Is CodaMetrix HIPAA compliant?
CodaMetrix signs a Business Associate Agreement, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use CodaMetrix with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies.
Does CodaMetrix sign a BAA?
Yes, it signs a BAA
CodaMetrix sells autonomous medical coding (the CMX CARE platform) to health systems. Its privacy policy says that when it processes data for a customer it commits to a mutually signed data processing agreement and/or BAA, so a BAA comes through the enterprise contract.
- Business associate
- CodaMetrix
- Tool
- CodaMetrix
- Plans with a BAA
- Health system contracts (sales-led)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Health system contracts (sales-led) | Signs a BAA | Through sales | The privacy policy (revised April 2026) says that when CodaMetrix processes data on behalf of a customer, it commits to a mutually executed data processing agreement and/or BAA and processes data under it. The 'and/or' wording means a customer should confirm the contract includes a BAA. The policy refers health-data requests back to the customer, as the controller of patient data.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what CodaMetrix says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| CMX CARE autonomous coding (CMX Automate, Amplify, Insights) | Covered | Autonomous coding from EHR data is the service CodaMetrix delivers, so it is the processing the customer agreement covers. No page checked names an LLM or model provider, or says whether customer data trains shared models.[1],[2] |
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.