Skip to content

Commit e863274

Browse files
roshan-vapiroshan-vapi
authored
updated docs to include compliance plan reference for structured outputs (#792)
1 parent 8d7589c commit e863274

File tree

2 files changed

+225
-0
lines changed

2 files changed

+225
-0
lines changed

‎fern/assistants/structured-outputs-quickstart.mdx‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -647,6 +647,157 @@ The extracted data (the `result` field from the API response) will look like thi
647647
When accessing via API, this data is nested inside the structured output object at `call.artifact.structuredOutputs[outputId].result`. The Dashboard shows the complete structure including the output ID and name.
648648
</Note>
649649

650+
## HIPAA Compliance & Storage Settings
651+
652+
<Warning>
653+
**Important for HIPAA users:** When HIPAA mode is enabled, Vapi does not store structured outputs by default. This protects privacy but limits your ability to view structured outputs in Insights and Call Logs.
654+
</Warning>
655+
656+
### Understanding the default behavior
657+
658+
When your organization or assistant has HIPAA mode enabled (`hipaaEnabled: true`):
659+
- **Structured outputs are NOT stored** - Results are generated but not persisted in Vapi's systems
660+
- **Limited visibility** - You cannot view outputs in the Dashboard's Call Logs or Insights
661+
- **Privacy first** - This ensures sensitive data is not retained
662+
- **Webhook access only** - You can still receive outputs via webhooks during the call
663+
664+
This default behavior protects patient privacy and ensures compliance with HIPAA regulations.
665+
666+
### Enabling storage for non-sensitive outputs
667+
668+
For structured outputs that extract **non-sensitive, non-PHI information**, you can override this behavior using the `compliancePlan.forceStoreOnHipaaEnabled` setting.
669+
670+
<Warning>
671+
**Your responsibility:** You must ensure that any structured output with storage enabled does NOT extract or generate PHI or sensitive data.
672+
</Warning>
673+
674+
#### Safe use cases for storage override
675+
676+
Enable storage for these types of non-sensitive outputs:
677+
678+
- **Boolean outcomes**: `appointmentBooked: true/false`, `callSuccessful: true/false`
679+
- **General categories**: `issueCategory: "billing" | "technical" | "general"`
680+
- **Satisfaction scores**: `csatScore: 1-10`
681+
- **Call metrics**: `sentiment: "positive" | "neutral" | "negative"`
682+
- **Success indicators**: `issueResolved: boolean`, `followUpRequired: boolean`
683+
684+
#### Never enable storage for these
685+
686+
**Do not** enable storage for outputs that extract:
687+
- Patient names, dates of birth, or contact information
688+
- Diagnosis, treatment, or medication information
689+
- Medical record numbers or identifiers
690+
- Social security numbers
691+
- Credit card or payment details
692+
693+
### Configuration examples
694+
695+
<Tabs>
696+
<Tab title="Dashboard">
697+
1. Navigate to **Structured Outputs** in the left sidebar
698+
2. Create or edit a structured output
699+
3. Expand the **Compliance Settings** section
700+
4. Enable the toggle for "Enable Storage of Structured Outputs while on HIPAA Mode"
701+
5. **Recommendation**: Only enable if your output does not extract sensitive information
702+
</Tab>
703+
704+
<Tab title="cURL">
705+
```bash
706+
# Creating a HIPAA-safe structured output with storage enabled
707+
curl -X POST https://api.vapi.ai/structured-output \
708+
-H "Authorization: Bearer $VAPI_API_KEY" \
709+
-H "Content-Type: application/json" \
710+
-d '{
711+
"name": "Appointment Booked",
712+
"type": "ai",
713+
"description": "Boolean indicator of whether appointment was booked",
714+
"schema": {
715+
"type": "boolean",
716+
"description": "Whether an appointment was successfully booked during the call"
717+
},
718+
"compliancePlan": {
719+
"forceStoreOnHipaaEnabled": true
720+
}
721+
}'
722+
```
723+
</Tab>
724+
725+
<Tab title="TypeScript (Server SDK)">
726+
```typescript
727+
import { VapiClient } from "@vapi-ai/server-sdk";
728+
729+
const vapi = new VapiClient({ token: process.env.VAPI_API_KEY! });
730+
731+
// Safe: Boolean outcome, no PHI
732+
const structuredOutput = await vapi.structuredOutputs.create({
733+
name: "Appointment Booked",
734+
type: "ai",
735+
description: "Boolean indicator of whether appointment was booked",
736+
schema: {
737+
type: "boolean",
738+
description: "Whether an appointment was successfully booked during the call"
739+
},
740+
compliancePlan: {
741+
forceStoreOnHipaaEnabled: true // Safe because output contains no PHI
742+
}
743+
});
744+
745+
// Update existing structured output to enable storage
746+
await vapi.structuredOutputs.update(structuredOutput.id, {
747+
compliancePlan: {
748+
forceStoreOnHipaaEnabled: true
749+
}
750+
});
751+
```
752+
</Tab>
753+
754+
<Tab title="Python (Server SDK)">
755+
```python
756+
from vapi import Vapi
757+
import os
758+
759+
vapi = Vapi(token=os.environ.get("VAPI_API_KEY"))
760+
761+
# Safe: Boolean outcome, no PHI
762+
structured_output = vapi.structured_outputs.create(
763+
name="Appointment Booked",
764+
type="ai",
765+
description="Boolean indicator of whether appointment was booked",
766+
schema={
767+
"type": "boolean",
768+
"description": "Whether an appointment was successfully booked during the call"
769+
},
770+
compliance_plan={
771+
"forceStoreOnHipaaEnabled": True
772+
}
773+
)
774+
775+
# Update existing structured output to enable storage
776+
vapi.structured_outputs.update(
777+
structured_output.id,
778+
compliance_plan={
779+
"forceStoreOnHipaaEnabled": True
780+
}
781+
)
782+
```
783+
</Tab>
784+
</Tabs>
785+
786+
<Warning>
787+
**IMPORTANT:** Only set `forceStoreOnHipaaEnabled: true` if you are certain your structured output does NOT extract PHI or sensitive data. Review your schema carefully before enabling storage.
788+
</Warning>
789+
790+
### Best practices for HIPAA compliance
791+
792+
1. **Default to privacy**: Keep storage disabled for all outputs that might contain PHI
793+
2. **Review schemas carefully**: Ensure your extraction logic cannot accidentally capture sensitive data
794+
3. **Use specific schemas**: Design narrow schemas that target only non-sensitive data
795+
4. **Test thoroughly**: Verify outputs don't contain PHI before enabling storage
796+
5. **Document decisions**: Maintain records of which outputs have storage enabled and why
797+
6. **Regular audits**: Periodically review stored outputs to ensure compliance
798+
799+
For more information about HIPAA compliance with Vapi, see our [HIPAA Compliance Guide](/security-and-privacy/hipaa).
800+
650801
## Next steps
651802

652803
<CardGroup cols={2}>

‎fern/security-and-privacy/hipaa.mdx‎

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,80 @@ When enabling HIPAA compliance, only HIPAA compliant providers may be chosen.
9797
</Accordion>
9898
</AccordionGroup>
9999

100+
## Structured Outputs with HIPAA Mode
101+
102+
When HIPAA mode is enabled, Vapi does not store structured outputs by default. This protects privacy but limits your ability to use structured outputs in Insights and Call Logs. For non-sensitive outputs, you can override this behavior.
103+
104+
<AccordionGroup>
105+
<Accordion title="How do structured outputs work with HIPAA mode enabled?">
106+
By default, when HIPAA mode is on, Vapi doesn't store structured outputs. This keeps data private but limits your ability to use structured outputs in Insights and Call Logs.
107+
108+
You can enable storage for specific structured outputs using the `compliancePlan.forceStoreOnHipaaEnabled` setting. This allows you to store non-sensitive outputs even when HIPAA mode is active.
109+
110+
**Important:** Your organization is responsible for ensuring that any structured output with storage enabled does NOT extract or generate PHI or sensitive data. Only use this for non-sensitive information.
111+
</Accordion>
112+
113+
<Accordion title="When should I enable storage for structured outputs in HIPAA mode?">
114+
Enable storage ONLY for structured outputs that extract non-sensitive, non-PHI information.
115+
116+
**Safe use cases:**
117+
- Boolean outcomes: `appointmentBooked: true/false`
118+
- Call success indicators: `issueResolved: true/false`
119+
- General categories: `issueCategory: "billing" | "technical" | "general"`
120+
- Satisfaction scores: `csatScore: 1-10`
121+
- Call sentiment: `sentiment: "positive" | "neutral" | "negative"`
122+
123+
**Never enable storage for:**
124+
- Patient diagnosis information
125+
- Medical record numbers
126+
- Social security numbers
127+
- Credit card details
128+
- Patient names, dates of birth, or contact information
129+
- Treatment plans or medication information
130+
131+
**Warning:** Enabling storage for outputs containing PHI violates HIPAA compliance and your BAA with Vapi.
132+
</Accordion>
133+
134+
<Accordion title="How do I configure structured output storage in HIPAA mode?">
135+
You can enable storage for specific structured outputs via the Dashboard or API.
136+
137+
**Via Dashboard:**
138+
1. Navigate to **Structured Outputs** in the left sidebar
139+
2. Create or edit a structured output
140+
3. Expand the **Compliance Settings** section
141+
4. Enable the toggle for "Enable Storage of Structured Outputs while on HIPAA Mode"
142+
5. Only enable if your output does not extract sensitive information
143+
144+
**Via API:**
145+
146+
When creating a structured output:
147+
```json
148+
{
149+
"name": "Appointment Booked",
150+
"type": "ai",
151+
"schema": {
152+
"type": "boolean",
153+
"description": "Whether an appointment was successfully booked"
154+
},
155+
"compliancePlan": {
156+
"forceStoreOnHipaaEnabled": true
157+
}
158+
}
159+
```
160+
161+
When updating a structured output:
162+
```json
163+
{
164+
"compliancePlan": {
165+
"forceStoreOnHipaaEnabled": true
166+
}
167+
}
168+
```
169+
170+
**IMPORTANT:** Only set `forceStoreOnHipaaEnabled: true` if you are certain your structured output does NOT extract PHI or sensitive data. Your organization is responsible for ensuring compliance. Misuse could result in BAA violations.
171+
</Accordion>
172+
</AccordionGroup>
173+
100174
## Best Practices
101175

102176
<AccordionGroup>

0 commit comments

Comments
 (0)