You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Delete structured outputs section for HIPAA compliance
Removed section on structured outputs in HIPAA mode, including usage guidelines and configuration instructions as we introduce a new hipaa mode that will allow customers to use structured outputs
Copy file name to clipboardExpand all lines: fern/security-and-privacy/hipaa.mdx
-73Lines changed: 0 additions & 73 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -97,79 +97,6 @@ When enabling HIPAA compliance, only HIPAA compliant providers may be chosen.
97
97
</Accordion>
98
98
</AccordionGroup>
99
99
100
-
## Structured Outputs with HIPAA Mode
101
-
102
-
When HIPAA mode is enabled, Vapi does not store structured outputs by default. This protects privacy but limits your ability to use structured outputs in Insights and Call Logs. For non-sensitive outputs, you can override this behavior.
103
-
104
-
<AccordionGroup>
105
-
<Accordiontitle="How do structured outputs work with HIPAA mode enabled?">
106
-
By default, when HIPAA mode is on, Vapi doesn't store structured outputs. This keeps data private but limits your ability to use structured outputs in Insights and Call Logs.
107
-
108
-
You can enable storage for specific structured outputs using the `compliancePlan.forceStoreOnHipaaEnabled` setting. This allows you to store non-sensitive outputs even when HIPAA mode is active.
109
-
110
-
**Important:** Your organization is responsible for ensuring that any structured output with storage enabled does NOT extract or generate PHI or sensitive data. Only use this for non-sensitive information.
111
-
</Accordion>
112
-
113
-
<Accordiontitle="When should I enable storage for structured outputs in HIPAA mode?">
114
-
Enable storage ONLY for structured outputs that extract non-sensitive, non-PHI information.
- Patient names, dates of birth, or contact information
129
-
- Treatment plans or medication information
130
-
131
-
**Warning:** Enabling storage for outputs containing PHI violates HIPAA compliance and your BAA with Vapi.
132
-
</Accordion>
133
-
134
-
<Accordiontitle="How do I configure structured output storage in HIPAA mode?">
135
-
You can enable storage for specific structured outputs via the Dashboard or API.
136
-
137
-
**Via Dashboard:**
138
-
1. Navigate to **Structured Outputs** in the left sidebar
139
-
2. Create or edit a structured output
140
-
3. Expand the **Compliance Settings** section
141
-
4. Enable the toggle for "Enable Storage of Structured Outputs while on HIPAA Mode"
142
-
5. Only enable if your output does not extract sensitive information
143
-
144
-
**Via API:**
145
-
146
-
When creating a structured output:
147
-
```json
148
-
{
149
-
"name": "Appointment Booked",
150
-
"type": "ai",
151
-
"schema": {
152
-
"type": "boolean",
153
-
"description": "Whether an appointment was successfully booked"
154
-
},
155
-
"compliancePlan": {
156
-
"forceStoreOnHipaaEnabled": true
157
-
}
158
-
}
159
-
```
160
-
161
-
When updating a structured output:
162
-
```json
163
-
{
164
-
"compliancePlan": {
165
-
"forceStoreOnHipaaEnabled": true
166
-
}
167
-
}
168
-
```
169
-
170
-
**IMPORTANT:** Only set `forceStoreOnHipaaEnabled: true` if you are certain your structured output does NOT extract PHI or sensitive data. Your organization is responsible for ensuring compliance. Misuse could result in BAA violations.
0 commit comments