HIPAA Compliance and BAA Requirements for Scale Plan

Getting Started
1

We recently purchased the Scale plan and would like to clarify the additional steps required for HIPAA compliance.

Could you please confirm:

  • Does the Scale plan automatically include a Business Associate Agreement (BAA), or do we need to execute a separate BAA with LiveKit?
  • If a separate BAA is required, could you please share the process for initiating and signing it?
  • Are there any additional configuration or security requirements that we need to complete on our end to enable HIPAA-compliant usage?

We would appreciate any documentation or guidance you can provide regarding the HIPAA/BAA requirements for the Scale plan.

2

@aman.dhiman Not staff, so the BAA itself has to come from LiveKit sales, but two of their legal pages cover part of this.

HIPAA Eligible Products and Services (HIPAA Eligible Products and Services | LiveKit) lists what has been assessed against the Security, Breach Notification and Privacy Rules: realtime transport over WebRTC and SIP, Egress, Ingress, agent hosting, agent observability, and agent conversational models.

The part easiest to miss is LiveKit Inference, which is only HIPAA-compliant with specific model families:

  - STT: assemblyai/*, cartesia/*, deepgram/*, inworld/*, xAI/*
  - LLM: deepseek-ai/*, google/*, qwen/*, livekit/*, moonshotai/*, openai/*, xAI/*
  - TTS: cartesia/*, deepgram/*, inworld/*, rime/*, xAI/*

Worth auditing your stack against that before any PHI flows. The page is dated 03/22/2026, so check the current version.

Terms of Service 5.2 also states that PHI must not be processed “unless and until Customer has executed a business associate agreement.” Whether that’s bundled with Scale or handled separately is a question for sales rather than something I’d read into the terms.

3

I will send you a DM for how to proceed with BAA