Is AutoNotes HIPAA compliant?
AutoNotes AI, LLC signs a Business Associate Agreement for AutoNotes, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use AutoNotes with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies.
Does AutoNotes sign a BAA?
Yes, it signs a BAA
AutoNotes is an AI documentation tool for therapists. Its trust center says it signs a BAA with every customer who puts PHI in the app, executed at signup or before PHI use, and the BAA is downloadable from the trust center.
- Business associate
- AutoNotes AI, LLC
- Tool
- AutoNotes
- Plans with a BAA
- Notes / Workspace / Practice (self-serve, per clinician); Enterprise (custom, sales-led)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Notes / Workspace / Practice (self-serve, per clinician) | Signs a BAA | Included in the termsRequest page | The trust center and help center tie the BAA to PHI use, not to a plan. The BAA lets the customer accept by ticking a box or clicking a button during onboarding, or by signature. The homepage FAQ says 'BAAs available for organizations', but the trust center says every customer using PHI gets one. Pricing runs $19 to $69 per clinician per month, with a free trial.[1],[2],[3],[4] |
| Enterprise (custom, sales-led) | Signs a BAA | Through salesRequest page | Enterprise pricing is custom and arranged through a sales inquiry. The same every-customer BAA commitment applies.[1],[4] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what AutoNotes AI, LLC says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| AI notes, Magic Edit and AI treatment planning | Covered | The trust center says AI requests may contain PHI and are processed under a BAA and DPA. It names OpenAI and Deepgram among 12 subprocessors and says PHI is minimized or de-identified before external AI use, with subprocessors barred from training on or retaining PHI. It does not say whether each AI provider has signed its own BAA. The BAA itself has no AI-specific clause.[1],[2],[3] |
Compare AutoNotes
- Supanote vs AutoNotesSupanote: signs a BAA
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.