Is Twilio HIPAA compliant?
Yes, if you upgrade to Twilio's Security or Enterprise Edition, sign their business associate addendum, and only use the products named on Twilio's HIPAA Eligible Services list.
Applies to Twilio communications APIs. Last reviewed against Twilio's own documentation. Next review December 8, 2026.
Reviewed by Lisa Tran, CISSP — Healthcare Information Security Executive.
What you must do
- Purchase Twilio Security Edition or Enterprise Edition. Twilio will not sign on lower editions.
- Execute the addendum before any patient information moves through the platform.
- Restrict patient information to products named on Twilio's HIPAA Eligible Services document, last updated 30 June 2026.
- For the many features marked with an asterisk on that list — Studio, call recordings and storage, call transcription, Media Streams, Conversation Relay, secure trunking, SIP interface and others — follow Twilio's 'Architecting for HIPAA on Twilio' guidance.
- Understand there is no HIPAA toggle. Twilio states the eligible version of a product is the same as the non-eligible version; the protection comes from how you architect the workflow.
- You may use non-eligible Twilio products elsewhere, but only where patient information cannot reach them.
Does Twilio sign a business associate agreement?
Yes. Twilio offers one. Twilio Security Edition or Enterprise Edition Upgrade the account to Security or Enterprise Edition, then work with your Twilio representative to execute the Business Associate Addendum. Newly eligible products are picked up automatically without re-signing, provided they are used through existing HIPAA-enabled projects or subaccounts.
What this means in practice
Twilio's most important sentence is the one that disappoints people: there is no HIPAA toggle. The eligible version of a Twilio product is the same product as the non-eligible version. Nothing changes when you sign except what you are permitted to do and what obligations you carry. The protection comes from how the workflow is architected, which is why Twilio warns that signing alone does not make your application compliant.
Getting to the starting line means moving up to Security or Enterprise Edition, signing the addendum, and then living inside the eligible services list, currently dated 30 June 2026. That list is versioned and it moves, so it is the document to check rather than a memory of what was true last year.
Two practical consequences catch billing companies and small vendors. SendGrid email and WhatsApp messaging are not named on that list, so the obvious ways to extend patient messaging fall outside it. And several eligible features, including Studio, call recording and storage, transcription and Media Streams, carry an asterisk meaning Twilio's separate architecture guidance applies before you build on them.
How organizations get this wrong
The specific mistakes we see with Twilio, not generic advice.
- Sending patient appointment reminders by email through SendGrid on the same Twilio bill, when SendGrid is not named on the eligible services list.
- Adding a WhatsApp channel for patient messaging because Twilio supports it commercially, without checking it against the eligible list.
- Hunting for an account setting that switches products into a compliant mode, when Twilio states the eligible version is the identical product.
- Turning on call recording or transcription without reading the architecture guidance that the asterisked entries on the list require.
What the agreement does not cover
- Any Twilio product not named on the eligible services list — notably SendGrid email and WhatsApp messaging channels do not appear on the 30 June 2026 list.
- Twilio warns that signing the addendum alone does not make your application compliant; architecture is a shared responsibility.
- Two listed products are being retired and should not be built on: Programmable Chat and Twilio Frontline.
Alternatives
Listed on merit. We take no payment for placement and use no affiliate links.
A ready-made phone system rather than an API you must architect yourself
Signing the agreement is step one. Proving it is step two.
Once you have the agreement with Twilio, someone has to know it exists, where the copy is, when it needs revisiting and who owns it. That register is what a client's security questionnaire is actually asking about, and it is the section of an evidence pack most organizations cannot produce on request.
$79/month, 14-day free trial, no credit card. The checker itself stays free and needs no account.
Sources
Every statement above comes from Twilio’s own published documentation, read on the date shown.
- Twilio and HIPAA — Twilio. No publication date given. Read July 29, 2026.
- HIPAA Eligible Services — Twilio. Published June 30, 2026. Read July 29, 2026.
- HIPAA Accounts — Twilio. No publication date given. Read July 29, 2026.
Change history
- — First published.
This page is information, not certification and not legal advice. It reflects Twilio’s published documentation as read on July 29, 2026; vendors change their terms without notice, so confirm anything you rely on directly with the vendor. Whether your own use is compliant depends on your configuration, your executed agreement and how your staff actually work. No company can be “HIPAA certified” — no such designation exists.
Think something here is wrong or out of date? Tell us at support@hipaacompliancesoftware.org — corrections are published with a dated note in the change history above, never silently. See our editorial standards for how entries are researched and re-verified.