Heidi vs Nabla: which signs a HIPAA BAA?
Both can be covered by a BAA, on different terms. Heidi Health signs a BAA for Heidi on every plan we list. Nabla signs a BAA on every plan we list.
- Business associate
- Heidi Health
- Tool
- Heidi
- Plans with a BAA
- Free / Clinician (self-serve individual plans); Teams / clinic and enterprise agreements
- Checked
Signs a BAA
- Business associate
- Nabla
- Tool
- Nabla
- Plans with a BAA
- Individual clinician accounts (self-serve sign-up, US); Health organizations (license contract)
- Checked
Signs a BAA
Side by side
| HeidiHeidi Health | NablaNabla | |
|---|---|---|
| BAA | Signs a BAA | Signs a BAA |
| Plans with a BAA | Free / Clinician (self-serve individual plans); Teams / clinic and enterprise agreements | Individual clinician accounts (self-serve sign-up, US); Health organizations (license contract) |
| How to get it | Through sales | Included in the terms; Through sales |
| AI features outside the BAA | None listed | None listed |
| Sources | 4 sources | 4 sources |
| Last checked | Oct 11, 2026 | Oct 11, 2026 |
Every plan
Heidi
- Free / Clinician (self-serve individual plans)Heidi's HIPAA page offers a BAA to every covered entity it works with and names no plan exceptions. Heidi does not say whether self-serve users get it in the app, by request or automatically. The pricing page does not mention BAAs.Signs a BAA
- Teams / clinic and enterprise agreementsThe Clinic Agreement Standard T&C commits the parties to sign a Business Associate (Subcontractor) Agreement in the form of Annexure A and says the BAA controls in any conflict. Annexure A is not published on the page. The Teams plan is 'Talk to us'.Signs a BAA
Nabla
- Individual clinician accounts (self-serve sign-up, US)Section 9 of the US Terms applies the Appendix I BAA from account creation when the user is a HIPAA covered entity or business associate and will use PHI. The wording covers accounts opened 'for yourself or your organization'. The precedence clauses conflict: the Terms say the Agreement prevails, while the BAA says the BAA prevails.Signs a BAA
- Health organizations (license contract)Nabla publishes a standalone BAA that forms part of the client's license and maintenance contract. It is governed by French law and pre-authorizes Google as the hosting subcontractor.Signs a BAA
If you handle patient data
Either can work. Choose on features and price, then make sure you’re on a plan listed above and the BAA is signed before anyone enters protected health information.
More comparisons
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.