Suki states that it signs a business associate agreement (BAA) with customers, but only through sales-led contracts. It publishes no plan tiers, no pricing and no list of exclusions, so the BAA scope has to be confirmed in writing.
Conditional A BAA is available via customer contract (no public plan tiers) for Suki Assistant / Suki Platform. The main caveat is that no plans or exclusions are published and the BAA comes only through sales. Last verified 2026-10-28. See All vendor HIPAA checks for other vendors.
Short answer
Suki states that it signs BAAs for the handling of patient data. A BAA is the contract that lets a vendor handle protected health information (PHI) for a covered entity or business associate. Suki sells through enterprise contracts. It has no public pricing and no public plan tiers, so there is no self-serve route to a BAA.
Suki states TLS 1.2 for data in transit and AES-256 at rest on Google Cloud. No SOC 2 or HITRUST statement was found on the pages checked: Not published by the vendor.
Which plans include a BAA
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Not published by the vendor | Available per vendor statement | Via sales / customer contract | Not published by the vendor |
There is no public pricing, so a practice cannot compare tiers or find out which tier carries the BAA. Ask sales for the BAA together with the quote, and confirm in writing whether it is included in the contract price.
What the BAA covers and what it excludes
Covered, per the vendor's statement:
- Suki Assistant / Suki Platform: ambient documentation, dictation and the API.
Excluded: Suki publishes no exclusions. Absence of a published list is not confirmation that nothing is excluded. Get the scope in writing in the BAA itself.
Do not assume the BAA extends to third-party integrations or EHR connections. Nothing published says it does, so treat each connected system as needing its own review.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Yes |
| Encryption at rest | Yes |
| Audit log | Not published by the vendor |
| Access controls | Not published by the vendor |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Not published by the vendor |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" means the vendor did not state the control on the pages checked. It does not mean the control is absent. These are the items to put on a diligence request to Suki's sales team.
How to use Suki with PHI
Compliance depends on the signed BAA, your configuration and your organization's policies, not on the product alone. A working checklist:
- Sign the BAA before any clinician dictates or records a patient encounter.
- Confirm the BAA names every Suki product you will use (Assistant, Platform, API).
- Configure user access and set up offboarding, so a departing clinician loses access the same day.
- Ask sales for audit logging, SSO, access-control and data-residency details, plus any security reports, since none are published.
- Set a written policy for dictation and ambient recording, including patient notice and where recorded content may and may not be used.
- Train staff on that policy and keep a record of the training.
- Review any connected system, such as an EHR or other AI model, under its own BAA. For AI-model reviews, see Is Claude AI HIPAA compliant?.
More background is in the HIPAA guides.
Alternatives with a BAA
Verdicts are factual and listed alphabetically, not ranked.
- DeepScribe: yes
- Freed: yes, BAA from the Starter plan
- Heidi Health: conditional
- Upheal: yes, BAA from the Free plan
- Glass Health: a related clinical AI tool; see Is Glass Health HIPAA compliant?
Browse more by type in HIPAA-compliant software by category.
Sources
- Security & Compliance — Vendor page, checked 2026-10-28. "We sign Business Associate Agreements (BAA) for patient data handling with our customers."
- Security & Compliance — Vendor page, checked 2026-10-28. "All data transmitted to and from the Suki platform is encrypted using TLS 1.2."
- Security & Compliance — Vendor page, checked 2026-10-28. "Data at rest is encrypted using AES-256 with Google Cloud services, such as Cloud SQL and Google Cloud Storage."
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes and FAQ
Changes: No changes recorded since first verification on 2026-10-28. See Recent changes in vendor HIPAA status for other vendors.
Does Suki sign a BAA?
Suki states that it signs BAAs with customers for handling patient data. The BAA is part of a sales-led customer contract. Its scope is not published, so confirm which products it names.
How do I get a BAA from Suki, and is it tied to a plan?
Request it through Suki's sales team as part of the contract. Suki publishes no plan tiers or pricing, so the BAA is not tied to a public plan. Whether it costs extra: Not published by the vendor.
How does Suki encrypt PHI in transit and at rest?
Suki states TLS 1.2 for data in transit and AES-256 at rest on Google Cloud. Key management details: Not published by the vendor.
Does Suki publish SOC 2, HITRUST or ISO 27001 reports?
Not on the pages checked: Not published by the vendor. Ask sales whether reports exist and under what terms they are shared.