Heidi Health says it acts as a Business Associate and signs BAAs, but it does not publish which plans include one or how to get one without talking to the company. For a clinic, that means you can't assume a BAA comes with the plan you are on. Confirm it in writing before any patient encounter goes into the scribe.
Is Heidi HIPAA compliant? Verdict
Conditional BAA available on request for the Heidi AI scribe (verified 2026-10-28); Heidi publishes no plan-level BAA statement, so no plan-by-plan coverage is stated.
Short answer
Heidi states that it acts as a Business Associate and executes a Business Associate Agreement (BAA) with customers as needed. No page the vendor pages says which plans (Free, Clinician, Teams) include a BAA, or how to get one self-serve. Heidi also states that US customer data is hosted in the United States, and it claims SOC 2 Type 2 and ISO 27001.
This page reports the vendor's published terms. It is not an audit, a certification or legal advice. For the same check on other tools, see all vendor HIPAA checks.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | Not published by the vendor | On request to Heidi (sales/compliance); no self-serve BAA published | Not published by the vendor |
| Clinician | Not published by the vendor | On request to Heidi (sales/compliance); no self-serve BAA published | Not published by the vendor |
| Teams | Not published by the vendor | On request to Heidi (sales/compliance); no self-serve BAA published | Not published by the vendor |
Plan names are not consistent across sources. The pricing page lists Free, Evidence, Clinician and Enterprise, while the other source names Free, Clinician and Teams.
The pricing page's call to action reads "Get Heidi free". It says nothing about a BAA for the free tier, so a free account should not be treated as covered.
What the BAA covers and what it excludes
Covered, per the vendor's HIPAA statements:
- Heidi AI scribe, including clinical notes, templates and Ask Heidi
Excluded: the vendor publishes no exclusions on the pages checked. This page does not infer any. Absence of a stated exclusion is not confirmation of coverage.
Before use, ask Heidi to name the covered plan and features in writing. For a practice that means asking about each feature it intends to use, for example the scribe, Ask Heidi, templates, and any integration or mobile app.
Security controls the vendor publishes
These come from Heidi's own HIPAA pages. This site did not test them.
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Not published by the vendor |
| SSO | Yes |
| Data residency | US (US customers); region-appropriate residency stated |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Yes |
Report dates and scope for SOC 2 and ISO 27001 are not published on the pages checked.
How to use Heidi with PHI
A BAA does not make a practice compliant on its own. Use of the tool is lawful only if the signed agreement, your configuration and your policies all line up. A working checklist:
- Sign the BAA first. Get it executed before anyone dictates or uploads a patient encounter.
- Confirm the covered plan and features in writing. Do this before you pick a plan based on price.
- Configure SSO and user access. Give each clinician an individual login rather than a shared front-desk account.
- Manage offboarding. Remove departing clinicians and locums the day they leave.
- Set staff policies and training. Define what may go into the tool, how notes are reviewed before they enter the chart, and who owns that review.
- Review patient consent practices. Decide how your clinic tells patients that an AI scribe is recording or transcribing the visit.
Do not put PHI into the Free plan unless Heidi confirms in writing that it is covered. The vendor publishes no such statement. More step-by-step material is in the HIPAA guides.
Alternatives with a BAA
Directory verdicts for other AI scribes, each with its own source and date on its check page:
- DeepScribe: yes.
- Freed: yes, BAA from the Starter plan.
- Suki: conditional.
- Upheal: yes, BAA from the Free plan.
For more categories, see HIPAA-compliant software by category.
Related AI tool checks: Is Claude HIPAA compliant? covers a general-purpose AI assistant, and Is Otter AI HIPAA compliant? covers a transcription tool.
Sources
- Heidi AI is a HIPAA-Compliant Note Taking App — Vendor page, checked 2026-10-28. "Heidi acts as a Business Associate and executes Business Associate Agreements (BAAs). Heidi maintains signed BAAs with customers and counterparties as needed."
- Heidi AI is a HIPAA-Compliant Note Taking App — Vendor page, checked 2026-10-28. "in-transit and at-rest encryption, region-appropriate residency, secure hosting, and audit logging"
- Heidi AI is a HIPAA-Compliant Note Taking App — Vendor page, checked 2026-10-28. "This includes SOC 2 Type 2 and ISO 27001, with supporting policies and test reports available."
- HIPAA Compliance – Heidi — Trust center, checked 2026-10-28. "We prioritise data sovereignty by ensuring all our data is locally hosted within the United States."
- Heidi Pricing | Free, Evidence, Clinician & Enterprise Plans — Pricing page, checked 2026-10-28. "Get Heidi free"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes and FAQ
No changes recorded since first verification on 2026-10-28. Track other vendors under recent changes in vendor HIPAA status.
Does Heidi Health sign a BAA?
Heidi states that it acts as a Business Associate and executes BAAs with customers as needed. No page says how to request one or whether a BAA can be obtained self-serve.
Is the free Heidi plan covered by a BAA?
The vendor publishes no plan-level BAA statement, so the Free plan's status is not published. Do not put PHI into it without written confirmation from Heidi.
Is Heidi AI scribe HIPAA compliant?
The accurate statement is that a BAA is available on request for the Heidi AI scribe. Whether a particular clinic's use is compliant depends on the signed BAA, the clinic's configuration and its policies. Heidi is not "HIPAA certified", and HIPAA has no such certification.
Where does Heidi store US customer data?
Heidi states that US customer data is hosted in the United States. It also states region-appropriate residency for other customers, but the pages checked give no further detail, so this page makes no claim about non-US hosting.