Yes Checked 2026-10-28. Upheal publishes a business associate agreement (BAA) that is available on the Free, AI notes, Pay-as-you-go and EHR Pro plans. No plan is excluded, and the vendor publishes no feature exclusions. This is a statement about BAA availability, not a certification, and using Upheal does not make a practice HIPAA compliant on its own. See all vendor HIPAA checks for other tools.
Short answer
Covered entities can accept Upheal's published BAA at signup, including on the $0 Free plan. The BAA takes effect when the user clicks accept. It is available on the plans above for Upheal AI notes, AI Assistant, EHR and telehealth.
Upheal also publishes that it has completed a SOC 2 Type II audit, encrypts PHI at the record level, logs and monitors access, and runs on AWS infrastructure. The practice still has to accept the BAA under the right legal entity, configure access and keep its own policies.
Which plans include a BAA
A business associate agreement (BAA) is the contract that lets a vendor handle PHI on a covered entity's behalf. Upheal's version is click-through: you accept it during signup, and the text is public on the vendor's BAA page.
| Plan | BAA | How it is obtained | Extra cost |
|---|---|---|---|
| Free | Available | Click-through acceptance on signup; published on the vendor BAA page | Plan from $0/month; BAA-specific cost not published by the vendor |
| AI notes | Available | Click-through acceptance on signup; published on the vendor BAA page | Not published by the vendor |
| Pay-as-you-go | Available | Click-through acceptance on signup; published on the vendor BAA page | Not published by the vendor |
| EHR Pro | Available | Click-through acceptance on signup; published on the vendor BAA page | Not published by the vendor |
The vendor lists no excluded plans. A solo therapist trialing the Free plan is therefore offered the same click-through BAA as a group practice on EHR Pro. The BAA is still a legal agreement with obligations, and "free" does not mean "no obligations."
What the BAA covers and what it excludes
Covered, per the vendor:
- Upheal AI notes
- AI Assistant
- EHR
- Telehealth
Excluded: The vendor publishes no excluded features on the pages checked.
Third-party tools used alongside Upheal, such as a separate video platform, a transcription app or a calendar, are not covered by this vendor's BAA unless the vendor says so. If a clinician pastes session notes into another tool, that tool needs its own BAA. A related example is Is Otter AI HIPAA compliant?.
Security controls the vendor publishes
| Control | Published status |
|---|---|
| Encryption in transit | Not published by the vendor |
| Encryption at rest | Yes |
| Audit log | Yes |
| Access controls | Yes |
| SSO | Not published by the vendor |
| Data residency | Not published by the vendor |
| SOC 2 | Yes |
| HITRUST | Not published by the vendor |
| ISO 27001 | Not published by the vendor |
"Not published" means the vendor's pages checked do not state it. It does not mean the control is absent. If your security review requires SSO, a data residency commitment or ISO 27001, ask Upheal for written confirmation and file the answer with the BAA.
How to use Upheal with PHI
A signed BAA is the starting point. These items stay with the practice. More background is in the HIPAA guides.
- Accept the BAA under the correct legal entity (the practice, not an individual clinician's personal account) before entering any PHI.
- Create user accounts for each clinician and staff member, and remove access when someone leaves.
- Review access settings so each person sees only the clients they treat.
- Set a device and password policy for every phone, laptop and tablet that opens Upheal.
- Train staff and document your policies for AI-generated notes, including who reviews them before they enter the record.
- Record the BAA acceptance (date, entity, who accepted) in your vendor inventory.
Compliance depends on the signed BAA, how the tool is configured and the organization's own policies.
Alternatives with a BAA
Verdicts below follow each vendor's own published terms. Open each check for plan details.
- DeepScribe: yes. Is DeepScribe HIPAA compliant?
- Freed: yes, BAA from the Starter plan. Is Freed HIPAA compliant?
- Heidi Health: conditional. Is Heidi Health HIPAA compliant?
- Suki: conditional. Is Suki HIPAA compliant?
For the full comparison, see HIPAA-compliant software by category and the AI scribes category.
Sources
- HIPAA-Compliant Mental Health EHR | Privacy & Security | Upheal — Trust center, checked 2026-10-28. "All Covered Entities who use our platform agree to the terms of the BAA upon signing up."
- HIPAA-Compliant Mental Health EHR | Privacy & Security | Upheal — Trust center, checked 2026-10-28. "Upheal has completed a SOC 2 Type II audit"
- HIPAA-Compliant Mental Health EHR | Privacy & Security | Upheal — Trust center, checked 2026-10-28. "Record-level encryption of customer PII and PHI data"
- HIPAA-Compliant Mental Health EHR | Privacy & Security | Upheal — Trust center, checked 2026-10-28. "All access to personal data is logged and monitored"
- Business Associate Agreement | Upheal — BAA page, checked 2026-10-28. "This Agreement takes effect on the date (the “Effective Date”) when you click the"
- Pricing | Upheal — Pricing page, checked 2026-10-28. "$0/ month"
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status.
Changes
No changes recorded since first verification on 2026-10-28. See recent changes in vendor HIPAA status for other vendors.
FAQ
Does Upheal offer a BAA on the Free plan?
Yes. Upheal's published BAA is available on the Free plan, which starts at $0/month, as well as on the AI notes, Pay-as-you-go and EHR Pro plans. It is accepted at signup.
When does Upheal's BAA take effect?
It takes effect when the user clicks accept. Accept it under the correct legal entity before entering PHI.
Which Upheal services does the BAA cover?
The vendor lists Upheal AI notes, AI Assistant, EHR and telehealth. It publishes no excluded features on the pages checked.
Has Upheal completed a SOC 2 Type II audit?
Yes, according to Upheal's trust center. The report date and auditor are not stated here.