Is Spruce Health HIPAA compliant?
Spruce Health signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Spruce Health with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Spruce Health doesn't say whether the BAA covers all of its AI features.
Does Spruce Health sign a BAA?
Yes, it signs a BAA
Spruce automatically includes a BAA in its organization terms for eligible organizations, including during the free trial, at no extra cost. Its AI transcription and summarization page says a BAA is included, though the terms note that SMS, email, fax and voice fall outside Spruce's secure platform.
Not confirmed for the AI features: Spruce Health doesn’t say whether its BAA covers Automations (AI message routing and workflows). Get that in writing before using it with patient data.
- Business associate
- Spruce Health
- Tool
- Spruce Health
- Plans with a BAA
- Basic and Communicator (and 14-day trial)
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Basic and Communicator (and 14-day trial) | Signs a BAA | Included in the termsRequest page | Eligible organizations agree to the BAA through the Terms of Service for Organizations, with no separate agreement or fee, from account creation. The BAA applies only to covered entities or business associates. The terms say email, SMS, e-fax and voice are outside the platform's security and Spruce isn't liable for unauthorized access to them. Part 2 substance-use records need extra conditions.[1],[2] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Spruce Health says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| AI voicemail transcription | Covered | Available on Basic and Communicator. Spruce's AI summarization page says a BAA is included, and the help article says data is never used to train third-party models.[3],[4] |
| AI summaries and call/audio-message transcription | Covered | Communicator plan only, off by default and enabled by an admin. Spruce's AI page says a BAA is included. Transcripts are visible only to the practice team and sync to connected EHRs.[3],[4] |
| Automations (AI message routing and workflows) | Not stated | The organization terms make the customer solely responsible for the use and outcomes of Automations and disclaim Spruce's liability. No page says how the BAA applies to them.[2] |
Sources
- Your Business Associate Agreement with Spruce
- Spruce Terms of Service for Organizations
- AI Transcription & Summarization | Spruce
- AI Transcription & Summarization
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.