Yes A BAA is available on Starter, Core, Premier, Groups and the free trial through Schedule A of Freed's Terms of Use, and the vendor publishes no plan or feature exclusions (verdict date 2026-10-28). The verdict concerns BAA availability, not a certification. Freed's own claims are labeled as such below.
Short answer
Freed's BAA is Schedule A of the platform Terms of Use, so it applies to every account, including the 7-day free trial. A signed copy or an organization-wide BAA can be requested through a form. The vendor publishes these controls: SOC 2 Type 1 and 2, TLS 1.2-1.3, AES-256 encryption and US-based servers.
This directory words the result as "BAA available on plan X for services Y," never "HIPAA certified." A BAA is a contract under which a vendor handles PHI on a covered entity's behalf; see the HIPAA glossary. For other tools, see all vendor HIPAA checks.
Published by Chanty, Inc. This directory reports vendors' published terms. It does not audit vendors and is not legal advice.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Starter | Yes | Part of the Terms of Use (Schedule A); signed copy on request via the BAA request form | Not published by the vendor |
| Core | Yes | Same | Not published by the vendor |
| Premier | Yes | Same | Not published by the vendor |
| Groups | Yes | Same; organization-wide BAA on request via the form | Not published by the vendor |
| Free trial (7 days) | Yes | Covered by Schedule A; signed copy on request via the form | Not published by the vendor |
The vendor lists no excluded plans. Freed's pricing page lists plans from $39/month (Starter, 1 clinician). Check the current plan labels on that page before buying, because plan names there may not match the names used in Schedule A.
What the BAA covers and what it excludes
Covered: the Freed AI scribe, meaning notes, processing of recordings, and integrations.
Excluded: none published by the vendor on the pages checked.
"None published" is not the same as "none exist." This check reports the quoted sources only. It does not read the full BAA text beyond them. Have your privacy officer read Schedule A itself before PHI goes in.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | US |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
The vendor does not describe Freed as end-to-end encrypted, and this page does not either.
How to use Freed with PHI
A BAA is only the contract. In a clinic, the work that remains looks like this:
- Request a signed BAA, or an organization-wide BAA for a group practice, and file it in your vendor inventory.
- Read Schedule A and confirm the covered scope matches how your clinicians use the scribe.
- Set user access and offboarding. When a clinician leaves, remove their account the same day.
- Secure the devices that record visits: screen locks, OS updates, and no shared logins on exam-room tablets.
- Write a staff policy for recording, including how patient consent is obtained and documented.
- Check which integrations send notes or recordings onward, and whether each receiving vendor needs its own BAA.
- Re-verify the terms at the next check (2027-01-28) and after any plan change.
Compliance depends on the signed BAA, your configuration and your organization's policies, not on the tool alone. For comparable tools, browse HIPAA-compliant software by category.
Alternatives with a BAA
Directory verdicts for other AI scribes:
- DeepScribe: verdict yes. The BAA plan is not stated in the facts.
- Heidi Health: verdict conditional. The BAA plan is not stated in the facts.
- Suki: verdict conditional. The BAA plan is not stated in the facts.
- Upheal: verdict yes, with a BAA from the Free plan.
Sources
- How can I obtain a Business Associate Agreement (BAA) with Freed Scribe to ensure HIPAA compliance? — Help article, checked 2026-10-28. "Yes, the BAA is included as Schedule A of Freed’s platform Terms of Use."
- How can I obtain a Business Associate Agreement (BAA) with Freed Scribe to ensure HIPAA compliance? — Help article, checked 2026-10-28. "Yes, you can request a BAA during the trial period by filling out the BAA request form."
- How Freed Keeps Your AI Medical Documentation Secure and HIPAA-Compliant — Vendor page, checked 2026-10-28. "All data is encrypted in transit using TLS 1.2–1.3 and stored with AES‑256 encryption, ensuring protection at every step."
- How Freed Keeps Your AI Medical Documentation Secure and HIPAA-Compliant — Vendor page, checked 2026-10-28. "All data is stored securely in United States-based servers."
- Pricing — Free Trial, Individual & Group | Freed — Pricing page, checked 2026-10-28. "Yes, Freed is HIPAA-compliant, SOC2 Type 1 & 2 certified, and HITECH-compliant."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does Freed sign a BAA?
Yes. Freed's BAA is Schedule A of its platform Terms of Use, available on Starter, Core, Premier, Groups and the free trial. A signed copy can be requested through the vendor's form.
Is the Freed free trial covered by a BAA?
Yes. Schedule A applies to all accounts, including the 7-day free trial, according to the vendor's help article. Whether trial users receive a signed copy is not stated in the sources above.
How do I get a signed or organization-wide BAA from Freed?
Use the BAA request form that Freed links from its help article. An organization-wide BAA is requested the same way. Any extra cost is not published by the vendor.
Where does Freed store data and how is it encrypted?
Freed states that its servers are US-based. It publishes TLS 1.2-1.3 for data in transit and AES-256 for data at rest. It does not publish end-to-end encryption, audit log, access control or SSO details.