Yes As of 2026-10-28, a BAA is available for the DeepScribe AI medical scribe. It is attached as Exhibit A to the Terms of Use and executed with the customer agreement, and no plan tiers are published. The main gap is that no security controls are published on the pages reviewed. See all vendor HIPAA checks for other tools.
Short answer
DeepScribe's Terms of Use attach a BAA that governs how PHI is handled. The Terms state that PHI "shall be protected in accordance with HIPAA, as set forth in the BAA." Affiliates must countersign the BAA.
Purchase is sales-led. No public pricing or plan tiers are published, so the BAA is obtained through the customer agreement rather than by choosing a plan.
The pages reviewed state no security controls. An evaluator has to request them directly from DeepScribe.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Not published by the vendor | Yes, Exhibit A to the Terms of Use | Executed with the customer agreement | Not published by the vendor |
Because there is no public pricing page, a practice cannot see in advance what the agreement costs or which service levels come with it. Ask for both in the sales process and keep the answers with the executed BAA.
What the BAA covers and what it excludes
Covered:
- The DeepScribe AI medical scribe
Exclusions: The Terms of Use publish none. That is not the same as everything else being covered. The pages reviewed do not describe any other DeepScribe product, integration or connected third-party service. Do not assume the BAA extends to anything beyond the scribe. If your clinic exports notes into an EHR or another tool, that destination needs its own BAA and its own check.
Affiliates must countersign the BAA. A multi-entity group or a clinic with an affiliated billing company should confirm who signs before any PHI is recorded.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Not published by the vendor |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" means the pages reviewed do not state it. It does not mean the control is absent. Request each item in writing before approving PHI use.
How to use DeepScribe with PHI
Compliance depends on the signed BAA, configuration and your own policies, not on the vendor alone. A practical checklist:
- Sign and file the executed business associate agreement (BAA) before any patient encounter is recorded.
- Have affiliates countersign the BAA where they will use the service.
- Request security documentation in writing: encryption in transit and at rest, audit logging, access controls, SSO, data residency, and any SOC 2, HITRUST or ISO 27001 reports.
- Limit user access to the clinicians who need it, and remove accounts the day someone leaves.
- Set internal policies for when the scribe may be used, such as which visit types and what patient notice is given, and train staff on them.
- Add DeepScribe to your vendor inventory with the BAA date, the documents received and the next review date.
Alternatives with a BAA
Verdicts below come from each vendor's own check page.
- Freed: yes, BAA from the Starter plan.
- Upheal: yes, BAA from the Free plan.
- Heidi Health: conditional.
- Suki: conditional.
Compare more options in HIPAA-compliant AI scribes, or browse HIPAA-compliant software by category.
Sources
- DeepScribe Terms of Use — Terms, checked 2026-10-28. "countersigns this Agreement and the BAA attached hereto in the form executed by the Parties"
- DeepScribe Terms of Use — Terms, checked 2026-10-28. "shall be protected in accordance with HIPAA, as set forth in the BAA."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
FAQ
Does DeepScribe sign a BAA?
Yes. The BAA is attached as Exhibit A to the Terms of Use and executed with the customer agreement.
Which DeepScribe plan includes a BAA?
No plans or tiers are published. The BAA is obtained through the customer agreement, and pricing is not published by the vendor.
Which DeepScribe services does the BAA cover?
The DeepScribe AI medical scribe. The Terms of Use publish no exclusions, but they also describe no other covered services. Affiliates must countersign the BAA.
Does DeepScribe publish its security controls, SOC 2 or HITRUST status?
Not on the pages reviewed. Encryption, audit logs, access controls, SSO, data residency, SOC 2, HITRUST and ISO 27001 are all "Not published by the vendor." Request them in writing.