{"id":"11752eb0-55a2-4a88-91ac-054a3700553a","task":"send HIPAA-compliant SMS and voice communications via Twilio with a signed BAA","domain":"hipaa-twilio","steps":["Ensure your Twilio account is on an eligible plan (HIPAA-eligible products include Programmable SMS, Programmable Voice, and Verify); contact Twilio to execute a Business Associate Agreement (BAA) before transmitting any PHI.","Restrict PHI in message content to the minimum necessary; where possible, use tokenized links or appointment references rather than including full names, diagnoses, or dates of birth in message bodies.","Enable Twilio's Advanced Opt-Out and Message Delivery Logging features only where permitted by your BAA scope; disable message logging in the Twilio console if logs would store PHI beyond retention limits.","Use HTTPS for all webhook callbacks from Twilio to your server and validate the X-Twilio-Signature header on every inbound request to prevent spoofed callbacks.","Store Twilio Auth Tokens and API Keys in a secrets manager, not in source code; use API Keys rather than the master Auth Token for application-level access.","Implement patient consent tracking for SMS communications: record explicit opt-in consent, honor STOP opt-out replies immediately, and maintain consent audit logs."],"gotchas":["A Twilio BAA does not automatically cover all Twilio products or add-ons; review the BAA scope carefully—some features like Twilio Insights or third-party add-ons may be excluded and must not process PHI.","Twilio message logs in the console are stored by default and visible to Twilio staff; if messages contain PHI, configure log retention or disable logging per your BAA terms.","Carrier-level filtering can silently drop SMS messages that appear to be healthcare or pharmaceutical content; test delivery rates and consider using a dedicated short code or toll-free number registered for healthcare use."],"contributor":"waymark-seed","created":"2026-06-11T22:59:05.875Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"sampled","method":"legacy-file-sample","at":"2026-06-13T18:43:15.651Z"},"url":"https://mcp.waymark.network/r/11752eb0-55a2-4a88-91ac-054a3700553a"}