Conditional Twilio makes a BAA available on Security Edition and Enterprise Edition, and the main exclusion is any product not on its HIPAA Eligible Services list. Verified 2026-10-28.
Short answer
A BAA is available on Security Edition or Enterprise Edition for services on Twilio's HIPAA Eligible Services list: Voice, SMS, Video, Verify, Studio, Functions, Flex and Segment. Eligibility is a matter of edition and service, not a property of Twilio as a whole. See the glossary entries for BAA and PHI if you need the definitions, and the All vendor HIPAA checks index for comparable vendors.
Both of the variants people search for are covered. Programmable SMS/MMS and Programmable Video are on the Eligible Services list, so SMS and Video are covered once the BAA is signed on a qualifying edition.
Twilio's own text prohibits using Eligible Services with PHI before a BAA is in place (quote in Sources). A clinic that starts sending appointment reminders that include patient names and visit types before the addendum is signed is outside the vendor's terms.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Security Edition | Yes | Through a Twilio Account Representative or Contact Sales, as an addendum to the Terms of Service | Not published by the vendor |
| Enterprise Edition | Yes | Through a Twilio Account Representative or Contact Sales, as an addendum to the Terms of Service | Not published by the vendor |
| Pay-as-you-go / Developer accounts without an Edition | No | Not available | Not published by the vendor |
Edition pricing is not published by the vendor. An account without Security or Enterprise Edition cannot get a BAA, whatever products it uses.
What the BAA covers and what it excludes
Covered (HIPAA Eligible Services):
- Runtime Tools
- Programmable Video
- Programmable Voice and SIP
- Programmable SMS/MMS
- Conversations (classic)
- Verify and Lookup
- Event Streams
- Flex
- Segment (per the list's change log)
Excluded:
- Any product not on the Eligible Services list. These can be used only where no PHI can be exchanged.
- SendGrid email.
- Frontline, which reaches end of life on 9/30/2026.
- Programmable Chat, which is end of life.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published by the vendor" means the pages reviewed state nothing on the point. It does not mean the control is absent. Ask Twilio for these details in writing during vendor review.
How to use Twilio with PHI
- Get the BAA signed before any PHI enters the account, including test data drawn from real patients.
- Confirm the account is on Security Edition or Enterprise Edition.
- Build PHI workflows only on Eligible Services, such as SMS reminders, Voice callbacks or Video visits.
- Keep PHI out of non-listed products such as SendGrid. An emailed appointment summary does not belong there.
- Migrate off Frontline and Programmable Chat, which are end of life.
- Configure SSO and review audit logs on a regular schedule.
- Set message content and recording policies, and train staff on what may be sent by text or voice.
Compliance depends on the signed BAA, your configuration and your policies, not on Twilio alone. The HIPAA guides cover risk analysis and vendor onboarding steps.
Alternatives with a BAA
For a wider view, see HIPAA-compliant software development tools.
- Amazon Web Services: conditional, BAA applies to all AWS accounts
- Microsoft Azure: conditional
- Firebase: conditional, covered through the Google Cloud BAA
- Google Cloud Platform: yes
- Heroku: conditional, Heroku Shield Private Spaces on Enterprise
Sources
- Twilio and HIPAA — BAA page, checked 2026-10-28. "Customers wishing to sign a BAA with Twilio must have our Security Edition or Enterprise Edition."
- Twilio and HIPAA — BAA page, checked 2026-10-28. "Customers may use all other products and services that are not on this list, but there must be no potential for PHI being exchanged in violation of HIPAA as part of these workflows."
- HIPAA Accounts — Help article, checked 2026-10-28. "HIPAA Accounts are available with Security and Enterprise Editions."
- HIPAA Eligible Services (Last Updated: June 30, 2026) — Vendor page, checked 2026-10-28. "If you are a Covered Entity or Business Associate as defined by the Health Insurance Portability and Accountability Act of 1996 (as amended, HIPAA), you agree to not to use the HIPAA Eligible Services for any purpose or in any manner involving Protected Health Information without first entering into a Twilio Business Associate Agreement."
- Editions | Twilio — Pricing page, checked 2026-10-28. "Use any SAML 2.0 Identity Provider to control user authentication and usage of Twilio."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-28. See Recent changes in vendor HIPAA status.
Is Twilio SMS HIPAA compliant?
A BAA is available for Programmable SMS/MMS on Security Edition or Enterprise Edition. The BAA must be signed before any PHI is sent. Without it, or on an account with no Edition, SMS should not carry PHI.
Does Twilio sign a BAA on a pay-as-you-go account?
No. A Security Edition or Enterprise Edition is required, and the BAA is arranged through a Twilio Account Representative or Contact Sales.
Is Twilio Video covered by the BAA?
Programmable Video is on the HIPAA Eligible Services list, including recordings and compositions. The same edition and signed-BAA conditions apply. For a comparison with a meeting product, see Is Zoom HIPAA compliant?
Can I send PHI through SendGrid or other products not on the list?
No. SendGrid is not on the Eligible Services list. Products that are not listed can be used only where no PHI can be exchanged.