---
title: Architecting HIPAA on the Telnyx Platform
canonical: https://telnyx.com/resources/architecting-hipaa-telnyx
---
# Architecting HIPAA on the Telnyx Platform

[Back to blog](https://telnyx.com/resources)

**Telnyx**

# Architecting HIPAA on Telnyx

Architecting HIPAA on Telnyx

By Telnyx Team

## Introduction to Architecting HIPAA on Telnyx

This document is intended for Telnyx customers who have, or plan to enter into, a Business Associate Addendum (BAA) with Telnyx to use HIPAA-eligible services. It outlines specific guidelines on how to build HIPAA-compliant applications and workflows using Telnyx’s platform, which may be updated from time to time.

Security and compliance are a shared responsibility: Telnyx provides the necessary platform capabilities, while customers must ensure proper use of those tools and services. Only services explicitly designated as HIPAA-eligible should be used to process Protected Health Information (PHI). These guidelines do not constitute legal advice, and it is Customer's sole responsibility to confirm its applications and workflows conform with applicable law.

## Customer Requirements Across All Telnyx Services

**Required for HIPAA:**

* Encrypted communication: All interactions with Telnyx APIs must use HTTPS.
* Signed/validated webhooks: Verify that incoming webhooks genuinely originate from Telnyx.
* No PHI in support tickets: Support requests may not include PHI; use Telnyx-specific IDs (e.g., call/message IDs) instead.
* Artificial Intelligence Features: Any AI-powered features or services currently available through Telnyx must only be used in workflows that process PHI via Telnyx-hosted models (e.g. llama and qwen) and store any such retained data on Telnyx-hosted infrastructure.

**Recommended for HIPAA:**

* HTTP authentication: Secure your endpoints through basic or digest auth.
* Static proxy or fixed IPs: If Telnyx supports, use fixed source addresses to simplify firewall rules.
* Public key validation: Use mutual TLS or key-based validation to ensure secure service-to-service communication.

## Product-Specific Guidelines

### A. Programmatic Voice/Call Recording

**Required:**

* Enforce HTTP Basic authentication on recording URLs

**Special Considerations:**

* Enable encryption for call recording storage (e.g., client-side public-key wrapped recordings) or store on your own infrastructure.
* For media streaming or transcription, ensure destination services are Telnyx-hosted.

**Not Eligible:**

* Avoid third-party integrations not covered by a BAA.
* Do not use automatic transcription or analysis features unless explicitly HIPAA-enabled.

### B. Messaging (SMS/MMS)

**Required:**

* Use HTTP Basic auth for media URLs in MMS.
* Only U.S.-based messaging traffic is HIPAA eligible.

**Special Considerations:**

* Enable message body/number redaction features, if available.
* Filter metadata (e.g., tags) to avoid PHI leakage.

**Not Eligible:**

* Avoid marketplace add-ons or bot integrations without BAA coverage.

### C. Chat / Multi-Channel Conversations

**Required:**

* Use only private channels for any PHI exchange.

**Special Considerations:**

* Evaluate and control third-party integrations—ensure BAAs in place.

**Not Eligible:**

* Do not use public chat channels or unsupported calling/chat features.

### D. Unified Conversations / Omni-Channel

**Required & Special Considerations:**

* Comply with HIPAA requirements for each channel used (e.g., SMS, voice, chat).

**Not Eligible:**

* Avoid channels not HIPAA-eligible in their standalone sections (e.g., social messaging platforms without BAA).

### E. Contact Center or Agent Tools

For contact-center tooling:

**Required:**

* Secure media playback endpoints (HTTP auth, encryption).
* Ensure agent screens do not expose PHI without proper training/access control.
* Implement session timeouts (auto-logout or VPN inactivity enforcement).

**Special Considerations:**

* Restrict plugins/customizations to be HIPAA-compliant (avoid PHI in error messages or logs).
* Any third-party app integrations require a valid BAA.

**Not Eligible:**

* Do not enable social integrations or other channels not addressed in this guide. For email, see Section F.

### F. Email (Email API / Inbound Inboxes)

**Required:**

* Use HTTPS webhook endpoints. Inbound email webhooks include message content, so your endpoint receives PHI.
* Configure retention and use the deletion API consistent with your policies. The deletion API applies to sent email; received messages and attachments are deleted automatically under the inbound retention period stated in the Email API documentation.

**Special Considerations:**

* Delivery to recipients' mail servers uses opportunistic TLS, so Telnyx cannot guarantee the final hop is encrypted. Decide what PHI, if any, to include in email content consistent with your HIPAA obligations (for example, the minimum necessary, links to a secure portal, or patient preference for unencrypted email).

### G. Privacy Controls & Protocols

**Required:**

* Implement tracking plans or validation to prevent non-compliant data from entering workflows.

**Special Considerations:**

* Use privacy portals or data labeling tools to classify and block/mask PHI.

Share on Social

## Jump to:

[Introduction to Architecting HIPAA on Telnyx](#introduction-to-architecting-hipaa-on-telnyx)[Customer Requirements Across All Telnyx Services](#customer-requirements-across-all-telnyx-services)[Product-Specific Guidelines](#product-specific-guidelines)

## Sign up for emails of our latest articles and news

[Start building](https://telnyx.com/sign-up)

Latest from Telnyx

* [**Messaging**What is SMS? Meaning, how it works, and what each message costs![Serhii](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/_DSC8799-6.jpg?width=96&format=webp)By Serhii Omelchenko26, Oct 2026](https://telnyx.com/resources/what-is-sms)
* [**WhatsApp Business API**WhatsApp for real estate: listings, viewings and calls on one number![Deniz Yakışıklı](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Deniz_Yakisikli_6b7b420ed4.png?width=96&format=webp)By Deniz Yakışıklı26, Oct 2026](https://telnyx.com/resources/whatsapp-for-real-estate)
* [**Voice**Build vs buy contact center software in 2026: build, buy or extend![Serhii](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/_DSC8799-6.jpg?width=96&format=webp)By Serhii Omelchenko26, Oct 2026](https://telnyx.com/resources/contact-center-software-build-vs-buy)
* [**Inference**Open weight models: what they are and how to use them![Eli Mogul](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Eli_Mogul_1de9939dcb.png?width=96&format=webp)By Eli Mogul23, Oct 2026](https://telnyx.com/resources/open-weight-models)
* [**Inference** Top AI inference platforms: how to evaluate providers on real cost![Eli Mogul](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Eli_Mogul_1de9939dcb.png?width=96&format=webp)By Eli Mogul22, Oct 2026](https://telnyx.com/resources/inference-provider-eval)
* [**Telnyx**LLM inference explained: phases, bottlenecks and the fastest setup![Eli Mogul](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/Eli_Mogul_1de9939dcb.png?width=96&format=webp)By Eli Mogul21, Oct 2026](https://telnyx.com/resources/llm-inference)

### Ask AI

* [![GPT](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/chatgpt_icon-ea55e09d.jpeg?width=92&format=webp)](https://chat.openai.com/?q=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.)
* [![Claude](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/claude_icon-c7c8eef3.webp?width=92&format=webp)](https://claude.ai/new?q=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.)
* [![Perplexity](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/perplexity_icon-cd5b74f1.webp?width=92&format=webp)](https://www.perplexity.ai/search?q=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.)
* [![Gemini](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/gemini_icon-4ff1cbf4.webp?width=92&format=webp)](https://www.google.com/search?udm=50&aep=11&q=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.)
* [![Grok](https://d2efw2akbx8gaf.cloudfront.net/https://dotcom-payload-assets-prod.s3.us-east-1.amazonaws.com/cms-media/grok_icon-e588e5bd.webp?width=92&format=webp)](https://x.com/i/grok?text=What makes Telnyx's global network different, breakdown call quality for normal phone calls and voice AI calls.)