Short answer: Most AI scribes we list publish a BAA or say they sign one, but plan coverage, audio retention and model training terms differ. Read the BAA and the retention and training terms for the exact plan you will use before entering any PHI.
At a glance
Evidence labels: Documentation reviewed Vendor-reported Ask vendor. Every fact comes from published vendor pages, as checked 2026-10-13.
| Vendor | BAA | Which plans | Where to find it | Retention policy | Training policy |
|---|---|---|---|---|---|
| Freed | Yes Documentation reviewed | Every plan; organization-wide BAA available for larger organizations Documentation reviewed | BAA help article | Published Documentation reviewed | Published Documentation reviewed |
| Heidi Health | Yes Documentation reviewed | Privacy policy says the business associate role can apply to organization, individual self-serve and free accounts Documentation reviewed | HIPAA and BAA page | Published Documentation reviewed | Published Documentation reviewed |
| Nabla | On request Documentation reviewed | Ask vendor | Trust Center | Published Documentation reviewed | Published Vendor-reported |
| Tali AI | Ask vendor | Ask vendor | Security and privacy page | Published Vendor-reported | Ask vendor |
| Abridge | Yes Documentation reviewed | Enterprise customer agreements Documentation reviewed | BAA terms | Published Documentation reviewed | Ask vendor |
| Microsoft Dragon Copilot | See terms Documentation reviewed | Ask vendor | Privacy white paper | Published Documentation reviewed | Published Documentation reviewed |
| Suki | Yes Vendor-reported | Ask vendor | Developer security FAQ | Published Documentation reviewed | Published Documentation reviewed |
| Sunoh.ai | Yes Documentation reviewed | Listed on the $149 per user/month plan Documentation reviewed | Pricing page | Ask vendor | Ask vendor |
| PMHScribe | Yes Vendor-reported | Every plan includes a signed HIPAA BAA Vendor-reported | HIPAA page | Published Vendor-reported | Published Vendor-reported |
| Berries | Yes Documentation reviewed | Every account from sign-up Documentation reviewed | BAA | Published Vendor-reported | Published Documentation reviewed |
| DeepCura | Yes Documentation reviewed | Every account, including solo sign-ups Vendor-reported | Terms of Service and BAA | Published Documentation reviewed | Published Documentation reviewed |
| Medwriter | Yes Documentation reviewed | Listed on the Standard plan ($99/month/user) and included in Pro Documentation reviewed | BAA | Published Vendor-reported | Ask vendor |
BAA and data terms by vendor
Freed
BAA: Yes. The BAA is Schedule A of the Platform Terms and applies from sign-up; a signed copy can be requested, including during the trial Documentation reviewed
Which plans: Every plan; organization-wide BAA available for larger organizations Documentation reviewed
Audio and transcript retention: Audio deleted after processing (recoverable up to 48 hours; troubleshooting copies up to 14 days). Notes deletable anytime or auto-deleted after 30 days, plus up to 7 days in backups Documentation reviewed
Model training: Help Center: protected health information is never used for AI training. Terms allow training on your data only with consent given in Platform settings Documentation reviewed
Subprocessors: Hosted on Microsoft Azure under a BAA; vendors that may process patient information must sign BAAs Vendor-reported
Certifications: SOC 2 Type 2 Vendor-reported
Sources, as checked 2026-10-13: BAA help article, Platform Terms (Schedule A), Privacy and security, Security page
Heidi Health
BAA: Yes. "We make a BAA available to every covered entity we work with" Documentation reviewed
Which plans: Privacy policy says the business associate role can apply to organization, individual self-serve and free accounts Documentation reviewed
Audio and transcript retention: Audio deleted as soon as processing is complete unless a recording-saving feature is on. Organization auto-delete 1 to 90 days; individual subscribers keep data until they delete it Documentation reviewed
Model training: Organization and paid individual plans: no customer data or health information used to train models. Free plan: de-identified data may be used under the Terms of Service Documentation reviewed
Subprocessors: Current subprocessor list, roles and locations published in the Trust Centre Documentation reviewed
Certifications: ISO/IEC 27001:2022, ISO/IEC 42001, Cyber Essentials Plus, SOC 2 Type II Vendor-reported
Sources, as checked 2026-10-13: HIPAA and BAA page, Privacy policy (2026-09-29), Trust Centre subprocessors
Nabla
BAA: HIPAA documentation available on request in the Trust Center Documentation reviewed
Which plans: Ask vendor
Audio and transcript retention: No audio stored by default. Clinical notes kept 14 days by default, configurable by client Documentation reviewed
Model training: "No model training on your data" (EHR integration page) Vendor-reported
Subprocessors: Trust Center lists Google Cloud (hosting; US central region for US clients), Azure Speech to Text (US regions) and Front (support ticketing, no PHI) Documentation reviewed
Certifications: SOC 2 Type 2, ISO 27001, TX-RAMP Level 2 Vendor-reported
Sources, as checked 2026-10-13: Trust Center, HIPAA help article, Data retention article, EHR integration page
Tali AI
BAA: Ask vendor
Which plans: Ask vendor
Audio and transcript retention: Audio streamed in real time, no PHI stored beyond the conversation; no data left on the client after transcription Vendor-reported
Model training: Ask vendor
Subprocessors: Ask vendor
Certifications: SOC 2 Type II; states HIPAA, PIPEDA and PHIPA compliance and Quebec TGV certification Vendor-reported
Sources, as checked 2026-10-13: Security and privacy page
Abridge
BAA: Yes. Published Business Associate Agreement terms that apply alongside the customer service agreement Documentation reviewed
Which plans: Enterprise customer agreements Documentation reviewed
Audio and transcript retention: Audio, transcripts and draft notes kept per the organization's configured retention, then audio permanently deleted; early deletion of single encounters not supported Documentation reviewed
Model training: Ask vendor
Subprocessors: Ask vendor
Certifications: SOC 2 Type 1 and Type 2, TX-RAMP Vendor-reported
Sources, as checked 2026-10-13: BAA terms, Trust Center, Retention support article
Microsoft Dragon Copilot
BAA: Privacy and data protection commitments are set in the Microsoft Data Protection Addendum and Product Terms, including Dragon Copilot service terms; confirm HIPAA BAA coverage in your agreement Documentation reviewed
Which plans: Ask vendor
Audio and transcript retention: Audio, recognized text, transcripts and flowsheet values retained up to 90 days, then purged Documentation reviewed
Model training: Models trained solely on anonymized data; selected customer data is anonymized within 90 days in a research environment Documentation reviewed
Subprocessors: Disclosed in the Microsoft Health and Life Sciences subprocessor list Documentation reviewed
Certifications: SOC 1 Type II, SOC 2 Type II, C5 Type II, NEN 7510; ISO/IEC 27001 and 27701 certification pending Vendor-reported
Sources, as checked 2026-10-13: Privacy white paper, Data FAQ
Suki
BAA: Yes. "We sign Business Associate Agreements (BAA) for patient data handling with our customers" Vendor-reported
Which plans: Ask vendor
Audio and transcript retention: Developer Platform ambient sessions: audio and transcript permanently deleted after 30 days; final note kept for the contract term Documentation reviewed
Model training: Only de-identified, anonymized data used for model training Documentation reviewed
Subprocessors: Google Cloud storage and Cloudflare web application firewall named in the security FAQ Vendor-reported
Certifications: SOC 2 Type 2 (Suki homepage, "SOC2 Type 2 certified", as checked 2026-10-13) Vendor-reported; HIPAA compliant and SOC 2 Type II Vendor response to APA, July 2025, not independently verified
Sources, as checked 2026-10-13: Developer security FAQ, Privacy policy, Homepage
Sunoh.ai
BAA: Yes. "Business Associate Agreement (BAA) included" Documentation reviewed
Which plans: Listed on the $149 per user/month plan Documentation reviewed
Audio and transcript retention: Ask vendor
Model training: Ask vendor
Subprocessors: Runs on Microsoft Azure Vendor-reported
Certifications: Ask vendor
Sources, as checked 2026-10-13: Pricing page
PMHScribe
BAA: Yes. A BAA is available for every practice Vendor-reported
Which plans: Every plan includes a signed HIPAA BAA Vendor-reported
Audio and transcript retention: Does not save or store an audio recording. Notes kept until you delete them Vendor-reported
Model training: Customer data is not used to train AI models Vendor-reported
Subprocessors: Hosted on Amazon Web Services Vendor-reported
Certifications: Ask vendor
Sources, as checked 2026-10-13: HIPAA page
Berries
BAA: Yes. Every clinician who signs up is covered by the published BAA (last updated 2026-10-11), part of the Terms of Use Documentation reviewed
Which plans: Every account from sign-up Documentation reviewed
Audio and transcript retention: Session recordings not stored. Notes deletable anytime or auto-deleted after 30 days Vendor-reported
Model training: BAA: Berries will not use PHI to train AI models Documentation reviewed
Subprocessors: Subprocessor list linked from the BAA (Trust Center) Documentation reviewed
Certifications: SOC 2; states HIPAA, HITECH and PHIPA compliance Vendor-reported
Sources, as checked 2026-10-13: BAA, Security center
DeepCura
BAA: Yes. Terms of Service include the BAA; "a BAA with every customer" Documentation reviewed
Which plans: Every account, including solo sign-ups Vendor-reported
Audio and transcript retention: Audio kept by default until you delete the note, request deletion or close the account; you can turn off evidence-audio retention so recordings are not stored after transcription Documentation reviewed
Model training: PHI, audio recordings and transcripts are not used to train AI models Documentation reviewed
Subprocessors: Audio sent to third-party transcription and AI processors under BAAs Documentation reviewed
Certifications: CASA Tier 2 (App Defense Alliance); vendor states it is not SOC 2 certified, and its Trust Center lists SOC 2 as in progress Vendor-reported
Sources, as checked 2026-10-13: Terms of Service and BAA, Trust Center
Medwriter
BAA: Yes. The BAA is incorporated into the Terms of Service Documentation reviewed
Which plans: Listed on the Standard plan ($99/month/user) and included in Pro Documentation reviewed
Audio and transcript retention: Configurable data retention and deletion policies Vendor-reported
Model training: Ask vendor
Subprocessors: Ask vendor
Certifications: Ask vendor
Sources, as checked 2026-10-13: BAA, Terms of Service, Homepage and pricing
What a BAA does and does not cover
What it does. Under the HIPAA Rules, a business associate agreement sets the permitted uses and disclosures of PHI, requires the vendor to safeguard it and follow the Security Rule, requires reporting of breaches and security incidents, requires subcontractors that touch PHI to accept the same restrictions, and requires PHI to be returned or destroyed at termination where feasible.
What it does not do. A BAA does not make a tool accurate, does not by itself limit how long a vendor keeps data or whether de-identified data is used to improve models (those come from the agreement terms and the vendor's policies), and does not cover your own duties, such as patient consent to recording, state recording laws, psychotherapy-notes authorization or 42 CFR Part 2. A BAA also only helps if it covers the plan and the account you actually use.
Source: HHS, Business Associate Contracts (sample provisions), as checked 2026-10-13. This page is general information, not legal advice.
FAQ
Which AI scribes offer a HIPAA BAA?
Freed, Heidi Health, Abridge, Suki, Sunoh.ai, PMHScribe, Berries, DeepCura and Medwriter publish a BAA or state that they sign one. Nabla offers HIPAA documentation on request, and Microsoft sets its commitments in its Data Protection Addendum and Product Terms. For Tali AI, ask vendor.
Is the BAA included on free or trial plans?
Freed includes its BAA in the Platform Terms from sign-up and offers a signed copy during the trial. Heidi says the business associate role can apply to free accounts. Berries covers every clinician who signs up. For other vendors, ask vendor before entering any PHI.
Does a BAA stop a vendor from training AI on my data?
Not by itself. Training rules come from the vendor terms and policies. Heidi, Nabla, Berries, DeepCura, PMHScribe and Freed state limits on using PHI or customer data for training, while Microsoft and Suki state they train on anonymized or de-identified data.
How long do AI scribes keep audio?
It varies: Freed deletes audio after processing (up to 14 days for troubleshooting copies), Heidi deletes it when processing is complete, Nabla, PMHScribe and Berries say they do not store it, Suki deletes Developer Platform audio after 30 days, and Dragon Copilot keeps it up to 90 days. DeepCura keeps audio by default unless you turn that off.
Does signing a BAA make my practice HIPAA compliant?
No. A BAA is one required piece. You still need your own policies, patient consent where required, and a check that the BAA covers the plan you use. This is not legal advice.
Related
- Best AI scribe for psychiatry
- Best AI Scribes for Therapists
- Questions to ask before you buy
- Methodology
Sources and last checked
All vendor facts were checked on published vendor pages on 2026-10-13 and are linked in each vendor section. General information only, not legal advice. See the methodology and corrections.