Is Twilio HIPAA compliant?
Yes, if you upgrade to Twilio's Security or Enterprise Edition, sign their business associate addendum, and only use the products named on Twilio's HIPAA Eligible Services list.
Applies to Twilio communications APIs. Last reviewed .
Researched and maintained by the CompyMax editorial team to our published standards.
What you must do
- Purchase Twilio Security Edition or Enterprise Edition. Twilio will not sign on lower editions.
- Execute the addendum before any patient information moves through the platform.
- Restrict patient information to products named on Twilio's HIPAA Eligible Services document, last updated 30 June 2026.
- For the many features marked with an asterisk on that list (Studio, call recordings and storage, call transcription, Media Streams, Conversation Relay, secure trunking, SIP interface and others) follow Twilio's 'Architecting for HIPAA on Twilio' guidance.
- Understand there is no HIPAA toggle. Twilio states the eligible version of a product is the same as the non-eligible version; the protection comes from how you architect the workflow.
- You may use non-eligible Twilio products elsewhere, but only where patient information cannot reach them.
Does Twilio sign a business associate agreement?
Yes. Twilio offers one. Twilio Security Edition or Enterprise Edition Upgrade the account to Security or Enterprise Edition, then work with your Twilio representative to execute the Business Associate Addendum. Newly eligible products are picked up automatically without re-signing, provided they are used through existing HIPAA-enabled projects or subaccounts.
What this means in practice
Twilio's most important sentence is the one that disappoints people: there is no HIPAA toggle. The eligible version of a Twilio product is the same product as the non-eligible version. Nothing changes when you sign except what you are permitted to do and what obligations you carry. The protection comes from how the workflow is architected, which is why Twilio warns that signing alone does not make your application compliant.
Getting to the starting line means moving up to Security or Enterprise Edition, signing the addendum, and then living inside the eligible services list, currently dated 30 June 2026. That list is versioned and it moves, so it is the document to check rather than a memory of what was true last year.
Two practical consequences catch billing companies and small vendors. SendGrid email and WhatsApp messaging are not named on that list, so the obvious ways to extend patient messaging fall outside it. And several eligible features, including Studio, call recording and storage, transcription and Media Streams, carry an asterisk meaning Twilio's separate architecture guidance applies before you build on them.
How organizations get this wrong
- Sending patient appointment reminders by email through SendGrid on the same Twilio bill, when SendGrid is not named on the eligible services list.
- Adding a WhatsApp channel for patient messaging because Twilio supports it commercially, without checking it against the eligible list.
- Hunting for an account setting that switches products into a compliant mode, when Twilio states the eligible version is the identical product.
- Turning on call recording or transcription without reading the architecture guidance that the asterisked entries on the list require.
What the agreement does not cover
- Any Twilio product not named on the eligible services list: notably SendGrid email and WhatsApp messaging channels do not appear on the 30 June 2026 list.
- Twilio warns that signing the addendum alone does not make your application compliant; architecture is a shared responsibility.
- Two listed products are being retired and should not be built on: Programmable Chat and Twilio Frontline.
Alternatives
A ready-made phone system rather than an API you must architect yourself
Keep a record of your Twilio agreement
Sources
- Twilio and HIPAA: Twilio. Read July 29, 2026.
- HIPAA Eligible Services: Twilio. Published June 30, 2026. Read July 29, 2026.
- HIPAA Accounts: Twilio. Read July 29, 2026.
Twilio can change these terms at any time. If something here no longer matches what Twilio tells you, tell us.