BBAA Atlas

Is Vonage HIPAA compliant?

Communications APIs · vendor site ↗

BAA on select plansPHI with conditions
Will Vonage sign a HIPAA BAA?
Sometimes — Vonage signs a HIPAA BAA only on specific plans or add-ons.
Vonage signs a publicly posted BAA, but coverage is limited to designated HIPAA-enabled APIs: the Video API (with the HIPAA/BAA feature activated and encryption turned on) and the SMS API (US numbers only, with the HIPAA/BAA feature enabled and 'Covered Numbers' confirmed in writing by Vonage). The gate is per-API feature activation, not a plan tier.
PHI eligibility
PHI may be processed only on Vonage's designated HIPAA-eligible APIs (Video API, US SMS API) with a signed BAA and required feature flags; all other Vonage products are excluded.
SOC 2
Not publicly confirmed
Trust center
vonage.com ↗
Sub-processors
—
Notes
Vonage's own pages returned HTTP 403 to fetching; this relies on a recent third-party source that references the official BAA URL. SOC 2 status not verified.
Last verified 2026-05-31confidence: medium· Vendor terms change — confirm directly with Vonage before storing PHI.

Get notified when this changes

We track Vonage's BAA and HIPAA status. Leave your email and we'll send one note if the verdict on this page changes.

One email per change. No newsletter, no selling your address.

How to request and sign a BAA with Vonage

Sometimes — Vonage signs a HIPAA BAA only on specific plans or add-ons.

Request routeSelf-serve — enable it in your account
  1. 1
    Get on a qualifying plan
    Vonage signs a publicly posted BAA, but coverage is limited to designated HIPAA-enabled APIs: the Video API (with the HIPAA/BAA feature activated and encryption turned on) and the SMS API (US numbers only, with the HIPAA/BAA feature enabled and 'Covered Numbers' confirmed in writing by Vonage). The gate is per-API feature activation, not a plan tier.
  2. 2
    Request the Business Associate Agreement
    Vonage lets you obtain the BAA without a sales call. Follow the path named in the plan requirement above — typically an in-product toggle or a billing / compliance settings page — then request and accept the agreement from your own account.
  3. 3
    Confirm what PHI is allowed before you store any
    PHI may be processed only on Vonage's designated HIPAA-eligible APIs (Video API, US SMS API) with a signed BAA and required feature flags; all other Vonage products are excluded. Match your configuration to this scope before putting protected health information into Vonage.
Last verified 2026-05-31 · Plan tiers and BAA terms change often — confirm the current process directly with Vonage before you rely on it. This is cited public information, not legal advice.

Frequently asked questions

Does Vonage sign a HIPAA Business Associate Agreement (BAA)?
Sometimes — Vonage signs a HIPAA BAA only on specific plans or add-ons. Vonage signs a publicly posted BAA, but coverage is limited to designated HIPAA-enabled APIs: the Video API (with the HIPAA/BAA feature activated and encryption turned on) and the SMS API (US numbers only, with the HIPAA/BAA feature enabled and 'Covered Numbers' confirmed in writing by Vonage). The gate is per-API feature activation, not a plan tier.
Is Vonage HIPAA compliant?
Vonage can be HIPAA-compliant only on the specific plans or add-ons where it will sign a Business Associate Agreement (BAA). PHI may be processed only on Vonage's designated HIPAA-eligible APIs (Video API, US SMS API) with a signed BAA and required feature flags; all other Vonage products are excluded.
Can you store PHI (protected health information) in Vonage?
PHI may be processed only on Vonage's designated HIPAA-eligible APIs (Video API, US SMS API) with a signed BAA and required feature flags; all other Vonage products are excluded.
Is Vonage SOC 2 certified?
We could not confirm a public SOC 2 report for Vonage. SOC 2 is separate from a HIPAA BAA — confirm both directly with Vonage.
How do I request a HIPAA BAA from Vonage?
Vonage lets you obtain the BAA without a sales call. Follow the path named in the plan requirement above — typically an in-product toggle or a billing / compliance settings page — then request and accept the agreement from your own account. Confirm current terms directly with Vonage before storing PHI.
What plan do I need to sign a BAA with Vonage?
Vonage signs a publicly posted BAA, but coverage is limited to designated HIPAA-enabled APIs: the Video API (with the HIPAA/BAA feature activated and encryption turned on) and the SMS API (US numbers only, with the HIPAA/BAA feature enabled and 'Covered Numbers' confirmed in writing by Vonage). The gate is per-API feature activation, not a plan tier.

Sources

Is Vonage HIPAA compliant? (2025 update) — Paubox
https://www.paubox.com/blog/is-vonage-hipaa-compliant
Supports: Vonage will sign a BAA; only Video API and US SMS API are HIPAA-eligible with the HIPAA/BAA feature enableddated: 2025
This page is cited public information, not legal or compliance advice. A BAA's availability can depend on your specific plan, region, and contract. Always confirm current terms with Vonage before processing protected health information.

Check another vendor

TwilioBAA on select plansActiveCampaignBAA on select plansAcuity SchedulingBAA on select plansAdobe Acrobat SignBAA on select plansAircallSigns a BAAAirtableBAA on select plans

See all HIPAA compliant transactional email & messaging APIs →
Browse all 105 vendors by category →