> ## Documentation Index > Fetch the complete documentation index at: https://help.withallo.com/llms.txt > Use this file to discover all available pages before exploring further. # HIPAA and BAA > Allo signs a HIPAA Business Associate Agreement with healthcare businesses. $50 per month for the whole workspace, on Business and Ultra. If your business has to comply with HIPAA, Allo signs a Business Associate Agreement (BAA) with you. It is a **\$50 per month** add-on for your whole workspace, available on the **Business** and **Ultra** plans. [Contact support](/en/support/contact) to request one. ## What HIPAA is HIPAA is the Health Insurance Portability and Accountability Act of 1996, a United States federal law. It protects sensitive patient health information from being shared without the patient's consent or knowledge. The law applies to two kinds of companies: * **Covered Entities**: healthcare providers, health plans and healthcare clearinghouses. * **Business Associates**: the companies that create, receive, maintain or transmit patient information on behalf of a Covered Entity. ## What a Business Associate Agreement is A BAA is a contract between a Covered Entity and a Business Associate. It is legally required whenever the Business Associate creates, receives, maintains or transmits Protected Health Information (PHI) to perform a service on the Covered Entity's behalf. The same requirement applies between a Business Associate and its own subcontractors. Allo is a Business Associate when patient information passes through your phone system. That includes a name and a reason for the call left on a voicemail, a symptom mentioned during a call, a recording, a transcript, an AI summary or a note on a contact. ## Who needs one You need a BAA if you are a Covered Entity, or a Business Associate working for one, and patient information passes through Allo. Clinics, dental and medical practices, therapists, home care providers, medical billing companies and health plans are the usual cases. Whether your business falls under HIPAA is a legal question, not a product setting. If you are not sure, ask your legal counsel before you start handling patient information in Allo. ## What it costs * **\$50 per month**, for your whole workspace, whatever the number of seats. * Available on the **Business** and **Ultra** plans. * Added to your existing subscription, on the same billing cycle. See [plans and pricing](/en/billing/plans-and-pricing) for the rest of the plan and add-on costs. ## How to get one [Contact support](/en/support/contact), or your account manager if you have one. Tell us the legal name of your company and who signs on your side. We send you the BAA for signature. Once the BAA is signed, the \$50 per month line is added to your subscription and the terms apply to your workspace. ## Settings worth checking The BAA is the contract. These settings control how much patient information you keep in the first place. Audio is never stored, while transcription and AI summaries keep working. Recordings and transcripts are kept indefinitely by default. Support can set auto-deletion after a number of days. HIPAA sets a 6-year minimum for records you are required to keep. A consent message can play at the start of calls, per number or for the whole company. Security posture, SOC 2 and how your data is encrypted and stored. ## Frequently asked questions The BAA is what puts your account under HIPAA terms. If patient information passes through your calls, request it before you start using Allo for that work. No. It is \$50 per month for the whole workspace, whether you have 2 seats or 50. No. The BAA is available on the Business and Ultra plans. [Compare the plans](/en/billing/plans-and-pricing). The patient information Allo processes for you: calls, recordings, transcripts, AI summaries, messages and contact records. No. HIPAA is a United States law. Allo is built to GDPR standards on every plan, at no extra cost. The BAA only matters if you handle patient information under US law. *** ## Need help? Request a BAA or ask about your setup Consent, retention and privacy mode