Conditional A BAA is available for Vonage Communications APIs on Enterprise accounts. The main exclusion is non-U.S. traffic, and Vonage publishes no BAA statement for its Vonage Business Communications (VBC) phone plans. Verified 2026-10-20. Owner: Ericsson. Category: HIPAA-compliant phone systems. All vendors are listed in Is it HIPAA compliant? All vendors.
Short answer
Vonage offers a BAA on request through your account manager for the Video, Voice, Messages and Verify APIs, for U.S. traffic only. In wording this directory uses: BAA available on Enterprise accounts for Vonage Communications APIs, not for traffic outside the U.S. Vonage publishes no BAA statement for VBC, so confirm coverage with Vonage sales in writing before a clinic puts PHI on a VBC line. For definitions, see the HIPAA glossary: BAA and PHI.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Vonage Communications APIs (Enterprise accounts) | Available | Sign through your account manager or Vonage sales | Not published by the vendor |
| Non-U.S. traffic | Not covered | Not applicable | Not applicable |
| VBC Mobile, Premium, Advanced | No public BAA statement found | Confirm with Vonage sales | Not published by the vendor |
Minimum seats: Not published by the vendor. Vonage states no BAA for non-Enterprise API accounts, so do not assume one.
What the BAA covers and what it excludes
Covered (U.S. traffic):
- Video API
- Voice API
- Messages API (SMS/MMS, U.S. traffic, dedicated numbers)
- Verify API
Excluded or not confirmed:
- Traffic outside the U.S.
- Voice AI agents. Whether they can handle PHI depends on the API configuration and the connected AI engine, and they are not covered by the BAA.
- VBC phone plans. Coverage is not publicly stated.
After the BAA is signed, HIPAA features are activated per API and the covered numbers are designated. A number that is not designated is not covered, so a clinic that adds a new appointment-reminder number later needs to repeat the designation step.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | U.S.-based region selectable for storing and processing PHI |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
Data residency: a U.S.-based region can be selected for storing and processing PHI.
How to use Vonage with PHI
Vonage's controls cover its side of the service. The rest is the customer's responsibility. A checklist for a clinic or a digital-health team:
- Sign the BAA before any PHI touches the service.
- Configure U.S. data residency.
- Activate HIPAA features for each API you use and designate the covered numbers.
- Keep PHI traffic inside the U.S. A patient video visit or text thread with a non-U.S. participant falls outside the BAA.
- Vet the AI engine behind any voice agent separately, because the agent is not covered by the BAA.
- Confirm in writing whether VBC is covered before using a VBC phone line for PHI.
- Maintain access controls, staff policies and training.
Compliance depends on the signed BAA, your configuration and your organization's policies. More background is in the HIPAA guides. This directory reports Vonage's published terms. It does not audit Vonage and is not legal advice.
Alternatives with a BAA
Phone and communications vendors with a BAA path, listed alphabetically with no ranking:
- Dialpad: conditional.
- Google Voice: conditional.
- Nextiva: conditional.
- RingCentral: conditional.
For video meetings, see Is Zoom HIPAA compliant?. The full comparison is in HIPAA-compliant phone systems.
Sources
- HIPAA Compliance – Vonage Communications APIs — Trust center, checked 2026-10-20. "Build HIPAA-supportable healthcare applications using Vonage programmable Video, Voice, Messages, and Verify APIs — backed by a signed Business Associate Agreement (BAA). […] HIPAA support and BAA coverage apply to U.S. traffic only."
- HIPAA Compliance – Vonage Communications APIs (steps and safeguards) — Trust center, checked 2026-10-20. "Step 1 — Sign a BAA Contact your account manager to review and sign the Business Associate Agreement. Step 2 — Configure Data Residency Select a U.S.-based region to store and process PHI. […] Encryption: Voice, video, and messaging data is protected by TLS and HTTPS. PHI stored in Vonage data centers is encrypted with strong algorithms."
- Does Vonage Video API provide HIPAA Business Associate Agreements? – Vonage API Support — Help article, checked 2026-10-20. "HIPAA BAAs are available for Enterprise accounts. Contact your account manager or sales representative for more information."
- Healthcare Communications Solutions | Vonage — Vendor page, checked 2026-10-20. "Healthcare providers can securely use Vonage APIs and AI Studio to deliver HIPAA-compliant applications."
Changes
No changes recorded since first verification on 2026-10-20. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-20. See Recent changes in vendor HIPAA status.
Does Vonage sign a BAA?
Yes, for Vonage Communications APIs on Enterprise accounts. It is available through your account manager and covers the Video, Voice, Messages and Verify APIs for U.S. traffic. Pricing and minimums are not published by the vendor.
Does the Vonage BAA cover traffic outside the U.S.?
No. Vonage states that the BAA applies to U.S. traffic only.
Is the Vonage Business Communications phone system covered by a BAA?
Vonage publishes no BAA statement for VBC Mobile, Premium or Advanced. Confirm coverage with Vonage sales in writing before using it for PHI.
Can Vonage voice AI agents be used with PHI?
They are outside the BAA. Whether a voice agent can handle PHI depends on the API configuration and the connected AI engine, which you must vet separately.