Skip to content

Delete structured outputs section for HIPAA compliance #952

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
sailingnat wants to merge 1 commit into
base: update-hipaa-docs
Choose a base branch
from
Open

Delete structured outputs section for HIPAA compliance #952

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
73 changes: 0 additions & 73 deletions fern/security-and-privacy/hipaa.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,79 +97,6 @@ When enabling HIPAA compliance, only HIPAA compliant providers may be chosen.
</Accordion>
</AccordionGroup>

## Structured Outputs with HIPAA Mode

When HIPAA mode is enabled, Vapi does not store structured outputs by default. This protects privacy but limits your ability to use structured outputs in Insights and Call Logs. For non-sensitive outputs, you can override this behavior.

<AccordionGroup>
<Accordion title="How do structured outputs work with HIPAA mode enabled?">
By default, when HIPAA mode is on, Vapi doesn't store structured outputs. This keeps data private but limits your ability to use structured outputs in Insights and Call Logs.

You can enable storage for specific structured outputs using the `compliancePlan.forceStoreOnHipaaEnabled` setting. This allows you to store non-sensitive outputs even when HIPAA mode is active.

**Important:** Your organization is responsible for ensuring that any structured output with storage enabled does NOT extract or generate PHI or sensitive data. Only use this for non-sensitive information.
</Accordion>

<Accordion title="When should I enable storage for structured outputs in HIPAA mode?">
Enable storage ONLY for structured outputs that extract non-sensitive, non-PHI information.

**Safe use cases:**
- Boolean outcomes: `appointmentBooked: true/false`
- Call success indicators: `issueResolved: true/false`
- General categories: `issueCategory: "billing" | "technical" | "general"`
- Satisfaction scores: `csatScore: 1-10`
- Call sentiment: `sentiment: "positive" | "neutral" | "negative"`

**Never enable storage for:**
- Patient diagnosis information
- Medical record numbers
- Social security numbers
- Credit card details
- Patient names, dates of birth, or contact information
- Treatment plans or medication information

**Warning:** Enabling storage for outputs containing PHI violates HIPAA compliance and your BAA with Vapi.
</Accordion>

<Accordion title="How do I configure structured output storage in HIPAA mode?">
You can enable storage for specific structured outputs via the Dashboard or API.

**Via Dashboard:**
1. Navigate to **Structured Outputs** in the left sidebar
2. Create or edit a structured output
3. Expand the **Compliance Settings** section
4. Enable the toggle for "Enable Storage of Structured Outputs while on HIPAA Mode"
5. Only enable if your output does not extract sensitive information

**Via API:**

When creating a structured output:
```json
{
"name": "Appointment Booked",
"type": "ai",
"schema": {
"type": "boolean",
"description": "Whether an appointment was successfully booked"
},
"compliancePlan": {
"forceStoreOnHipaaEnabled": true
}
}
```

When updating a structured output:
```json
{
"compliancePlan": {
"forceStoreOnHipaaEnabled": true
}
}
```

**IMPORTANT:** Only set `forceStoreOnHipaaEnabled: true` if you are certain your structured output does NOT extract PHI or sensitive data. Your organization is responsible for ensuring compliance. Misuse could result in BAA violations.
</Accordion>
</AccordionGroup>

## Best Practices

Expand Down
Loading