AI Vendor BAA Check

Does Heidi sign a BAA?

Yes, it signs a BAA

Heidi says it is a HIPAA business associate and offers a BAA to every covered entity it works with. Its clinic terms include a BAA annex. Heidi does not explain how a solo clinician on the Free or Clinician plan gets the BAA.

Based on 4 sources, all from Heidi Health unless marked.

Business associate
Heidi Health
Tool
Heidi
Plans with a BAA
Free / Clinician (self-serve individual plans); Teams / clinic and enterprise agreements
Checked
Signs a BAA
Heidi Health signs a BAA for Heidi.

By plan

PlanBAAHow to get itConditions
Free / Clinician (self-serve individual plans)Signs a BAANot statedHeidi's HIPAA page offers a BAA to every covered entity it works with and names no plan exceptions. Heidi does not say whether self-serve users get it in the app, by request or automatically. The pricing page does not mention BAAs.[1],[2]
Teams / clinic and enterprise agreementsSigns a BAAThrough salesThe Clinic Agreement Standard T&C commits the parties to sign a Business Associate (Subcontractor) Agreement in the form of Annexure A and says the BAA controls in any conflict. Annexure A is not published on the page. The Teams plan is 'Talk to us'.[3],[1]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Heidi Health says about each one.

AI featureUnder the BAADetails
AI scribe note generationCoveredHeidi acts as a business associate for the PHI it processes in its service. It says it does not use customer data to train its AI and saves no audio. Whether its AI subprocessors are under BAAs is unanswered: the FAQ asks the question but the answer is blank.[2],[4]

Compare Heidi

Sources

  1. Heidi PricingHeidi Health, Documentation. Checked Oct 11, 2026.
  2. Heidi HIPAA complianceHeidi Health, Documentation. Checked Oct 11, 2026.
  3. Clinic Agreement Standard T&CHeidi Health, Legal terms. Checked Oct 11, 2026.
  4. Heidi SafetyHeidi Health, Documentation. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.