Is Corti HIPAA compliant?
Corti signs a Business Associate Agreement, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Corti with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies.
Does Corti sign a BAA?
Yes, it signs a BAA
Corti's help center says it signs BAAs with U.S. customers, who can choose to have data processed in Corti's U.S. Azure environment. Corti does not publish which plans or self-serve API accounts get a BAA or how to request one.
- Business associate
- Corti
- Tool
- Corti
- Plans with a BAA
- U.S. customers (Corti Assistant, API, enterprise)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| U.S. customers (Corti Assistant, API, enterprise) | Signs a BAA | Not stated | Corti's Compliance FAQ (February 25, 2026) says it signs BAAs and complies with HIPAA for U.S. customers, and its HIPAA article says BAAs are executed with all customers and applicable third parties. Data is processed on Microsoft Azure in the EU or U.S.; U.S. customers may opt for U.S.-only processing. Corti does not say whether self-serve pay-as-you-go API accounts (with $50 free credits) get a BAA automatically or must request one. The website terms cover the website only; API and platform use falls under separate Master Terms of Service that were not reviewed.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Corti says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Ambient documentation, speech-to-text, coding and text-generation models | Covered | Corti says it builds its own healthcare models, starting from open-source models it refines, and runs them in its own Azure-hosted infrastructure, so AI processing is not described as going to an outside LLM vendor. Customer data is not used for training by default; training use requires explicit agreement in the DPA or contract.[1],[4] |
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.