Does Twofold sign a BAA?

Yes, it signs a BAA

Twofold signs a BAA with every account. Users agree to it automatically at signup, and the Group plan comes with an organization-wide BAA. A copy can be requested by email.

Based on 4 sources, all from Twofold Health unless marked.

Business associate
Twofold Health
Tool
Twofold
Plans with a BAA
Free trial / Personal plan (self-serve); Group plan (custom pricing)
Checked
Signs a BAA
Twofold Health signs a BAA for Twofold.

By plan

PlanBAAHow to get itConditions
Free trial / Personal plan (self-serve)Signs a BAAIncluded in the termsinfo@trytwofold.comThe help center says users agree to the BAA automatically at signup, and a solutions page says every account includes one. The security page offers a copy by email. The Personal plan is $69/month, or $49/month billed annually. The pricing article does not mention the BAA for the trial or Personal plan.[1],[2],[3]
Group plan (custom pricing)Signs a BAAThrough salesinfo@trytwofold.comThe pricing article lists an organization-wide BAA on the Group plan, which is quoted through a contact form.[4],[3]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what Twofold Health says about each one.

AI featureUnder the BAADetails
AI scribe / clinical note generationCoveredAI note generation is the core service under the account BAA. The security page says PHI is not used to train AI models, that recordings are deleted after processing, and that subprocessors handling PHI sign BAAs with Twofold. No LLM provider is named.[1],[2]

Compare Twofold

Sources

  1. Security & TrustTwofold Health, Trust center. Checked Oct 11, 2026.
  2. Business Associate Agreement (BAA)Twofold Health, Help center. Checked Oct 11, 2026.
  3. AI Scribe with BAATwofold Health, Documentation. Checked Oct 11, 2026.
  4. Twofold Health PricingTwofold Health, Help center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.