AI Vendor BAA Check

Does Notable sign a BAA?

Not confirmed

No Notable page reviewed says whether Notable signs a BAA with its health-system customers. Its blog says it holds BAAs with its own partners and LLM providers, and its trust center lists HITRUST and SOC 2 but no BAA.

Based on 4 sources, all from Notable Health unless marked.

Business associate
Notable Health
Tool
Notable
Plans with a BAA
Not stated
Checked
Not confirmed
No BAA offer found on Notable Health's own pages.

By plan

PlanBAAHow to get itConditions
Health system / enterprise customers (sales-led)Not confirmedNot statedNotable sells to health systems through demo and contact requests, with no public pricing. The trust center's Legal section lists a Master Services Agreement, Privacy Policy and Cyber Insurance, but no BAA. No customer-facing BAA statement was found.[1],[2],[3]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Notable Health says about each one.

AI featureUnder the BAADetails
AI Agents / Sidekick / Flow Builder (AI platform)Not statedCustomer BAA coverage is not stated. Notable's blog says it enforces BAAs with all partners, including LLM providers such as OpenAI, and that those agreements require data to be deleted immediately after processing.[4],[2]

Clinical AI assistants that offer a BAA

  • Glass HealthBAA on: Glass Developer APISome plans only
  • OpenEvidenceBAA on: OpenEvidence accounts used by US covered entitiesSigns a BAA

All BAA-ready alternatives to Notable

Sources

  1. Notable Trust CenterNotable Health, Trust center. Checked Oct 11, 2026.
  2. AI Platform for Healthcare AutomationNotable Health, Documentation. Checked Oct 11, 2026.
  3. Notable completes SOC 2 compliance reportNotable Health, Documentation. Checked Oct 11, 2026.
  4. AI data security: What healthcare leaders need to knowNotable Health, Documentation. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.