Overview
LiveKit provides the building blocks for new kinds of healthcare apps, including telehealth, voice-agent-based scheduling, and clinical transcription.
The Health Insurance Portability and Accountability Act (HIPAA) is a United States law that protects patient health information. If your app handles protected health information (PHI) subject to HIPAA, sign a Business Associate Agreement (BAA) with LiveKit before you go live.
Eligible plans
To be considered for a BAA, your project must be on one of the following plans:
| Plan name | Pricing | How to apply |
|---|---|---|
| Scale | See pricing | Upgrade in billing |
| Enterprise | Custom | Contact sales |
| Startup program | Free for eligible startups | Apply online |
The BAA, if approved, covers LiveKit Cloud. However, not every product, feature, or model is eligible. Refer to the following page for the latest information on which features are HIPAA-eligible:
Request a BAA
LiveKit signs a BAA upon request and review. Being on an eligible plan doesn't guarantee approval.
For approved requests, LiveKit uses an e-signature process over email. Coverage starts when LiveKit confirms in writing that the BAA is in effect. Your BAA can cover one or more project/workspace, although each must be on an eligible plan. Send PHI only through the projects listed in your BAA.
To request a BAA, email LiveKit support from the dashboard:
- Sign in to LiveKit Cloud and open your project.
- In the sidebar, select Support → Email support.
- In your email, include the following:
- Your company's legal name, address, and state or country of incorporation.
- The name, title, and email address of your authorized signer for the BAA.
- The project ID (
p_...) or workspace ID (wo_...) of each project/workspace that will handle PHI. - A short description of your use case and how PHI gets to LiveKit.
Additional projects or workspaces
To request coverage for additional projects or workspaces, follow the same process as above but ask for an "amendment". Upon approval and signature, your BAA will list the additional projects/workspaces and you may begin sending PHI through them.
Projects/workspaces not listed on your current BAA are not HIPAA-eligible. Each project you wish to add must be enrolled in an eligible plan.
Your responsibilities
The BAA covers LiveKit Cloud only. You're responsible for PHI in other parts of your application, including the following:
- Self-hosted LiveKit: The open source LiveKit server isn't covered by a LiveKit Cloud BAA.
- Third-party providers: Providers your agent calls directly through a plugin aren't covered. You need your own BAA with each one.
- Your own storage and services: Storage buckets, databases, analytics, and any other service you send PHI to aren't covered.
- Connections you configure: Use encrypted protocols, such as TLS or SRTP, for connections you set up, such as SIP trunks, webhooks, and storage destinations.
A BAA covers only HIPAA in the United States. It doesn't cover health privacy laws in other countries, and it doesn't determine whether your app meets HIPAA requirements. Confirm your obligations with your own legal and compliance team.
Additional resources
The following page covers the security practices behind LiveKit Cloud.