# HIPAA Compliance and BAA Requirements for Scale Plan

**URL:** <https://community.livekit.io/t/hipaa-compliance-and-baa-requirements-for-scale-plan/2053>\
**Category:** Getting Started\
**Created:** [September 14, 2026, 8:19am UTC](https://community.livekit.io/t/hipaa-compliance-and-baa-requirements-for-scale-plan/2053 "2026-09-14T08:19:54Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![aman.dhiman](https://avatars.discourse-cdn.com/v4/letter/a/6f9a4e/32.png) [@aman.dhiman](https://community.livekit.io/u/aman.dhiman)\
**Post date:** [September 14, 2026, 8:19am UTC](https://community.livekit.io/t/hipaa-compliance-and-baa-requirements-for-scale-plan/2053/1 "2026-09-14T08:19:54Z")

</div>

We recently purchased the Scale plan and would like to clarify the additional steps required for HIPAA compliance.

Could you please confirm:

- Does the Scale plan automatically include a Business Associate Agreement (BAA), or do we need to execute a separate BAA with LiveKit?
- If a separate BAA is required, could you please share the process for initiating and signing it?
- Are there any additional configuration or security requirements that we need to complete on our end to enable HIPAA-compliant usage?

We would appreciate any documentation or guidance you can provide regarding the HIPAA/BAA requirements for the Scale plan.

---

<div class="post-metadata">

**Author:** ![abidullahcs.uk](https://avatars.discourse-cdn.com/v4/letter/a/ba8739/32.png) [@abidullahcs.uk](https://community.livekit.io/u/abidullahcs.uk)\
**Post date:** [September 14, 2026, 3:12pm UTC](https://community.livekit.io/t/hipaa-compliance-and-baa-requirements-for-scale-plan/2053/2 "2026-09-14T15:12:16Z")

</div>

@aman.dhiman Not staff, so the BAA itself has to come from LiveKit sales, but two of their legal pages cover part of this.

HIPAA Eligible Products and Services ([HIPAA Eligible Products and Services | LiveKit](https://livekit.com/legal/hipaa)) lists what has been assessed against the Security, Breach Notification and Privacy Rules: realtime transport over WebRTC and SIP, Egress, Ingress, agent hosting, agent observability, and agent conversational models.

The part easiest to miss is LiveKit Inference, which is only HIPAA-compliant with specific model families:

```auto
  - STT: assemblyai/*, cartesia/*, deepgram/*, inworld/*, xAI/*
  - LLM: deepseek-ai/*, google/*, qwen/*, livekit/*, moonshotai/*, openai/*, xAI/*
  - TTS: cartesia/*, deepgram/*, inworld/*, rime/*, xAI/*

```

Worth auditing your stack against that before any PHI flows. The page is dated 03/22/2026, so check the current version.

Terms of Service 5.2 also states that PHI must not be processed “unless and until Customer has executed a business associate agreement.” Whether that’s bundled with Scale or handled separately is a question for sales rather than something I’d read into the terms.

---

<div class="post-metadata">

**Author:** ![CWilson](https://sea1.discourse-cdn.com/flex001/user_avatar/community.livekit.io/cwilson/32/135_2.png) [@CWilson](https://community.livekit.io/u/CWilson)\
**Post date:** [September 14, 2026, 5:03pm UTC](https://community.livekit.io/t/hipaa-compliance-and-baa-requirements-for-scale-plan/2053/3 "2026-09-14T17:03:25Z")

</div>

I will send you a DM for how to proceed with BAA

---

<div class="post-metadata">

**Author:** ![system](https://sea1.discourse-cdn.com/flex001/user_avatar/community.livekit.io/system/32/26_2.png) [@system](https://community.livekit.io/u/system)\
**Post date:** [September 29, 2026, 5:04pm UTC](https://community.livekit.io/t/hipaa-compliance-and-baa-requirements-for-scale-plan/2053/4 "2026-09-29T17:04:13Z")

</div>

This topic was automatically closed 15 days after the last reply. New replies are no longer allowed.