HIPAA
Learn how ElevenLabs Agents, coupled with Zero Retention Mode, is designed to promote HIPAA compliance for healthcare applications. Please refer to our compliance page for the latest information.
Overview
Section titled “Overview”ElevenLabs Agents is one of ElevenLabs’ HIPAA-eligible services, and we offer Business Associate Agreements (BAAs) to eligible customers. To the extent Covered Entities and Business Associates, as defined under HIPAA, have executed a BAA and have Zero Retention Mode engaged, ElevenLabs allows such customers to develop AI-powered voice agents for the handling Protected Health Information (PHI). The application of Zero Retention Mode is designed to promote compliance with HIPAA by limiting the processing of such PHI. You can read more about Zero Retention Mode here.
Controls designed to promote HIPAA compliance
Section titled “Controls designed to promote HIPAA compliance”When HIPAA compliance is required for a workspace, and to the extent a BAA has been executed with ElevenLabs, the following policies are enabled:
- Zero Retention Mode - You can read more about Zero Retention Mode here
- LLM Provider Restrictions - Only LLM from providers with whom we have a BAA in place are available as preconfigured options
- Storage Limitations - Raw audio files and transcripts containing PHI are not retained
To the extent Zero Retention Mode is engaged, ElevenLabs’ platform is designed to ensure that PHI shared as part of a conversation is not stored or logged in any system component, including:
- Conversation transcripts
- Audio recordings
- Tool calls and results
- Data analytics
- System logs
Enterprise customers
Section titled “Enterprise customers”Available LLMs
Section titled “Available LLMs”When operating in Zero Retention Mode, only the following LLMs are available:
Google Models
- Gemini 3.5 Flash
- Gemini 3.5 Flash Lite
- Gemini 3.1 Flash Lite
- Gemini 2.5 Flash
- Gemini 2.5 Flash Lite
- Gemini 2.0 Flash
- Gemini 2.0 Flash Lite
- Gemini 1.5 Flash
- Gemini 1.5 Pro
- Gemini 1.0 Pro
Anthropic Models
- Claude Sonnet 5
- Claude Sonnet 4.6
- Claude Sonnet 4.5
- Claude Sonnet 4
- Claude Opus 4.8
- Claude Opus 4.7
- Claude Haiku 4.5
- Claude 3.7 Sonnet
- Claude 3.5 Sonnet v2
- Claude 3.5 Sonnet v1
- Claude 3 Haiku
OpenAI Models
- GPT-5.6 Sol*
- GPT-5.6 Terra*
- GPT-5.6 Luna*
- GPT-5.5*
- GPT-5.4*
- GPT-5.4 Mini*
- GPT-5.4 Nano*
- GPT-5.2*
- GPT-5.2 Chat Latest*
- GPT-5.1*
- GPT-5*
- GPT-5 Mini*
- GPT-5 Nano*
- GPT-4.1*
- GPT-4.1 Mini*
- GPT-4.1 Nano*
- GPT-4o*
- GPT-4o Mini*
- GPT-4*
- GPT-4 Turbo*
- GPT-3.5 Turbo*
*Available only for enterprise workspaces with a BAA.
Hosted by ElevenLabs
- Qwen3.5-397b-a17b
- GLM-5.2
Custom LLMs
- Custom LLM (supports any OpenAI-API compatible provider and requires you to bring your own API keys)
Technical implementation
Section titled “Technical implementation”Zero Retention Mode implements several safeguards and is designed to:
- LLM Allowlist - Prevent use of LLMs except as provided above
- PII Redaction - Automatically redact sensitive fields before storage
- Storage Prevention - Disable uploading of raw audio files to cloud
Developer experience
Section titled “Developer experience”When working with Zero Retention Mode agents:
LLMs (except the available LLMs as described above) are disabled in the UI
The UI shows disabled LLM options with tooltip explanations
Content is redacted from content history
All sensitive information contained within the prompt or output is redacted and not stored
Conversation analysis is limited
Minimal information is visible to ElevenLabs given Zero Retention Mode
API restrictions are enforced
Section titled “API restrictions are enforced”API calls attempting to use unavailable LLMs will receive an HTTP 400 error. Analytics data will be limited to non-sensitive metrics only.
Can I use any LLM if I am subject to HIPAA?
No. You can only use models on the allowlist for your residency and workspace type. Attempts to use other LLMs return an error. Use a custom LLM if you need a model that is not hosted on the allowlist, and complete the Custom LLM steps in the note above.
Can I execute a BAA with ElevenLabs if I am subject to HIPAA?
BAAs are only available to enterprise customers. Please refer to your account executive to discuss further.
Does the application of Zero Retention Mode affect conversation quality?
No. Zero Retention Mode and the execution of a BAA only affects how data is stored and which LLMs can be used. It does not impact the quality or functionality of conversations while they are active.
Can I still analyze conversation data?
Yes, but with limitations. Conversation analytics will only include non-sensitive metadata like call duration and success rates. Specific content from conversations will not be available.
Considerations
Section titled “Considerations”When building voice agents, you may consider:
- Use Custom LLMs when possible, which may provide enhanced control over data processing
- Implement proper authentication for all healthcare applications
- Validate configuration is correct by checking redaction before launching + passing PHI