HIPAA & PCI

Overview

Sulus provides robust compliance features for organizations handling sensitive data, including HIPAA (healthcare) and PCI (payment card) compliance modes. Here's a comprehensive overview of both.

HIPAA compliance on Sulus is designed for organizations handling Protected Health Information (PHI). By default, Sulus records calls and stores logs and transcriptions, but HIPAA mode changes this behavior to meet regulatory requirements.

Enabling HIPAA Mode

HIPAA mode requires an Enterprise subscription or a separately purchased HIPAA add-on, and a signed Business Associate Agreement (BAA) with Sulus before activation. To enable it:

1. Email [email protected] to arrange your Business Associate Agreement (BAA)
2. Go to Organization > Settings > Billing & Add-Ons in the Dashboard and turn on HIPAA
3. Switch all assistants to HIPAA-compliant providers

HIPAA mode is an organization-level setting — it applies to every assistant in your organization with no per-assistant exception, and cannot be enabled through the API.

HIPAA-Compliant Providers

Where PHI Can Be Used

PHI may only be passed through the /call endpoint. It should never be placed in assistant prompts, phone number labels, or any other configuration endpoints where data would be stored on Sulus's platform.

Structured Outputs in HIPAA Mode

By default, Sulus does not store structured outputs when HIPAA mode is enabled. For non-sensitive outputs only, you can override this using compliancePlan.forceStoreOnHipaaEnabled:

{
  "compliancePlan": {
    "forceStoreOnHipaaEnabled": true
  }
}

Safe use cases include boolean outcomes (e.g., appointmentBooked: true/false) and call sentiment scores. Never enable this for patient names, diagnoses, medical record numbers, or any other PHI.

PCI compliance is designed for organizations handling payment card data. When enabled, Sulus ensures sensitive financial data is not retained on its systems.

Enabling PCI Mode

Enable PCI compliance by setting pciEnabled to true in your assistant's compliancePlan:

{
  "compliancePlan": {
    "pciEnabled": true
  }
}

When PCI compliance is enabled, you can optionally route recordings to a PCI DSS Level 1 compliant cloud storage (AWS S3, Azure Blob Storage, Google Cloud Storage, or Cloudflare R2) and receive transcripts via webhook. If neither is configured, recordings and transcripts are permanently deleted.

Selective Recording with Squads

For flows that need to collect payment data mid-call, Sulus supports using squads to disable recording only during the sensitive payment collection phase:

"artifactPlan": {
    "recordingEnabled": false,
    "loggingEnabled": false,
    "transcriptPlan": {
        "enabled": false
    }
}

This lets you record the beginning and end of a call for quality assurance while ensuring card data is never captured.

Safe Context Handoff

When transferring between assistants in a squad, use contextEngineeringPlan to prevent sensitive data from being forwarded:

• HIPAA mode and Zero Data Retention (ZDR) are mutually exclusive — disable one before enabling the other.
• PCI and HIPAA can be used together; when both are enabled, the stricter restrictions of both apply — no recordings or transcripts will be stored or transmitted.
• System logs and product usage metrics always remain on Sulus's internal infrastructure and are never uploaded to custom storage.

In summary, HIPAA mode protects Protected Health Information through a signed BAA, restricted provider choices, and default non-storage of structured outputs, while PCI mode protects payment card data through deletion-by-default and selective recording controls. Both can be enabled together, and the stricter of the two rule sets always applies.