Open data

The AI vendor HIPAA BAA dataset

The data behind this site, as files you can open in Excel, Google Sheets, R or Python: which AI tools’ vendors sign a HIPAA Business Associate Agreement, on which plans, how you get it, which AI features it covers, and the vendor pages each answer rests on.

Tools: 250
Plans: 402
AI features: 470
Source pages: 954
Last verified: Oct 13, 2026

Download the current data

Updated as we re-check vendors. The file name carries the date you downloaded it.

Tools CSV250 rows. One row per tool: its verdict, the plans with a BAA, how you get it, and counts of covered and excluded AI features.
Plans CSV402 rows. One row per plan, tier or setup, with its BAA status, route and conditions.
AI features CSV470 rows. One row per AI feature, with whether the BAA covers it.
Sources CSV954 rows. One row per vendor page a record rests on, with the date we read it and an archived copy.
Everything JSONAll four tables plus column definitions and version details in one file.

Frozen monthly versions

At the start of each month we freeze a copy of the dataset alongside that month’s report edition. Frozen versions never change, so analysis you publish can point at the exact data you used.

Version	Frozen	Files
October 2026	Oct 14, 2026	Tools Plans AI features Sources JSON

What’s in each file

The tables join on slug. Verdicts are YES, CONDITIONAL, NO or UNKNOWN; UNKNOWN means the vendor’s own pages don’t say, not that the answer is no.

Tools (tools.csv, 19 columns)

`slug`	Stable ID for the tool; its page is /tools/{slug}.
`tool`	Tool name.
`vendor`	Company that would sign the BAA.
`category`	Kind of tool (category slug).
`verdict`	YES (signs a BAA on all listed plans), CONDITIONAL (some plans or setups only), NO, or UNKNOWN (not confirmed on the vendor's pages).
`plans_listed`	Number of plans or setups recorded.
`plans_with_baa`	Plans or setups where the vendor signs a BAA (YES or CONDITIONAL), separated by semicolons.
`easiest_route`	Easiest way to get the BAA on a qualifying plan: AUTO_INCLUDED, SELF_SERVE, EMAIL_REQUEST, SALES or UNKNOWN. Empty when no plan offers one.
`self_serve_baa`	TRUE when a qualifying plan's BAA is accepted online or included in the terms (no sales call).
`free_plan_baa`	TRUE when a free plan (not a trial) is covered.
`seat_minimum`	Lowest minimum seat count across qualifying plans, if any.
`ai_features_listed`	AI features recorded for the tool.
`ai_features_covered`	AI features the vendor states are inside the BAA.
`ai_features_excluded_or_partial`	AI features fully or partly outside the BAA.
`ai_features_unstated`	AI features whose coverage the vendor doesn't state.
`confidence`	Our confidence in the record: HIGH, MEDIUM or LOW.
`official_sources`	Number of vendor-published pages the record rests on.
`last_verified`	Date the record was last checked against the vendor's pages (YYYY-MM-DD).
`url`	The tool's page on AI Vendor BAA Check, with plans, notes and sources.

Plans (plans.csv, 7 columns)

`slug`	Tool ID (joins to tools.slug).
`plan`	Plan, tier or setup name as the vendor describes it.
`baa`	YES, CONDITIONAL, NO or UNKNOWN for this plan.
`route`	How you get the BAA: AUTO_INCLUDED, SELF_SERVE, EMAIL_REQUEST, SALES, NONE or UNKNOWN.
`free_plan`	TRUE when this row includes a free plan (not a trial).
`min_seats`	Minimum seats for the BAA, if the vendor sets one.
`notes`	Conditions and context, paraphrased from the vendor's pages.

AI features (ai-features.csv, 5 columns)

`slug`	Tool ID (joins to tools.slug).
`feature`	AI feature name.
`coverage`	COVERED, EXCLUDED, PARTIAL or UNKNOWN (inside the BAA or not).
`applies_to_plans`	Plans the coverage applies to, separated by semicolons.
`notes`	Context, paraphrased from the vendor's pages.

Sources (sources.csv, 8 columns)

`slug`	Tool ID (joins to tools.slug).
`title`	Page title.
`publisher`	Who published the page.
`type`	Kind of page (trust center, legal terms, help center, official docs, press release, third party).
`official`	TRUE when the vendor published it. Verdicts rest only on official pages.
`url`	The page.
`checked_on`	Date we last read it for this record (YYYY-MM-DD).
`archived_copy`	Internet Archive copy of the page nearest that date.

How it’s built and kept current

Each verdict rests on the vendor’s own pages: trust center, HIPAA page, help center, legal terms or official docs. Third-party pages are used only to find those pages, never as the basis for a verdict.
When the vendor’s pages don’t say, the record says UNKNOWN. We don’t fill gaps from memory or guesses.
An automated monitor re-reads up to 120 vendor pages a day and flags changes for review. Each listing is due for a full re-check at least every 30 days.
Every change to a verdict is logged with its date on the change log (also as an RSS feed), including our own corrections.

Full method: How we check. Want it as an API instead? See the free API.

Terms of use

Free to use for reporting, research, teaching and compliance work, including in published articles, papers and charts.
Credit “AI Vendor BAA Check” with a link to aivendorbaacheck.com (or to the tool or report page you used).
Don’t republish the dataset in bulk as your own product. For commercial or bulk reuse, email us.
Verdicts summarize vendors’ published terms as of the dates given. They aren’t legal advice.

Cite the dataset

AI Vendor BAA Check. (n.d.). AI vendor HIPAA BAA dataset. Retrieved October 13, 2026, from https://aivendorbaacheck.com/data

Citing a frozen version? Use its edition page, for example aivendorbaacheck.com/report/2026-10. Found an error? Tell us and we’ll fix it and log the correction.