Is Elation Note Assist HIPAA compliant?
Elation Health, Inc. signs a Business Associate Agreement for Elation Note Assist, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Elation Note Assist with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies.
Does Elation Note Assist sign a BAA?
Yes, it signs a BAA
Elation publishes a click-through BAA that is part of its service agreement, and that agreement's definition of the service includes its AI features. Elation says its third-party AI providers (Anthropic, OpenAI, Google, Amazon) don't keep or train on customer data.
- Business associate
- Elation Health, Inc.
- Tool
- Elation Note Assist
- Plans with a BAA
- Elation EHR subscription (Note Assist free allowance or unlimited add-on)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Elation EHR subscription (Note Assist free allowance or unlimited add-on) | Signs a BAA | Included in the termsRequest page | Elation's BAA names Elation as business associate and takes effect when the customer clicks 'I agree'. The service agreement makes the BAA an integral part of the contract and applies it to customer content that is PHI. Each subscription includes 10 Note Assist notes a month, and unlimited use is a per-provider subscription. The BAA lets Elation use de-identified data for any purpose.[1],[2],[3] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Elation Health, Inc. says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Note Assist (ambient AI scribe) and other AI services | Covered | The service agreement defines the service to include AI Services, and customer content, including AI inputs, that is PHI falls under the BAA. Elation says its AI providers process inputs under enterprise licenses without logging, retention or model training. Audio is erased once transcribed, and transcripts are archived 14 days after the note is signed (up to 60 days if a support case is open).[2],[3],[4],[5] |
Sources
- Business Associate Agreement
- Service Agreement
- Note Assist Guide - Frequently Asked Questions
- AI Data Use Policy
- Elation Third-Party AI Providers
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.