Is Twilio HIPAA Compliant? Yes — With a BAA (2026)

Twilio can be HIPAA compliant — but only on Twilio's designated HIPAA-eligible products with a signed Business Associate Agreement (BAA). A standard Twilio account, a free trial account, and consumer-facing add-ons are not HIPAA-eligible. The compliance gap is wide enough that practices using Twilio for patient communications without explicit BAA contracting are routinely surprised when an audit surfaces the exposure.

The shape of the problem: Twilio is infrastructure for SMS, voice, email, and video. Many telehealth, patient outreach, and reminder workflows touch PHI — names, appointment times, provider details, and visit reasons. Without a BAA covering the specific Twilio products in that workflow, every message is an unprotected PHI transmission.

Here is what is eligible, what is not, and how to configure Twilio for HIPAA-compliant healthcare communications.

Which Twilio Products Are HIPAA-Eligible?

Twilio publishes a HIPAA Eligible Services list and signs BAAs with customers who contract for those specific products. Two conditions gate it. The product has to be on the list, and the account has to be on Twilio's Security or Enterprise Edition — a BAA is not available on lower editions or on a trial account. Eligibility is not a setting you toggle in the console.

The products below reflect Twilio's HIPAA Eligible Services document as last updated June 30, 2026.

Programmable Messaging (SMS, MMS). Eligible for HIPAA workloads when contracted with a BAA. Used for appointment reminders, two-way patient messaging, refill notifications, and care coordination outreach.

Programmable Voice. Eligible for HIPAA workloads with a BAA. Covers IVR systems, automated outbound calls, and recorded voice interactions when properly configured.

Programmable Video. Eligible with a BAA — used by many telehealth platforms as the underlying video infrastructure.

Twilio Conversations (classic). Multi-channel messaging across chat, SMS, MMS, and group texting, eligible with a BAA. WhatsApp is available as a Conversations channel but is not on Twilio's eligible list, so the BAA does not extend to it.

Twilio Flex. Customer engagement platform — eligible with a BAA for healthcare contact centers when contracted on the appropriate edition.

Compliance Toolkit for Messaging and the Consent Management API. Both became HIPAA-eligible on June 30, 2026 — the most recent additions to the list. For healthcare SMS this is the useful one: consent state for patient messaging can now live inside the same eligible perimeter as the messages themselves, rather than in a separate system you have to bring under its own agreement.

Twilio Segment. Eligible across Connections, Unify, Engage and Protocols, with per-feature conditions set out in Twilio's Architecting for HIPAA guidance.

Twilio Studio, TaskRouter, Functions, Sync, Event Streams and several other supporting products are also on the list, covered when used with eligible primary products under a BAA. A number of them carry a footnote pointing at Architecting for HIPAA — that footnote is doing real work, and it is worth reading before you assume a feature is in scope just because its parent product is.

Two products on the list are on their way out and should not carry new healthcare workflows: Twilio Frontline entered End of Sale in February 2023 and reaches end of life on September 30, 2026, and Programmable Chat has been end-of-life since 2022.

The practical rule: before any PHI flows through any Twilio product, confirm that product is on the current HIPAA-eligible list and that your BAA explicitly covers it.

SendGrid Is Not HIPAA-Eligible

SendGrid is a Twilio company, which leads a lot of teams to assume it inherits Twilio's HIPAA coverage. It does not. Twilio's own documentation states that SendGrid "is not a HIPAA Eligible Service" and that Twilio "is not able to sign Business Associate Agreements for SendGrid." SendGrid appears nowhere on Twilio's HIPAA Eligible Services list.

This holds on every SendGrid plan. There is no paid tier that changes it, and the usual workarounds do not either — Twilio addresses encrypting the message body and sending secure download links directly, and says those mitigations do not make SendGrid a HIPAA Eligible Service.

The practical consequence for a practice: appointment reminders, statements, and results notifications sent through SendGrid are uncovered PHI transmissions. If email is part of your patient communication, it needs a provider that will sign a BAA for the plan you are actually on.

What a Twilio BAA Actually Costs You

This is the question people search for and almost nobody answers, so here is the shape of it.

There is no line-item price for a Twilio BAA. Twilio does not sell the agreement. What it sells is an account edition, and the BAA is available on two of them: Security Edition and Enterprise Edition. Twilio lists three editions — Administration, Security and Enterprise — and does not publish pricing for any of them, directing customers to sales instead. So the honest answer to "what does the Twilio BAA cost" is that there is no published number, and the figure you are looking for is whatever moving your account from its current edition to Security or Enterprise costs at your volume. You have to ask.

Three consequences worth planning around:

• The cost is an account-level change, not a per-message surcharge. You are not buying a document; you are moving the whole account onto a different edition.
• It is a contracting step, not a checkbox. Engage Twilio's compliance team. Budget calendar time for it, not just money.
• A trial account cannot carry PHI. If a prototype has been running on one, the move is a re-contracting exercise and a re-architecture of message flows, and it is much cheaper before launch than after.

If the numbers do not work at your volume, that is a legitimate finding rather than a failure. Plenty of practices route patient messaging through a healthcare-specific platform that includes a BAA in its standard terms, and use Twilio only where it is genuinely the right infrastructure.

What Twilio Provides for HIPAA Compliance

When you deploy Twilio on eligible products with a signed BAA, the platform offers the technical safeguards expected of a healthcare communications provider.

Encryption in transit. All Twilio API endpoints enforce TLS. Calls and messages are encrypted between the client and Twilio's infrastructure, and onward to the carrier network as far as carrier infrastructure permits.

Encryption at rest. Message content, recordings, and transcripts stored within Twilio are encrypted at rest. Customer-managed key options are available on some products through Twilio's enterprise tiers.

Granular access controls. Twilio's authentication model supports API keys, OAuth, role-based access, and IP allowlisting. SSO and SCIM provisioning are available on enterprise plans for centralized workforce management.

Audit logging. Twilio captures detailed event logs for API calls, message delivery, call routing, and administrative actions. Logs can be retained and exported for compliance documentation.

Data residency. Twilio offers regional infrastructure deployment options for customers with specific data residency requirements.

Configurable retention. Message bodies, call recordings, and transcripts can be configured for retention windows that align with your retention policy and HIPAA's documentation requirements.

What Twilio Does Not Do

Twilio is communication infrastructure. It is not a compliance program.

Twilio does not classify your message content. If your team includes a patient's name and visit reason in an SMS body, Twilio transmits it. The platform has no awareness of which messages contain PHI. Your application code or workflow must enforce minimum-necessary content rules.

Twilio does not sign a BAA by default. Creating a Twilio account, even a paid one, does not establish a BAA. The BAA must be requested and contracted explicitly through Twilio's compliance team. Until that is signed, any PHI in messages is uncovered.

Twilio does not cover non-eligible products. Twilio offers products that are explicitly not HIPAA-eligible, and SendGrid is the one healthcare teams most often assume is covered. Using any of them with PHI falls outside your BAA.

Twilio does not protect message content beyond its infrastructure. Once an SMS is delivered to a patient's phone, it is no longer in Twilio's control. SMS itself is fundamentally insecure on the carrier network — encryption ends at carrier ingress. This is a structural limitation of SMS, not a Twilio gap.

Twilio does not enforce PHI minimization. Message templates that include extensive patient information increase exposure. Twilio will not refuse to send a long SMS body containing diagnosis details. Content discipline is your responsibility.

Twilio does not document your risk assessment. A BAA covers Twilio's obligations as a business associate. Risk analysis, policies, training, and incident response are entirely the covered entity's responsibility.

Common Mistakes Practices Make with Twilio

Building on a free trial account, then never migrating. Trial accounts are not HIPAA-eligible. Production traffic on a trial account is unprotected — and the migration path requires re-contracting and re-architecting message flows.

Including diagnosis or visit reason in SMS reminders. "Hi Jane, this is a reminder of your oncology consultation on Friday at 2 PM with Dr. Smith." That message contains identifiable PHI in plaintext on the carrier network.

Forwarding SMS to a non-HIPAA email or chat system. Many practices route incoming SMS to Slack, Microsoft Teams, or generic email. If those downstream systems are not covered by their own BAAs, the routing is a compliance failure.

Using non-eligible Twilio products like Twilio Marketing Campaigns without verifying coverage. Marketing-focused products may not be on the eligible list. Sending a "wellness program" SMS through a non-eligible product violates the BAA.

Recording calls without configuring retention. Call recordings can accumulate indefinitely without explicit retention policies. Unconstrained recording storage creates excess PHI exposure.

Storing call transcripts in non-HIPAA analytics tools. Transcripts are PHI when they include patient identifiers. Routing them to a generic analytics tool without a BAA creates exposure.

Sending PHI over WhatsApp because it appears as a Conversations channel. Being available in an eligible product is not the same as being eligible. WhatsApp is not on Twilio's HIPAA Eligible Services list, so a Twilio BAA does not reach it.

How to Configure Twilio for HIPAA Compliance

Configuration is where compliance is enforced.

• Contract a BAA with Twilio for the specific products you will use. This is not a self-service action. Engage Twilio's compliance team before production traffic involving PHI.
• Restrict your account to HIPAA-eligible products. Disable or do not provision non-eligible products. Document which products are in scope.
• Minimize PHI in message bodies. Use generic appointment reminders ("You have an appointment Friday at 2 PM. Reply C to confirm.") rather than diagnosis-rich messages. Link to a HIPAA-compliant patient portal for clinical detail.
• Enable audit logging and route logs to a retained, encrypted destination. Twilio's Event Streams or webhook delivery can feed your SIEM or audit log store. Ensure that destination is also covered.
• Configure call recording retention. Set explicit retention windows, document them in your policy, and apply automatic purging at the end of the window.
• Protect API keys and webhooks. Use scoped API keys per service, rotate them regularly, and enforce TLS on all webhook endpoints. Validate Twilio's webhook signatures.
• Restrict access by role and IP. Use Twilio's role-based access to enforce minimum necessary, and IP allowlist administrative access where possible.
• Audit downstream integrations. Every place a Twilio message terminates — CRM, EHR, analytics — must be evaluated for HIPAA coverage. Document the data flow end to end.
• Use SSO and centralized identity management. Eliminate orphaned admin accounts when staff leave. SSO with SCIM provisioning is the cleanest control on enterprise plans.

Where Twilio Fits in Your Compliance Program

Twilio is one vendor in a communications layer that often spans an EHR, a patient portal, a CRM, an email platform, and several analytics tools. A BAA with Twilio covers Twilio. It does not cover what your application sends, what downstream systems do with the data, or what patients receive. The other layers named there have their own eligibility rules, set out in which tools can hold patient information.

The compliance program manages the full data flow. That includes the message content rules, the routing logic, the downstream BAAs, and the retention configuration on every link in the chain.

Patient Protect records the vendors in your communications stack that you enter, tracks the state of every BAA, and keeps the evidence of your reviews. It does not monitor Twilio, the email platform running alongside it, or the downstream systems your messages land in — those reviews remain yours, and what the platform holds is the record of them. If you want to see where your own stack stands before talking to anyone, the free risk assessment covers vendor and BAA coverage alongside the rest.

Frequently Asked Questions

Does Twilio sign a BAA?

Yes, for HIPAA-eligible products, and only on Twilio's Security or Enterprise Edition. The BAA is not signed automatically with account creation and it is not available on a trial account. You must engage Twilio's compliance team and execute a written agreement before any PHI flows through the platform.

Is Twilio SMS HIPAA compliant?

Twilio's Programmable Messaging product is HIPAA-eligible with a signed BAA. However, SMS itself has structural limitations — once a message leaves Twilio's infrastructure, it travels on carrier networks that are not encrypted. For this reason, most healthcare practices minimize PHI in SMS bodies and use SMS as a reminder layer that links into a more secure channel for clinical detail.

Is SendGrid HIPAA compliant?

No. Twilio's documentation states that SendGrid is not a HIPAA Eligible Service and that Twilio is not able to sign a Business Associate Agreement for it. That applies to every plan, paid tiers included. Do not send PHI through SendGrid on any tier.

Can I use Twilio for telehealth video?

Yes — Twilio Programmable Video is HIPAA-eligible with a BAA. Many telehealth platforms use Twilio Video as the underlying infrastructure. Compliance also requires that the application above Twilio (authentication, session management, recording handling) is built and operated to HIPAA standards.

What about Twilio Studio, TaskRouter, or Frontline?

Studio and TaskRouter are on Twilio's eligible list and are covered when used with eligible primary products under a BAA. Frontline is a different situation: it entered End of Sale in February 2023 and reaches end of life on September 30, 2026. It stays available to existing customers until then and is no longer under active development, so it is not something to build a new healthcare workflow on. Every Twilio product carries its own eligibility status and the list changes several times a year — verify before putting PHI through anything new.

Does the Twilio BAA cover messages on the carrier network?

No. Once a message leaves Twilio's infrastructure for the carrier, Twilio's responsibility ends. The carrier network is not encrypted end-to-end. This is why the practical rule for SMS is to minimize PHI content in message bodies and direct patients to a secure channel for sensitive detail.

---

Patient Protect tracks your full compliance program — including communications vendors, BAAs, and message routing — starting at $39/month. For the messaging layer specifically, see HIPAA-compliant messaging; for the voice side of the same stack, voicemail and phone systems.