Does Writer (writer.com) sign a BAA?

Only on some plans or setups

WRITER's terms bar protected health information unless the customer is on the Enterprise version and has signed a BAA with WRITER, so a BAA is available only on Enterprise. Self-serve plans may not process PHI. WRITER says it holds a HIPAA Type 1 certification, but no page says which components the BAA covers.

Based on 2 sources, all from WRITER unless marked.

Business associate
WRITER
Tool
Writer (writer.com)
Plans with a BAA
Enterprise
Checked
Some plans only
WRITER signs only for the plans listed.

By plan

PlanBAAHow to get itConditions
Self-serve / non-Enterprise plansNo BAANot offeredThe Terms of Service forbid processing or sharing protected health information unless the customer is on Enterprise and has a BAA.[1]
EnterpriseSigns a BAANot statedThe terms say the PHI ban lifts once the customer is on Enterprise and has a BAA. Enterprise is governed by a separate Platform Services Agreement. No page describes how to request the BAA.[1]

Are the AI features covered?

Vendors often sign a BAA for the core product but leave some AI features out. Here is what WRITER says about each one.

AI featureUnder the BAADetails
WRITER generative AI platform (Enterprise)EnterpriseCoveredThe terms allow PHI in the Services once Enterprise and a BAA are in place. WRITER also says outputs are not meant as medical advice without a qualified professional involved.[1]
Individual components (AI Studio, WRITER Agent, Palmyra API, integrations)EnterpriseNot statedNeither the terms nor the trust page says which products or components the BAA or the claimed HIPAA certification covers.[1],[2]

Writing assistants that offer a BAA

  • GrammarlyBAA on: Enterprise (Grammarly for Business Enterprise / Superhuman Enterprise)Some plans only

All BAA-ready alternatives to Writer (writer.com)

Sources

  1. WRITER Terms of ServiceWRITER, Legal terms. Checked Oct 11, 2026.
  2. WRITER Trust CenterWRITER, Trust center. Checked Oct 11, 2026.

A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.