Three of the six AI note tools in this set publish BAA terms a clinic can accept without a sales call: Upheal from the Free plan, Freed from Starter, and DeepScribe in its Terms (plan not stated). Heidi Health and Suki sign on request or through a customer contract, and Dragon's status is unknown. A BAA covers only the named services and plan, so check scope before any patient audio is recorded. Other categories are listed under HIPAA-compliant software by category.
Quick answer: which AI scribes and clinical note tools sign a BAA, and from which plan
This is a comparison of published terms, not a ranking. Counts across the six vendors:
- BAA on a stated plan or in standard terms: 3 (Upheal, Freed, DeepScribe)
- BAA on request or via sales or contract: 2 (Heidi Health, Suki)
- Unknown: 1 (Dragon)
- Recorded as refusing a BAA: 0
Per vendor (see all vendors in Is it HIPAA compliant? All vendors):
- Upheal: yes. BAA from the Free plan, accepted through click-through terms.
- Freed: yes. BAA from the Starter plan under Terms of Use Schedule A. A signed copy is available on request.
- DeepScribe: yes. BAA in Exhibit A of the Terms. The plan is not stated.
- Heidi Health: conditional. BAA on request. There is no self-serve BAA and no plan statement.
- Suki: conditional. BAA through sales or the customer contract.
- Dragon Medical One / Dragon Copilot: unknown. Microsoft's BAA sits in the Online Services DPA for in-scope services, but the scope for the Dragon products is not confirmed.
Comparison table
All rows were last verified 2026-10-28.
| Vendor | Verdict | BAA from plan | How to obtain | Pricing from | Encryption at rest | Audit log | SSO | SOC 2 | Last verified |
|---|---|---|---|---|---|---|---|---|---|
| Upheal | Yes | Free | Part of the terms: accepted on signup (click-through), published at upheal.io/privacy-and-compliance/business-associate-agreement | $0/month (Free plan) | Yes | Yes | Not published by the vendor | Yes | 2026-10-28 |
| Freed | Yes | Starter | Part of the Terms of Use (Schedule A); signed copy or organization-wide BAA on request via the BAA request form | $39/month (Starter, 1 clinician; pricing page shows $59 and $39 without labeling the discount) | Yes | Not published by the vendor | Not published by the vendor | Yes | 2026-10-28 |
| DeepScribe | Yes | — | Part of the terms (Exhibit A of the Terms of Use), executed with the customer agreement | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| Heidi Health | Conditional | — | On request to Heidi (sales/compliance); no self-serve BAA or plan-level statement published | Not published by the vendor | Yes | Yes | Yes | Yes | 2026-10-28 |
| Suki | Conditional | — | Via sales / customer contract | Not published by the vendor | Yes | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
| Dragon Medical One / Dragon Copilot | Unknown | — | Microsoft HIPAA BAA included by default in the Online Services Data Protection Addendum for in-scope services; Dragon products sold via enterprise/volume licensing | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | Not published by the vendor | 2026-10-28 |
"—" means no plan is tied to a BAA. "Not published by the vendor" means the vendor's own terms or trust page gave no statement we could source. The table makes no claim that the control is absent.
Vendors that do not sign a BAA
No vendor in this set is recorded as refusing a BAA. Two groups still need a note:
- Dragon (unknown). Microsoft's BAA is part of the Online Services DPA and applies to in-scope services. Dragon is sold through enterprise and volume licensing, and its scope under that BAA is not confirmed for Dragon Medical One or Dragon Copilot. Until it is, the table does not treat Dragon as covered.
- Heidi Health and Suki (conditional). These are not a "no." A contract step comes first, and PHI should not go in until the BAA is signed.
Across this category, free and individual trials, model training on customer data, and consumer transcription apps are typical exclusions from a vendor's BAA. A BAA on the paid clinic plan does not extend to a free trial account a clinician opened with a personal email.
What counts as HIPAA-compliant AI scribes and clinical note tools
An ambient scribe records the visit and drafts the note. That makes three artifacts PHI: the audio, the transcript and the draft note. A tool that handles any of them for a covered entity is acting as a business associate. Terms such as PHI and BAA are defined in the HIPAA glossary, and the business associate agreement guide explains the contract itself. For the wider question of AI and PHI, see AI tools and PHI.
What a usable BAA needs to cover:
- Recording, transcription and storage, on the plan you actually use.
- The draft note and any edits, not only the raw audio.
- A statement on whether your data trains models, and how long recordings and transcripts are retained.
This page's wording rule: "BAA available on plan X for the named services." We do not write "HIPAA certified," and we do not treat "vendor is HIPAA compliant" as a product property. A BAA is necessary but does not make the clinic's use compliant on its own.
How to choose
- Confirm the BAA is signed and covers your plan before any patient audio is recorded. A therapist who starts on a free account and upgrades later should record the date the BAA took effect.
- Ask what is stored and for how long. Get answers on whether audio, transcripts and drafts are kept, and how deletion works after a note is finalized.
- Get a written statement on model training with customer data. The table does not record any vendor's position, so ask for it in writing.
- Check the controls you need: encryption at rest, audit log, SSO, and a SOC 2 report on request. Where the table says "Not published by the vendor," ask the vendor directly.
- Match the BAA route to your size. A solo clinician can use click-through terms or a Terms schedule. A group practice or health system will usually go through a request form or a sales contract. The guide on how to read a vendor BAA covers what to look for in each.
- Verify downstream parties. Subprocessors, and any EHR connection the note flows into, need their own BAA coverage. The scribe's BAA does not extend to them.
Related
Vendor terms change. Updates to a verdict appear under recent changes in vendor HIPAA status. Neighboring categories to check for related tools include AI transcription, AI tools and AI chatbots.
FAQ
Is an AI scribe HIPAA compliant if the vendor offers a BAA?
Not by that fact alone. A BAA is necessary, but it covers only the named services and the plan it is attached to. Check that it reaches audio, transcript and draft, then confirm training and retention terms. The clinic still has to configure access, train staff and keep its own policies.
Which AI scribes sign a BAA on a free or low-cost plan?
Upheal lists a BAA from the Free plan through click-through terms. Freed's BAA starts at the Starter plan, priced from $39/month. The pricing page shows $59 and $39 without labeling the discount. DeepScribe's BAA is in Exhibit A of its Terms, and the plan is not stated.
Which AI scribes need a sales contract or request before they sign a BAA?
Heidi Health signs on request, and no self-serve BAA or plan statement is published. Suki signs through sales or the customer contract. Dragon is unknown: Microsoft's BAA in the Online Services DPA applies to in-scope services, and Dragon-product scope is not confirmed.
Do AI scribes train models on my patient audio and notes?
This page does not record any vendor's training policy, so no claim is made either way. Ask each vendor for a written statement on whether your audio, transcripts and notes are used for model training, and for its retention and deletion terms. Get this before you sign the BAA.