The BAA is available to paying customers only (vendor HIPAA document).
Are RingCentral's AI products covered by the BAA?
The listed AI products are covered: AI Conversation Expert, AI Quality Management, AIR Pro, AI Receptionist, AI Supervisor Assist and AI Agent Assist (vendor HIPAA document, March 2026). Third-party products are not.
Are phone calls over the public telephone network encrypted in transit?
No. RingCentral states that PSTN communication is not encrypted in transit (vendor HIPAA document).