Free · no signup
HIPAA BAA cheat sheet for practice software
Which of the 121 tools in our directory offer a Business Associate Agreement, on which plan, with the source and the date we last checked. Admin and educational only. Not legal advice.
74marked “BAA available”
33vendor says every plan
22reported or some plans
21unverified
How to use this sheet
- Find the tool, then read the plan details. A BAA on “Enterprise” doesn't cover a Starter plan.
- Get the signed BAA (or accepted terms) for the exact plan before any patient information goes in, and keep a copy with your HIPAA records.
- “Reported” and “unverified” entries need a written answer from the vendor.
- Jump to: Phones & Scheduling · Patient Intake · Documentation & AI Scribes · Billing & Prior Auths · Inbox & Email · Marketing · EHR & Practice Management
Phones & Scheduling (21 tools)
| Tool | Status | What our sources say (plan, terms) | Entry price | Source | Last checked |
|---|---|---|---|---|---|
| Clinivocx | BAA available | Yes – signed BAA with every plan; MFA mandatory (vendor site) | From $799/mo | www.clinivocx.com | |
| DeskMD | BAA available | Yes – signed BAA on every account (vendor site) | From $299/provider/mo | www.deskmd.ai | |
| Echo | BAA available | Yes – signed BAA before go-live, included at every size (vendor site) | Quote | www.echobooking.com | |
| ElevenAgents (ElevenLabs) | BAA available | Yes – BAA only on Enterprise-tier contracts, with Zero Retention Mode required; self-serve plans are not covered, so no PHI on them (vendor docs) | Quote | elevenlabs.io | |
| Emitrr | BAA available | Yes – vendor's HIPAA page says customers who use PHI must sign a BAA with Emitrr; vendor blog says HIPAA compliance is on the Professional plan (vendor site) | From $20/user/mo | emitrr.com | |
| mdhub (Sarah AI admissions) | BAA available | Yes – BAA provided to every customer; HIPAA compliant and SOC 2 Type II (vendor site) | Quote | www.mdhub.ai | |
| Medman (Agentman) | BAA available | Yes – BAA signed before any patient data moves (vendor pricing) | From $10/hour | agentman.ai | |
| MedReception AI | BAA available | Yes – BAA signed for every deployment that touches PHI (vendor HIPAA page) | From $299/mo | www.medreception.ai | |
| Phone Stack | BAA available | Yes – on Scale and Enterprise plans only (vendor site) | From $199/mo | phonestack.com | |
| Quo (formerly OpenPhone) | BAA available | Yes – BAA on Business and Scale plans only; not on Starter (vendor support) | From $33/user/mo | support.quo.com | |
| Retell AI | BAA available | Yes – self-service BAA portal (vendor site) | $0.07–$0.31/min | www.retellai.com | |
| VCare Health | BAA available | Yes – BAA included at no cost on all plans including trial (vendor site) | From $299/mo | vcare-health.com | |
| Weave | BAA available | Yes – BAA available to customers; published BAA addendum (vendor legal) | From $199/mo | www.getweave.com | |
| Assort Health | BAA reported | Reported yes – signed BAA with every client (third-party review) | Quote | www.clinicspots.com | |
| Central | BAA reported | Reported yes – BAAs executed with customers handling PHI (third-party review) | From $89/mo | www.clinicspots.com | |
| Hello Patient | BAA reported | Reported yes – vendor FAQ says agents operate under the practice's BAA; confirm a signed BAA in writing before go-live (vendor FAQ) | Quote | www.hellopatient.com | |
| NexHealth | BAA reported | Reported yes – published BAA for SaaS/API use per third-party HIPAA checkers; confirm current agreement with vendor | Quote | www.keragon.com | |
| Talkie.ai | BAA reported | Reported yes (third-party review) | Quote | www.clinicspots.com | |
| RingCentral AI Receptionist | BAA on some plans | Requested per account – confirm before use (third-party review) | From $39/license | www.clinicspots.com | |
| Luma Health | BAA unverified | unverified – BAA URL exists but page currently shows Terms of Use; confirm signed BAA with vendor | Quote | www.lumahealth.io | |
| Smith.ai | BAA unverified | unverified – vendor markets to medical/wellness but no public BAA found on pricing or industry pages | Free plan · from $0/mo | smith.ai |
Patient Intake (11 tools)
| Tool | Status | What our sources say (plan, terms) | Entry price | Source | Last checked |
|---|---|---|---|---|---|
| Doxy.me | BAA available | Yes – free BAA for all users on Free and Premium; Free/individual BAAs cover one provider, multi-provider practices need a Clinic BAA (vendor help center) | Free plan · from $0 | helpcenter.doxy.me | |
| FormDoctor | BAA available | Yes – signed BAA included on every plan (vendor site) | Quote | formdr.com | |
| Formsort | BAA available | Yes – BAA signed with Enterprise clients only; Free/Pro HIPAA not included (vendor pricing FAQ) | Quote | formsort.com | |
| IntakeQ | BAA available | Yes – HIPAA BAA included on plans (vendor site) | From $29.90/mo | intakeq.com | |
| Jotform (HIPAA) | BAA available | Yes – on Gold or Enterprise after enabling HIPAA (vendor FAQ) | From $129/mo | www.jotform.com | |
| Keragon | BAA available | Yes – standard BAA included on all plans; custom BAA on Enterprise (vendor site) | From $99/mo | www.keragon.com | |
| Medman eligibility agent | BAA available | Yes – BAA signed before any patient data moves (vendor pricing) | From $0.50/check | agentman.ai | |
| Phreesia | BAA available | Yes – vendor states it enters BAAs with healthcare providers (vendor privacy policy) | Quote | www.phreesia.com | |
| Spruce Health | BAA available | Yes – automatic BAA for eligible organizations on every plan including trial (vendor help) | From $24/user/mo | help.sprucehealth.com | |
| Klara | BAA reported | Reported yes – terms identify Klara as a business associate with BAA addendum (third-party HIPAA checker; confirm with vendor) | Quote | www.keragon.com | |
| Availity Essentials | BAA unverified | unverified – Availity is a clearinghouse; confirm BAA/participation agreement for your organization | Quote | pabau.com |
Documentation & AI Scribes (27 tools)
| Tool | Status | What our sources say (plan, terms) | Entry price | Source | Last checked |
|---|---|---|---|---|---|
| AutoNotes | BAA available | Yes – vendor signs a BAA with customers using PHI (vendor trust center) | From $19/mo | www.autonotes.ai | |
| Berries | BAA available | Yes – BAA automatically covers every customer at signup; SOC 2 certified (vendor help center) | Free plan · from $79/mo | help.heyberries.com | |
| Clinical Notes AI (Clinically AI) | BAA available | Yes – vendor says it offers and signs BAAs; confirm the BAA covers the plan you use, including the free plan (vendor site) | Quote | www.clinicalnotes.ai | |
| Commure Scribe | BAA available | Yes – vendor executes signed BAAs with customers; contact support to execute one; SOC 2 Type II (vendor docs) | Quote | docs.scribe.commure.com | |
| DeepCura | BAA available | Yes – BAA with every customer (vendor site) | From $129/provider/mo | www.deepcura.com | |
| Freed | BAA available | Yes – BAA included in Platform Terms of Use at signup, including trial; signed copy on request (vendor help) | From $39/mo | help.getfreed.ai | |
| HealOS (formerly ScribeHealth) | BAA available | Yes – vendor signs BAAs with every customer; SOC 2 Type II (vendor site) | From $49/mo | www.scribehealth.ai | |
| JotPsych | BAA available | Yes – BAA included with every account at no extra cost, signed in-app by the practice admin (vendor) | From $53/mo | jotpsych.com | |
| PatientNotes | BAA available | Yes – BAA included with every paid Team/Enterprise plan at no extra cost (vendor pricing/security) | From $50/user/mo | patientnotes.ai | |
| PMHScribe | BAA available | Yes – vendor says a BAA is available for every practice and signed on every plan; recordings are not stored (vendor site) | From $79/mo | pmhscribe.com | |
| SimplePractice Note Taker | BAA available | Yes – covered under SimplePractice BAA accepted at signup; AI addendum applies (vendor support) | From $35/clinician/mo | support.simplepractice.com | |
| Supanote | BAA available | Yes – every account is covered by a BAA at onboarding; custom BAA for group practices (vendor) | From $19.99/mo | www.supanote.ai | |
| Twofold Health | BAA available | Yes – BAA automatic at signup on every plan (vendor help) | Free plan · from $69/mo | help.trytwofold.com | |
| YUNG Sidekick | BAA available | Yes – vendor FAQ says covered entities automatically agree to its BAA at signup; BAA published on its site (vendor site) | From $0/mo | yung-sidekick.com | |
| Blueprint | BAA reported | Reported yes – automatic (third-party review) | From $0.99/session | www.trytwofold.com | |
| DeepScribe | BAA reported | Reported yes – BAA referenced in vendor terms; confirm on contract (vendor terms / third-party reviews) | Quote | www.deepscribe.ai | |
| Doximity Scribe | BAA reported | Reported yes (verify in Doximity's FAQ) | Free | support.doximity.com | |
| Heidi Health | BAA reported | Reported only on the Practice tier (~$180/user/mo) – not on Free or Clinician (third-party review) | Free plan · from $150/mo | vendortrustindex.com | |
| Mentalyc | BAA reported | Reported yes (third-party review) | $14.99–$99.99/mo | www.upheal.io | |
| Nabla | BAA reported | Reported on paid plans only – not the free tier (third-party reviews) | Quote | www.toolglade.com | |
| Sunoh.ai | BAA reported | Reported included (third-party review) | From $149/mo | voiceboxmd.com | |
| Upheal | BAA reported | Reported yes (third-party review) | Free plan · from $39/mo | www.trytwofold.com | |
| Abridge | BAA on some plans | Via enterprise contract (third-party review) | Quote | www.toolglade.com | |
| Microsoft Dragon Copilot | BAA on some plans | Via Microsoft (third-party review) | Quote | voiceboxmd.com | |
| Suki | BAA on some plans | Via contract (third-party review) | Quote | www.toolglade.com | |
| Scribeberry | BAA unverified | unverified – vendor states HIPAA and PIPEDA compliance and SOC 2 Type 2, and says it has BAAs with its cloud and AI subprocessors, but we found no statement that it signs a BAA with customers; ask before recording US patients (vendor security page) | Free plan · from $0 | scribeberry.com | |
| VoiceboxMD | BAA unverified | unverified – marketing claims HIPAA orientation; no standalone public BAA page confirmed in this check | From $49 | voiceboxmd.com |
Billing & Prior Auths (14 tools)
| Tool | Status | What our sources say (plan, terms) | Entry price | Source | Last checked |
|---|---|---|---|---|---|
| CoverMyMeds | BAA available | Yes – published BAA for portal use (vendor privacy/terms) | Free | www.covermymeds.health | |
| MedBridge Ops | BAA available | Yes – BAA included on every plan (vendor site) | From $399/mo | www.medbridgeops.com | |
| Medman prior auth agent | BAA available | Yes – BAA signed before any patient data moves (vendor pricing) | $10–$25 | agentman.ai | |
| Mentaya | BAA available | Yes – BAA with Zaya Health Inc. takes effect automatically when your account is created (vendor site) | Free · 5% per claim | mentaya.com | |
| Reimbursify | BAA available | Yes – publishes a HIPAA Business Associate Agreement for covered-entity practitioners (vendor site) | Free plan · from $59/mo | reimbursify.com | |
| Thrizer | BAA available | Yes – signed BAA for every practice (vendor site) | From $0.30 | www.thrizer.com | |
| EasyPA | BAA on some plans | On request (vendor site) | From $50/user/mo | www.easypa.ai | |
| AuthPilot | BAA unverified | unverified | From $249/mo | auth-pilot.com | |
| Chalya | BAA unverified | unverified – no public BAA page found in this check | From $999/mo | chalya.com | |
| Claim.MD | BAA unverified | unverified – vendor FAQ lists a HIPAA-compliance question, but we could not confirm BAA terms from public pages; ask the vendor before sending claims | From $30/mo | www.claim.md | |
| Myndshft | BAA unverified | unverified – platform marketed as HIPAA-oriented on Google Cloud but no public BAA page found; confirm with sales | Quote | healthaidaily.com | |
| Pabau | BAA unverified | unverified – no public BAA page found in this check | From $62/mo | pabau.com | |
| Undeny | BAA unverified | Unverified for free tools (explicitly not covered); paid agent will require signed BAAs before PHI — confirm at onboarding (vendor security page) | Free | www.undeny.ai | |
| Waystar | BAA unverified | unverified – no public BAA page located in this check; RCM vendors typically require contracted BAA—confirm with sales | Quote | healthaidaily.com |
Inbox & Email (15 tools)
| Tool | Status | What our sources say (plan, terms) | Entry price | Source | Last checked |
|---|---|---|---|---|---|
| BastionGPT | BAA available | Yes – signed BAA (vendor site) | $20–$75/user/mo | bastiongpt.com | |
| Chat Data | BAA available | Yes – BAA available to sign on Standard plan or above ($95/mo+) (vendor site) | From $18.99/mo | www.chat-data.com | |
| ChatGPT for Clinicians (OpenAI) | BAA available | Yes – individual BAA signed in ChatGPT under Settings > Agreements; solo use only (one user, no shared workspace); PHI only after the BAA is in place (OpenAI Help Center) | Free | help.openai.com | |
| ChatGPT for Healthcare / Enterprise | BAA available | Yes – only on listed eligible products; not Free/Plus/Business (OpenAI Help Center) | Quote | help.openai.com | |
| CompliantChatGPT | BAA available | Yes – standard BAA included on every plan (vendor pricing) | From $19.99/user/mo | compliantchatgpt.com | |
| Google Workspace + Gemini | BAA available | Yes on eligible Workspace plans when BAA accepted in Admin console; Gemini in Workspace covered, Gemini in Chrome excluded (vendor HIPAA help) | Quote | knowledge.workspace.google.com | |
| Hushmail for Healthcare | BAA available | Yes – signed BAA included with Hushmail for Healthcare plans (vendor site) | From $11.99/mo | www.hushmail.com | |
| iFax | BAA available | Yes – vendor's HIPAA fax page says a BAA is included; HIPAA features are on Plus and higher plans only, not the send-only Basic plan (vendor site) | From $12.49/mo | www.ifaxapp.com | |
| Lindy | BAA available | Yes – HIPAA compliance and a signed BAA on the Enterprise plan only; not on the free trial or Team plan (vendor pricing page) | From $49.99/user/mo | www.lindy.ai | |
| Medman inbox triage | BAA available | Yes – BAA signed before any patient data moves (vendor pricing) | From $225/provider/mo | agentman.ai | |
| Microsoft 365 Copilot | BAA available | Yes – Microsoft BAA via DPA for in-scope services (Microsoft Learn) | From $30/user/mo | learn.microsoft.com | |
| OhMD | BAA available | Yes – automatic BAA for every user covering texting, voice, video, forms and file sharing (vendor site) | From $300/mo | www.ohmd.com | |
| Paubox | BAA available | Yes – BAA included with all accounts / every plan (vendor pricing) | From $20/mo | www.paubox.com | |
| Claude Enterprise (Anthropic) | BAA on some plans | Only on Enterprise or eligible API; not Free/Pro/Max/Team (third-party) | Quote | bastiongpt.com | |
| Medsender | BAA unverified | unverified – vendor says its AI solutions are HIPAA compliant and SOC 2 Type II, but we found no public BAA statement; ask for one before connecting your fax line or EHR (vendor site) | Quote | www.medsender.com |
Marketing (10 tools)
| Tool | Status | What our sources say (plan, terms) | Entry price | Source | Last checked |
|---|---|---|---|---|---|
| Brighter Vision | BAA available | Yes – on HIPAA packages only: Hushmail prepares a BAA for the HIPAA Secure Package add-on (from $14.99/mo), and HIPAA forms are included on Flourish; keep PHI out of the regular site (vendor site) | From $99/mo | www.brightervision.com | |
| beehiiv | No PHI needed | N/A – vendor states not HIPAA compliant and will not sign a BAA; do not store or send PHI (vendor trust center) | Quote | security.beehiiv.com | |
| Google Business Profile | No PHI needed | N/A – public info only, never PHI | Free | scoutrival.com | |
| Google Search Console | No PHI needed | N/A – no PHI | Free | scoutrival.com | |
| Psychology Today Directory | No PHI needed | N/A – public info only | From $29.95/mo | scoutrival.com | |
| Birdeye | BAA unverified | unverified – no public BAA page found; use carefully with PHI | Quote | emitrr.com | |
| Canva | BAA unverified | unverified – no public HIPAA BAA found; use for non-PHI marketing creatives only | Free | www.canva.com | |
| Klarity Health | BAA unverified | unverified – no public BAA page found; vendor describes HIPAA-compliant chat for text visits and collects a HIPAA acknowledgment from patients at booking (vendor site / provider newsletter) | Pay per booking | klarityhealth.substack.com | |
| Podium | BAA unverified | unverified – no public BAA page found; use carefully with PHI | Quote | emitrr.com | |
| Zocdoc | BAA unverified | unverified – Zocdoc's privacy policy reportedly says it acts as a HIPAA business associate for provider services, but we could not load the page to confirm and found no public BAA; ask Zocdoc for one before connecting your EHR (vendor privacy policy, via search snapshot) | Pay per booking | www.zocdoc.com |
EHR & Practice Management (23 tools)
| Tool | Status | What our sources say (plan, terms) | Entry price | Source | Last checked |
|---|---|---|---|---|---|
| AdvancedMD | BAA available | Yes – BAA is an exhibit to vendor Terms of Service (vendor TOS PDF) | From $429/provider/mo | www.advancedmd.com | |
| Carepatron | BAA available | Yes – BAA accepted automatically at signup on all plans, including Free; HIPAA compliant, SOC 2 Type II (vendor help center) | Free plan · from $0 | help.carepatron.com | |
| CharmHealth | BAA available | Yes – terms state a BAA may be entered before use (vendor terms of service) | From $25/provider/mo | www.charmhealth.com | |
| DrChrono | BAA available | Yes – BAA included as Exhibit A to Terms; accepted via order form (vendor terms) | Quote | www.drchrono.com | |
| eClinicalWorks | BAA available | Yes – published customer HIPAA BAA (vendor PDF) | From $449/provider/mo | www.eclinicalworks.com | |
| Elation Health | BAA available | Yes – published BAA accepted at signup (vendor BAA page) | From $349/provider/mo | www.elationhealth.com | |
| Healthie | BAA available | Yes – BAA effective when account is created (vendor BAA page) | $19.99–$129.99/mo | www.gethealthie.com | |
| ICANotes | BAA available | Yes – BAA offered to customers; published BAA PDF (vendor site) | From $75/mo | www.icanotes.com | |
| Jane | BAA available | Yes – BAA available on request for US subscribers subject to HIPAA (vendor) | From $59/mo | jane.app | |
| Ona Health | BAA available | Yes – BAA incorporated into Platform Terms for every workspace (vendor terms) | From $130/practitioner | docs.ona.health | |
| Practice Better | BAA available | Yes – HIPAA BAA signed in-app on all plans, including the free Sprout plan (vendor help center) | Free plan · from $35/mo | help.practicebetter.io | |
| PracticeQ (IntakeQ) | BAA available | Yes – HIPAA compliant with BAA, listed in every plan (vendor site) | From $59.90/mo | www.practiceq.com | |
| Sessions Health | BAA available | Yes – BAA accepted automatically at signup, including trial accounts, and covers all features (vendor help center) | Free plan · from $0 | support.sessionshealth.com | |
| SimplePractice | BAA available | Yes – BAA accepted automatically at signup on all plans; HIPAA compliant and HITRUST certified (vendor support) | From $49/mo | support.simplepractice.com | |
| Tebra | BAA available | Yes – BAA incorporated into Terms of Service for covered entities (vendor BAA page) | $49–$799/provider/mo | www.tebra.com | |
| TheraNest (Ensora Mental Health) | BAA available | Yes – BAA provided to customers, including during trials; HIPAA compliant and HITRUST certified (vendor) | From $29 | experience.ensorahealth.com | |
| TherapyAppointment | BAA available | Yes – vendor executes a BAA with customers; AI Notes are covered under the same BAA (vendor FAQ) | From $10/mo | www.therapyappointment.com | |
| TherapyNotes | BAA available | Yes – BAA built into Terms of Service for covered entities (vendor support FAQ) | From $69/mo | support.therapynotes.com | |
| Canvas Medical | BAA reported | Reported yes – vendor stated to sign a standard BAA with covered entities (third-party HIPAA checker; confirm with sales) | Quote | www.keragon.com | |
| Practice Fusion | BAA reported | Reported yes – BAA available via Practice Fusion admin/account process (third-party how-to; confirm in product) | From $149/provider/mo | www.accountablehq.com | |
| athenaOne (athenahealth) | BAA unverified | unverified – privacy materials discuss PHI handling but no standalone public BAA page found in this check; confirm with account team | Quote | www.athenahealth.com | |
| Osmind | BAA unverified | unverified – no public BAA page found in this check; confirm with vendor before go-live | Quote | eureka.md | |
| Valant | BAA unverified | unverified – no standalone public BAA page found in this check; confirm with vendor | Quote | www.valant.io |
Not legal advice. This is an informational snapshot of public vendor statements and third-party reviews as of the dates shown. BAA terms change. Confirm with each vendor and your compliance advisor. See also AI tools with a BAA and the printable checklist PDF.
Frequently asked questions
What is a BAA?
A Business Associate Agreement is the contract HIPAA requires between a practice (a covered entity) and a vendor that creates, receives, stores or transmits protected health information for it. This page is educational and not legal advice.
What do the status labels mean?
“BAA available” means the vendor's own pages say a BAA is offered on the plans we checked. “BAA on some plans” means only certain tiers or contracts. “BAA reported” means third-party sources say so but we couldn't confirm it on the vendor's site. “Unverified” means we found no public BAA. “No PHI needed” is for tools meant for public information only.
Does a free plan include the BAA?
Not always. Several tools offer a BAA only on paid or higher tiers. Read the plan details in the table and get the BAA for the exact plan you buy.
Is there a printable version?
Yes. The free HIPAA-safe AI checklist PDF on our Resources page includes a BAA table. This online cheat sheet is rebuilt from our directory data every time we update it.
Disclaimer: This site covers administrative and operational workflows only. It is not clinical, legal, or compliance advice. Pricing and BAA status come from vendor sites or third-party reviews as of the date shown and can change – confirm directly with each vendor and your compliance advisor before using any tool with protected health information.