COMPLIANCE INTELLIGENCE / REQUIREMENTS BEFORE REASSURANCE
The right requirements. The evidence to decide.
Start with the rules and assurances that matter to your work. Find the published evidence, understand its limits and know what to ask before you commit.
01 / FIND THE EVIDENCE
Your requirements. A more precise shortlist.
Find published claims that discuss your framework. A matching mention can describe a capability, condition or limitation. Read the statement before drawing a conclusion.
Purpose labels are curated against exact current evidence. Workflow support does not establish supplier assurance. Unclassified mentions remain available under “All published mentions”.
Product roles and BAA labels appear only when their reviewed supporting claims are current and published. BAA availability is conditional on the supplier’s terms; it does not establish an executed agreement or compliance. Missing evidence stays unknown.
Abridge describes clinical conversation documentation for clinicians, nursing and revenue-cycle workflows. Its public BAA and privacy policy describe a business-associate relationship; product scope and customer agreements require separate review.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
A public BAA governs services under an underlying agreement. Confirm the contracted product, permitted uses and return/destruction exceptions before PHI use.
vendor asserted · Reviewed 11/2/2026
Abridge publishes a HIPAA BAA tied to services under an underlying agreement between Abridge and the covered entity. This documents a contractual framework, not an executed customer agreement or eligibility of every product and account.
Ambience describes technology for documenting and transmitting clinical information into patient records. Its privacy policy distinguishes customer-governed health data processing from general privacy practices; service-specific BAA availability remains to be confirmed.
CLINICAL DOCUMENTATION / HIPAA SCOPE
BAA availability not established
The privacy policy says customer agreements may include BAAs as applicable. A public service-specific BAA offering and execution process are not established by this source; request the proposed contract.
vendor asserted · Reviewed 11/2/2026
Ambience states that processing for healthcare-provider customers is governed by customer agreements, which may include HIPAA BAAs where applicable and required. This does not establish public BAA terms, a universal plan entitlement or an executed agreement for a buyer.
Augmedix describes ambient clinical documentation with different levels of automation and human support. Its public terms and BAA distinguish agreement versions and services defined by a statement of work.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
Use the current BAA and the terms for the applicable statement of work; the site separately lists an older BAA for agreements before June 20, 2025. Do not mix versions or assume identical scope across AX services.
vendor asserted · Reviewed 11/2/2026
Augmedix publishes a current business-associate addendum addressing HIPAA-governed PHI. Its separate index also lists an older agreement version, so a buyer must reconcile the BAA with the signed statement of work and selected service.
Blueprint describes AI documentation and practice workflows for therapists, alongside an existing EHR or within its own EHR. Its security documentation explains BAA availability and clinician approval of records.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The security page says a BAA is included at signup and a signable copy is available. It describes optional recording and clinician review; confirm the agreement and settings for the selected workflow.
vendor asserted · Reviewed 11/2/2026
Blueprint's security page says a HIPAA BAA is included at signup and a signable copy is available for records. This is documentation of a vendor process, not proof of an executed agreement for a buyer.
Braintrust describes inspecting agent traces and comparing prompts and models using datasets and automated or human scoring.
SUPPORTING AI INFRASTRUCTURE / HIPAA SCOPE
Vendor documents BAA availability
The pricing page places BAA availability on Enterprise. Confirm the covered services, hosting boundary and downstream model providers before PHI use.
vendor asserted · Reviewed 11/2/2026
Braintrust describes a hybrid deployment option with its Brainstore data plane on customer infrastructure. A deployment option alone does not establish the HIPAA contractual boundary or whether other services receive PHI.
Braintrust's pricing documentation lists a business associate agreement for HIPAA use involving PHI and states that it is available on Enterprise plans. Scope: documented plan availability, not proof of a signed agreement, coverage of every model provider, or compliance of a healthcare deployment.
Carepatron describes healthcare practice-management, documentation and administrative workflows. Its help center explains BAA acceptance at account creation and how that process relates to subscription upgrades.
CARE DELIVERY & OPERATIONS / HIPAA SCOPE
Vendor documents BAA availability
The help center says the BAA is accepted during signup, including the free plan, and no new acceptance is needed on a paid upgrade. Confirm the applicable version and third-party integration boundaries.
vendor asserted · Reviewed 11/2/2026
Carepatron's BAA help article states that account creation includes acceptance of its BAA and that moving to a paid subscription does not require a new acceptance. This is a vendor-described HIPAA contracting process, not verification of a buyer's assent or third-party service coverage.
DeepScribe describes AI medical scribing for specialty care. Its posted terms include a BAA, and its acceptable-use policy identifies the practice agreement as controlling patient-data handling.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
Posted terms contain a BAA. The practice's agreement governs PHI handling, and order-form/service scope must be confirmed. AI output requires clinical review.
vendor asserted · Reviewed 11/2/2026
DeepScribe's posted terms include a HIPAA business-associate agreement between DeepScribe and its healthcare customer. Buyers must confirm the applicable service and order form; the published text is not evidence that their own BAA has been executed.
Doxy.me describes a telehealth platform. Its current Free/Premium help documentation discusses HIPAA safeguards, BAAs and subcontractor agreements; buyers should reconcile those statements with their account and selected apps.
CARE DELIVERY & OPERATIONS / HIPAA SCOPE
Vendor documents BAA availability
Current Free/Premium help documentation says Doxy.me will sign a BAA. Confirm the account-specific agreement and separate app features; older Clinic-plan guidance should not be generalized to every current service.
vendor asserted · Reviewed 11/2/2026
Doxy.me's Free/Premium help documentation states that it will sign a BAA acknowledging its HIPAA business-associate role. This documents vendor availability; the buyer must confirm the agreement applying to the account and selected services.
Eleos describes automated documentation and care-insight workflows for community-based care. Its privacy and security documents address requested BAAs, customer responsibilities and potential de-identified-audio use.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The privacy policy says customers can request a BAA. The security page also discusses retaining de-identified audio for system improvement; do not assume a blanket no-training or immediate-deletion policy.
vendor asserted · Reviewed 11/2/2026
Eleos's privacy policy states that customers can request execution of a BAA regulating access to customer information, including HIPAA-governed PHI. This does not establish that a specific agreement has been executed or that every service is included.
Freed describes an AI scribe that turns healthcare visits into clinical documentation. Its Scribe help center explains BAA inclusion in platform terms and signed-copy requests, while its security page describes retention and de-identified-note training practices.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The Scribe help article places the BAA in Schedule A of the platform terms and offers a separate signed-copy process. Check organizational signing authority, retention and de-identified-data use.
vendor asserted · Reviewed 11/2/2026
Freed's Scribe help center states that its HIPAA BAA is included as Schedule A of its platform terms and describes requesting a separate signed copy or organization-wide agreement. Scope: Freed's documented process; GovernAtlas has not executed or legally assessed an agreement for a customer.
Heidi describes a healthcare documentation service that transcribes patient encounters and prepares customizable medical notes. Its posted clinic agreement includes HIPAA and BAA provisions; buyers should confirm the applicable plan, region and contract before sharing PHI.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The posted clinic agreement dated July 8, 2024 describes an Annexure A BAA. Confirm that this is the agreement governing the proposed plan and region; no universal plan eligibility is inferred.
vendor asserted · Reviewed 11/2/2026
Heidi's posted clinic agreement, dated July 8, 2024, describes a Business Associate Subcontractor Agreement in Annexure A and a HIPAA section addressing the business-associate role. Scope: this published agreement, not a finding that it governs every current plan, region or customer; obtain the applicable contract before PHI use.
Helicone documentation distinguishes an AI Gateway workflow from use of customer-managed provider keys. It describes tracking request costs, latency and errors; its competitor comparisons and absolute uptime or latency promises are not independently established by this documentation.
SUPPORTING AI INFRASTRUCTURE / HIPAA SCOPE
BAA availability not established
The Team plan advertises HIPAA support. This captured pricing page does not establish a BAA process or the services covered by it.
vendor asserted · Reviewed 11/2/2026
Helicone's pricing page lists SOC 2 and HIPAA compliance with the Team plan, with Enterprise inheriting Team features. Scope: vendor-advertised plan support. This source does not establish BAA execution, eligible downstream providers or a compliant healthcare configuration.
A current published claim makes a product discoverable here. Its original classification remains visible. A negative statement, a restricted feature or a qualified promise can also mention a framework: matching text is not a positive compliance assessment.
A BAA is a scoped agreement.
HHS explains that a cloud provider handling ePHI on behalf of a covered entity or business associate may itself be a business associate, even when it cannot decrypt the data. Establish the relationship, obtain the appropriate agreement and assess the safeguards for the service you intend to use.
SOC 2 is an assurance report; ISO 27001 concerns an information security management system. Neither label alone answers your HIPAA deployment question. Ask for the relevant report or certificate, its scope, date and exclusions, and evaluate what it actually covers.
The HIPAA Security Rule addresses administrative, physical and technical safeguards. Your risk analysis, workforce practices, integrations and configuration remain part of the assessment. Review before sharing PHI and when material circumstances change.
Identify who decides the purposes and who processes on instructions. Review the DPA, subprocessors, transfers, rights assistance and retention for the actual service. A vendor privacy claim or an EU hosting option leaves those questions open.
Assess the intended purpose, operator role and current applicable obligations before selecting controls. A mapping platform can help organize work; its policy pack does not establish legal applicability, a completed conformity assessment or customer compliance.
A claim starts the conversation. Evidence moves it forward.
Review the service handling protected health information, its BAA and shared responsibilities. Prepare a scoped assessment before sharing PHI.
A BAA offering is not an executed agreement or a compliance finding. These questions prepare a review; they are not an exhaustive assessment.
Answers stay in this page’s memory. Export before leaving or switching frameworks; switching clears answers. Record source links and review notes, never patient information or credentials. “Evidence received” is not a finding of compliance.
01 / Scope & responsibilityWhich exact service, edition and deployment will handle our PHI, and in what role?
Request a data-flow diagram, service schedule and responsibility matrix. Identify your covered-entity or business-associate role and each recipient before evaluating controls.
02 / The agreementWill you sign a BAA covering that service before receiving PHI?
Request the proposed BAA and the covered-service list. Check permitted uses, subcontractor obligations, incident reporting, return or destruction and termination provisions with your reviewer.
Request names, functions, processing locations and the contractual flow-down. Include model providers, logging, support and backup services; do not assume the main vendor contract covers every integration.
04 / AI & secondary useCan prompts, outputs or patient records be retained or used for model training?
Request service-specific terms and configured retention/training settings. Document permitted uses and exceptions; an enterprise promise may not apply to a consumer account or another model endpoint.
05 / Access & identityHow are access privileges approved, limited, reviewed and removed?
Request role definitions, authentication options, privileged-access controls and joiner/leaver procedures. Test access boundaries with synthetic records, including support access.
06 / Security safeguardsHow are ePHI risks assessed and safeguards maintained?
Request a current risk-analysis summary, remediation ownership, encryption/key-management design and relevant assurance scope. Compare the actual service boundary; SOC 2 or ISO documentation does not substitute for a HIPAA assessment.
07 / AuditabilityCan we investigate who accessed or changed patient information?
Request sample audit events, log retention, export options and access protections. Test whether the actions and identities your investigation needs are recorded without leaking PHI into general logs.
08 / Incidents & notificationsHow will you detect, investigate and report security incidents and breaches?
Request the response process, contractual reporting commitments, escalation contacts and a recent exercise summary. Separate incident reporting from the legal determination and notification of a breach.
09 / Continuity & recoveryHow will patient information remain available during disruption?
Request backup, restoration and contingency procedures with recovery-test evidence. Agree acceptable recovery objectives for your clinical workflow; test downtime procedures before launch.
10 / Retention, rights & exitHow can we retrieve, amend where applicable, retain and remove records?
Request export formats, assistance with applicable individual rights, deletion exceptions and backup schedules. Reconcile retention duties and contract termination with your own policies.
11 / Your deploymentWhich controls and responsibilities remain with our team?
Request an implementation checklist covering configuration, integrations, workforce training, access reviews and risk acceptance. Assign an owner and evidence date to each unresolved item.
12 / Change & re-reviewWhat triggers a new review after purchase?
Request change notices for terms, models, subprocessors, features and material incidents. Recheck scope before connecting new data or activating another service; retain dated decisions and evidence.
QUESTIONS ANSWERED
Before you shortlist.
Does GovernAtlas certify these products?
No. Discovery links published claims to their sources. Inclusion, payment and a framework mention do not establish compliance or suitability for your deployment.
What if a vendor has no matching evidence?
Our current coverage may be incomplete. Use the checklist to ask the vendor for documents and submit public sources for editorial review. An unknown result is not an adverse finding.
Can I use the checklist for a clinical AI tool?
Use it for the PHI-handling review, then separately evaluate clinical safety, intended use, human oversight and any applicable medical-device requirements. HIPAA alone does not establish clinical safety or effectiveness.
Can companies pay for a better evidence classification?
No. Public research and this checklist stay free. Company subscriptions do not change editorial gates, evidence classifications or search eligibility.
GovernAtlas editorial buying method · reviewed November 2, 2026. Primary references: HHS business associates, HHS risk analysis. The checklist is a preparation aid, not an exhaustive legal assessment.