BAA / HIPAA

Avaga lists HIPAA on the footer trust band next to SOC 2 Type II, GDPR, and SSO / SAML. That is a review posture, not a certificate you download at Lite checkout. This page explains how we talk about protected health information (PHI) on the floor. It is not a BAA. It is not a determination that you are a covered entity or that Avaga is your business associate.

If a control is load-bearing, confirm it with us before you buy. Screenshots are a guide, not a contract.

If you are a covered entity or a business associate under HIPAA and Avaga will create, receive, maintain, or transmit PHI (voice, SMS, WhatsApp, recordings, transcripts, CRM notes, form leads), you likely need a Business Associate Agreement and a security review.

That package is Enterprise, quoted by sales. Do not self-serve Lite, Growth, or Business and assume a BAA is attached.

Keep PHI off the line until the review is done. Hours, directions, and empty booking slots only. AI employees after hours follow the same rule as humans: if the human may not collect a member ID, the receptionist seat may not either.

• Confirm whether you need a BAA. If yes, stop self-serve and open a compliance conversation.
• Decide who can play recordings. Who can play archives is a role, not a courtesy.
• Train pause and resume for cards, member IDs, and identity documents.
• Write the disclosure the caller hears. Match the states and channels you actually use.
• Know where transcripts, summaries, and CRM logs land. AI notes are still records.
• Give overflow AI employees the same recording rules as humans.

Pause and resume stay on the live line. A written disclosure stays in the IVR and the AI greeting. A short list of who can play recordings stays in roles. Mandatory tagging is available when you need a reason code before wrap.

Assist Pro must not whisper a diagnosis, a benefits determination, or a guessed member ID. Humans take those turns. See the LLM Policy.

Voice, voicemail, SMS, MMS, WhatsApp Business, Messenger, Instagram DMs, website forms, and ads lead forms can all carry PHI if you let them. Connecting a channel is a product action. It does not replace a BAA.

Meta, Google, LinkedIn, and WhatsApp have their own terms. A BAA with Avaga does not bind those platforms. Confirm each channel with your counsel.

Every plan includes role-based permissions, Google Sign-in, 2FA, and call recording with pause and resume. Turn 2FA on for owners and admins before you provision numbers.

SSO / SAML is contact sales, not a Lite or Growth toggle. Custom SLA, dedicated onboarding, and a success manager are Enterprise. Request the security review from Compliance & BAA or Talk to sales.

This page does not list every technical safeguard, every data center region, or every subprocessor. Those belong in the review packet sales sends after you say you handle PHI.

HIPAA on a badge is not a license to put charts on a Growth inbox. If you are unsure, treat the data as PHI and wait.

Use the form on Compliance & BAA. Say you need a BAA, a security review, or both. Work email only. Tell us the entity name, whether you are a covered entity or a business associate, and which channels will carry PHI.

Sales and compliance: hello@avaga.io, +1 415 723 8585.