Twilio HIPAA Sales Call Brief | Chesapeake Pediatrics

🎙️ 30-Second Elevator Pitch

Twilio Account SID

AC180459df82de842878256dec3456b94c

Inbound DID

+1 (410) 973-7701

"Hi! We are Chesapeake Pediatrics. We built an AI voice answering service for after-hours pediatric calls. We already have an enterprise signed BAA with Google for our Cloud Run bridge and Gemini Live AI model. We are now upgrading our Twilio account to execute a Business Associate Agreement (BAA). We only use Twilio for inbound Voice with bidirectional WebSocket Media Streams, plus outbound SMS and Content API RCS alerts to our on-call doctors. We do not store any call recordings in Twilio. Can you help us execute the BAA on our account or set up a HIPAA subaccount?"

🛠️ 5 Exact Twilio Services Used

1. Twilio Programmable Voice

Voice API

Receives inbound phone calls from patient parents via standard PSTN. Executes TwiML webhook to open the live audio stream.

<Response>
  <Connect>
    <Stream url="wss://[host]/media-stream">
      <Parameter name="callerPhone" value="{caller}" />
      <Parameter name="callSid" value="{call_sid}" />
    </Stream>
  </Connect>
</Response>

2. Twilio Media Streams (Bidirectional)

WebSockets

Live full-duplex audio transport. Streams caller speech to Cloud Run as 8kHz G.711 μ-law audio packets and receives 8kHz synthetic audio back for real-time playback. Handles instant barge-in buffer clearing.

3. Twilio Phone Numbers (DID)

10DLC / DID

Direct Inward Dialing number (+1 410-973-7701) configured with Voice Webhook and Messaging Webhook URLs.

4. Twilio Content API & RCS Sender

RCS Rich Cards

Dispatches rich pediatric intake alert cards to on-call doctors via Twilio Content API templates. Features interactive QUICK_REPLY buttons ("Acknowledge") and secure authenticated deep links.

5. Twilio Programmable Messaging (SMS)

SMS Alerting

Fallback alert delivery when doctor is outside RCS coverage. Inbound webhook receives doctor replies ("ACK", "received") and returns TwiML automated confirmation receipts. Also powers the 20-minute auto-escalation engine.

⚡ End-to-End Technical Flow

📞

Parent Dials In (+1 410-973-7701)
Twilio Voice triggers POST /incoming-call on Cloud Run. Cloud Run returns TwiML with <Connect><Stream> targeting wss://[host]/media-stream.
🔄

Bidirectional Media Streaming (Twilio ↔ Gemini)
Twilio streams raw 8kHz G.711 μ-law audio. Cloud Run transcodes to 16kHz PCM and forwards to Gemini 2.5 Flash Live API. Gemini generates 24kHz audio, transcoded to 8kHz μ-law and sent back via Twilio Media Stream.
🛑

Barge-in / Interruption Buffer Clear
When caller speaks over AI, Cloud Run sends {"event": "clear", "streamSid": "..."} to Twilio to immediately stop playing buffered audio through the phone.
📲

Pediatrician Alert Dispatch (RCS → SMS Fallback)
AI executes submit_pediatric_intake. System dispatches Twilio Content API RCS Card (Template HX6a886...) to on-call doctors. If RCS is unsupported, it falls back to standard Twilio SMS.
⏱️

1-Tap Acknowledgment & 20m Escalation
Doctor taps [ Acknowledge ] in RCS (triggers POST /inbound-message) or pushes /ack/{call_sid} button on mobile. If unacknowledged after 20 minutes, cron resends urgent escalation alerts.

❓ High-Priority Questions for Sales Rep

1. Which Twilio Edition is required to sign the BAA?

Context: Twilio typically requires Security Edition or Enterprise Edition for HIPAA eligibility. Ask what the minimum commitment or monthly fee is for our account size.

2. Are Media Streams explicitly covered under the Voice BAA exhibit?

Context: We do not use Twilio Call Recording; we use real-time bidirectional WebSocket Media Streams (<Connect><Stream>). We need explicit confirmation that raw voice audio streaming over WebSockets is covered under the BAA.

3. Are the Content API and RCS Senders covered under the BAA?

Context: We use Twilio Content API (HX... templates) and RCS Senders (rcs:agent_name) to send alert cards. Are Content API and RCS classified under Programmable Messaging under your BAA terms?

4. Can we execute the BAA on our existing Account SID?

Context: Our active Account SID is AC180459df82de842878256dec3456b94c. Ask if the BAA can be applied to this existing project or if we need to create a dedicated HIPAA Subaccount.

5. What logging / data redaction features should we turn on?

Context: Twilio provides Message Body Redaction and Voice Insights Data Redaction. We want to ensure our Twilio project logs zero PHI at rest.

🛡️ HIPAA Architecture & PHI Controls

Use these points if the Twilio rep asks how our system complies with HIPAA and protects PHI:

🔒

Zero Audio At Rest in Twilio
Twilio <Record> is disabled. Twilio is strictly a real-time transit conduit for voice packets. Call recordings and transcripts are stored exclusively in our encrypted Google Cloud Storage bucket (where we have a signed Google BAA).
🛡️

End-to-End Transport Encryption
All Twilio Media Streams run over secure WebSockets (wss://). All webhooks use TLS 1.3 (https://). Twilio request signatures (X-Twilio-Signature) are validated.
🛑

PHI Redaction on Public Links
The 1-tap mobile acknowledgment page (/ack/{call_sid}) strictly redacts patient name, date of birth, clinical symptoms, and callback phone numbers to prevent accidental PHI exposure over lock screens or link preview scrapers.
🔑

Google Workspace SSO & RBAC
Accessing full clinical notes, transcripts, or playback audio requires OAuth 2.0 authentication restricted strictly to verified @chesapeakepeds.com accounts.

✓ Key Takeaway for Sales Rep

We have already implemented technical safeguards, encryption, and data minimization. We only need Twilio to act as our HIPAA-compliant communications vendor and sign the BAA for Voice, Media Streams, and Messaging.