How we check
Every answer on this site comes from the vendor’s own published terms, broken down by plan and by AI feature, with a link to the page it rests on and the date we last checked it.
Where the answers come from
We read each vendor’s trust center, HIPAA page, help center, legal terms and official announcements. A verdict can rest only on the vendor’s own pages. Articles by other companies can point us to the right page, but they never decide an answer. Right now the database cites 511 vendor pages across 155 tools.
When a vendor says nothing about HIPAA, we mark the tool not confirmed rather than guessing. Silence isn’t a no. But it isn’t a yes either, so don’t send protected health information until the vendor confirms in writing.
What each answer means
- Signs a BAA
- The vendor signs a BAA on every plan we list for the product.
- Some plans only
- A BAA is available only on certain plans, with a minimum number of seats, or once you turn on a specific setting such as a HIPAA mode or zero data retention. The tool page shows which.
- No BAA
- The vendor says it doesn’t sign BAAs for this product, or its terms forbid sending it health information.
- Not confirmed
- We couldn’t confirm either way from the vendor’s own pages.
Why we check AI features separately
The most common trap isn’t a vendor that refuses to sign a BAA. It’s a vendor that signs one for the core product and quietly leaves its AI features out, or switches them off once you turn on HIPAA mode. So each tool page has a second table: every AI feature the vendor addresses, and whether the BAA covers it, partly covers it, or excludes it.
A BAA is not the same as compliance
HIPAA has no certification for software. A signed BAA is the contract that lets a vendor handle protected health information for you. You still need the right plan, the vendor’s required settings, access controls, staff training and your own risk analysis. That’s why we say a vendor “signs a BAA” and never that a product “is HIPAA compliant.”
How we keep it current
- Every day, an automated check re-reads the vendor pages behind each verdict and flags any change to their HIPAA or BAA wording for review.
- Every flagged change is re-checked against the vendor’s page before a verdict changes. Nothing changes automatically.
- Each tool is scheduled for re-verification every 30 days, even if nothing was flagged. The date on each tool page shows when it was last checked.
- Every change is logged publicly on What changed, and people watching a tool get an email.
Independence
We’re not affiliated with any vendor, regulator or HHS. Vendors can pay for a clearly labeled sponsored placement, but that never changes a verdict, the order of results, or what we say about anyone’s BAA. We don’t accept payment to add, remove or reword a listing.
Found a mistake?
Vendors change their terms often. If something’s wrong or out of date, send a correction with a link to the vendor’s page. We check it and update the page if it holds up.