Is DeepCura HIPAA compliant?
DeepCura signs a Business Associate Agreement, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use DeepCura with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies.
Does DeepCura sign a BAA?
Yes, it signs a BAA
DeepCura's Terms of Service include a Business Associate Agreement as an annex, and its scribe page says a signed BAA is included. The BAA is part of the standard terms rather than tied to a particular paid tier.
- Business associate
- DeepCura
- Tool
- DeepCura
- Plans with a BAA
- Monthly / Annual provider seat (self-serve, incl. free trial)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Monthly / Annual provider seat (self-serve, incl. free trial) | Signs a BAA | Included in the terms | The BAA (Annex I of the Terms of Service, updated September 23, 2026) is between DeepCura Inc. and any client that has entered the Terms, so it attaches on acceptance rather than by separate request. The annex names no plan tiers and does not address free-trial accounts specifically. PHI must be stored only in continental US data centers. The service is intended for healthcare providers only. For Google Workspace/Gmail integrations, the customer must hold its own BAA with Google.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what DeepCura says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| AI scribe (ambient notes, selectable LLM engine) | Covered | Audio is sent to third-party speech-to-text and AI language-model providers, which the Terms say operate under BAAs; the BAA requires written subcontractor flow-down. The scribe page lets users choose among OpenAI GPT, Anthropic Claude and Google Gemini models. The Terms say PHI is never used to train AI models.[1],[2] |
| AI Email (processes Gmail content) | Covered | The Terms say DeepCura processes email content as a business associate under the BAA, currently using Google Gemini. The customer must separately hold a Google Workspace BAA.[1] |
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.