No. Grasshopper says it is not HIPAA compliant and offers no business associate agreement (BAA). It points customers who need one to GoTo's healthcare products. Practices that need a virtual phone number, text and fax service for PHI should use a service that signs a BAA.
Verdict: no BAA on any Grasshopper plan
No No BAA is available on any Grasshopper plan. The main exclusion is that text messages, faxes and voicemails passing through Grasshopper are accessible to its support team. Verified 2026-10-20.
Short answer
Grasshopper states that it is not HIPAA compliant because its support team must be able to access account content. Customers who need a BAA are told to contact support or move to a GoTo healthcare product at goto.com/healthcare. Grasshopper is owned by GoTo and operates at grasshopper.com.
See Is it HIPAA compliant? All vendors for other vendor verdicts.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| All Grasshopper plans | Not available | Vendor directs BAA requests to support and to GoTo healthcare products | Not published by the vendor |
No individual plan names are published in the vendor material used for this page, so none are listed here.
What the BAA covers and what it excludes
Covered services: none. Grasshopper does not offer a BAA.
Excluded:
- Text messages passing through Grasshopper, which the support team can access.
- Faxes passing through Grasshopper, which the support team can access.
- Voicemails passing through Grasshopper, which the support team can access.
In a clinic, that rules out patient voicemails left on a front-desk line, appointment-related texts and faxed referrals or lab results.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
An evaluator cannot assess Grasshopper's safeguards from published material, and without a BAA the question is moot for PHI.
How to use Grasshopper with PHI
Without a BAA, the safe course is to keep PHI out of Grasshopper. Compliance depends on the signed BAA, correct configuration and staff policies; no vendor provides it alone. For the contract term, see the HIPAA glossary.
- Do not route PHI through Grasshopper. That includes patient texts, faxes and voicemails.
- Keep PHI out of voicemail greetings and account settings, such as names of patients or conditions in a greeting or label.
- If you think you need a BAA, confirm the position in writing with Grasshopper support rather than relying on a sales conversation.
- Evaluate a BAA-eligible phone service before migrating numbers, and check which plan the BAA covers.
- Update staff policies and train staff on which numbers and channels may carry patient information.
- Document the decision, including that no BAA is available, in your vendor inventory.
Alternatives with a BAA
These services have a verdict of conditional: a BAA is available, but only on the named plans or services in each vendor's own BAA terms. A BAA does not by itself make a practice compliant. The vendor pages list the plan or service where the BAA applies.
| Vendor | Verdict | BAA starting plan |
|---|---|---|
| Dialpad | Conditional | All paid Dialpad accounts (Dialpad Connect Standard, Pro, Enterprise; Dialpad Support; Dialpad Sell) |
| Google Voice | Conditional | Google Voice for Google Workspace (Starter, Standard, Premier licenses) on a Workspace account whose administrator has accepted the Google Workspace BAA |
| Nextiva | Conditional | Nextiva HIPAA-compliant ("HC") service offerings designated on the quote: NextivaONE, Nextiva Contact Center, NEXT, XBert AI, Core / Engage / Power Suite (NextivaCx) |
| RingCentral | Conditional | Paid RingEX plans (all tiers) |
| Vonage Business Communications | Conditional | Vonage Communications APIs – Enterprise accounts (Video, Voice, Messages, Verify APIs) |
To compare more options, see HIPAA-compliant phone systems.
Sources
- Is Grasshopper HIPAA compliant? – Grasshopper Support — Help article, checked 2026-10-20. "At this time, Grasshopper is not HIPAA compliant. In order to assist our customers with any technical issues they are experiencing, our support team must have access to the account settings and information. This includes messages that may pass through the Grasshopper system, like text messages, faxes, and voicemails."
- Is Grasshopper HIPAA compliant? – Grasshopper Support (BAA) — Help article, checked 2026-10-20. "If you require a Business Associate Agreement (BAA), please use the Contact Support option in this article. If you need to upgrade to a HIPAA compliant product, please refer to https://www.goto.com/healthcare"
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-20. Other updates appear on recent vendor status changes.
Does Grasshopper sign a BAA?
No. No BAA is available on any Grasshopper plan. Grasshopper directs BAA requests to its support team and to GoTo healthcare products.
Why does Grasshopper say it is not HIPAA compliant?
Grasshopper's support team must be able to access account content, including text messages, faxes and voicemails. Because of that access, it does not offer a BAA.
What does Grasshopper tell customers who need a BAA?
It tells them to contact support or move to a GoTo healthcare product at goto.com/healthcare. This page does not state what a GoTo BAA covers; confirm that with GoTo directly.
Can a practice use Grasshopper for patient texts, faxes or voicemails?
Not for PHI. With no BAA, patient texts, faxes and voicemails should not pass through Grasshopper. A practice that needs a business line for patient contact should choose a service that signs a BAA and confirm the covered plan in writing.