COMPLIANCE INTELLIGENCE / REQUIREMENTS BEFORE REASSURANCE
The right requirements. The evidence to decide.
Start with the rules and assurances that matter to your work. Find the published evidence, understand its limits and know what to ask before you commit.
01 / FIND THE EVIDENCE
Your requirements. A more precise shortlist.
Find published claims that discuss your framework. A matching mention can describe a capability, condition or limitation. Read the statement before drawing a conclusion.
Purpose labels are curated against exact current evidence. Workflow support does not establish supplier assurance. Unclassified mentions remain available under “All published mentions”.
Product roles and BAA labels appear only when their reviewed supporting claims are current and published. BAA availability is conditional on the supplier’s terms; it does not establish an executed agreement or compliance. Missing evidence stays unknown.
Abridge describes clinical conversation documentation for clinicians, nursing and revenue-cycle workflows. Its public BAA and privacy policy describe a business-associate relationship; product scope and customer agreements require separate review.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
A public BAA governs services under an underlying agreement. Confirm the contracted product, permitted uses and return/destruction exceptions before PHI use.
vendor asserted · Reviewed 11/2/2026
Abridge publishes a HIPAA BAA tied to services under an underlying agreement between Abridge and the covered entity. This documents a contractual framework, not an executed customer agreement or eligibility of every product and account.
Ambience describes technology for documenting and transmitting clinical information into patient records. Its privacy policy distinguishes customer-governed health data processing from general privacy practices; service-specific BAA availability remains to be confirmed.
CLINICAL DOCUMENTATION / HIPAA SCOPE
BAA availability not established
The privacy policy says customer agreements may include BAAs as applicable. A public service-specific BAA offering and execution process are not established by this source; request the proposed contract.
vendor asserted · Reviewed 11/2/2026
Ambience states that processing for healthcare-provider customers is governed by customer agreements, which may include HIPAA BAAs where applicable and required. This does not establish public BAA terms, a universal plan entitlement or an executed agreement for a buyer.
Augmedix describes ambient clinical documentation with different levels of automation and human support. Its public terms and BAA distinguish agreement versions and services defined by a statement of work.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
Use the current BAA and the terms for the applicable statement of work; the site separately lists an older BAA for agreements before June 20, 2025. Do not mix versions or assume identical scope across AX services.
vendor asserted · Reviewed 11/2/2026
Augmedix publishes a current business-associate addendum addressing HIPAA-governed PHI. Its separate index also lists an older agreement version, so a buyer must reconcile the BAA with the signed statement of work and selected service.
Blueprint describes AI documentation and practice workflows for therapists, alongside an existing EHR or within its own EHR. Its security documentation explains BAA availability and clinician approval of records.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The security page says a BAA is included at signup and a signable copy is available. It describes optional recording and clinician review; confirm the agreement and settings for the selected workflow.
vendor asserted · Reviewed 11/2/2026
Blueprint's security page says a HIPAA BAA is included at signup and a signable copy is available for records. This is documentation of a vendor process, not proof of an executed agreement for a buyer.
DeepScribe describes AI medical scribing for specialty care. Its posted terms include a BAA, and its acceptable-use policy identifies the practice agreement as controlling patient-data handling.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
Posted terms contain a BAA. The practice's agreement governs PHI handling, and order-form/service scope must be confirmed. AI output requires clinical review.
vendor asserted · Reviewed 11/2/2026
DeepScribe's posted terms include a HIPAA business-associate agreement between DeepScribe and its healthcare customer. Buyers must confirm the applicable service and order form; the published text is not evidence that their own BAA has been executed.
Eleos describes automated documentation and care-insight workflows for community-based care. Its privacy and security documents address requested BAAs, customer responsibilities and potential de-identified-audio use.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The privacy policy says customers can request a BAA. The security page also discusses retaining de-identified audio for system improvement; do not assume a blanket no-training or immediate-deletion policy.
vendor asserted · Reviewed 11/2/2026
Eleos's privacy policy states that customers can request execution of a BAA regulating access to customer information, including HIPAA-governed PHI. This does not establish that a specific agreement has been executed or that every service is included.
Freed describes an AI scribe that turns healthcare visits into clinical documentation. Its Scribe help center explains BAA inclusion in platform terms and signed-copy requests, while its security page describes retention and de-identified-note training practices.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The Scribe help article places the BAA in Schedule A of the platform terms and offers a separate signed-copy process. Check organizational signing authority, retention and de-identified-data use.
vendor asserted · Reviewed 11/2/2026
Freed's Scribe help center states that its HIPAA BAA is included as Schedule A of its platform terms and describes requesting a separate signed copy or organization-wide agreement. Scope: Freed's documented process; GovernAtlas has not executed or legally assessed an agreement for a customer.
Heidi describes a healthcare documentation service that transcribes patient encounters and prepares customizable medical notes. Its posted clinic agreement includes HIPAA and BAA provisions; buyers should confirm the applicable plan, region and contract before sharing PHI.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The posted clinic agreement dated July 8, 2024 describes an Annexure A BAA. Confirm that this is the agreement governing the proposed plan and region; no universal plan eligibility is inferred.
vendor asserted · Reviewed 11/2/2026
Heidi's posted clinic agreement, dated July 8, 2024, describes a Business Associate Subcontractor Agreement in Annexure A and a HIPAA section addressing the business-associate role. Scope: this published agreement, not a finding that it governs every current plan, region or customer; obtain the applicable contract before PHI use.
Lyrebird Health describes clinical notes, documents and practice workflows. Its privacy overview discusses regional processing and a no-training commitment, while service-specific US BAA availability remains unresolved here.
CLINICAL DOCUMENTATION / HIPAA SCOPE
BAA availability not established
The privacy overview describes regional processing and US HIPAA alignment, but a service-specific BAA offering is not established in the sources reviewed. Confirm US availability, agreement and region.
vendor asserted · Reviewed 11/2/2026
Lyrebird's privacy overview describes processing within the originating region and alignment with listed regional laws including US HIPAA. The page does not establish the buyer's US service availability, BAA terms or configured data boundary.
Mentalyc describes AI note taking, treatment planning and progress workflows for therapists. Its security page addresses BAA creation at signup and states that sessions are not used to train AI.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
The security page says a BAA is created at signup and describes session-data training and retention protections. Confirm the governing document and service settings before patient-data use.
vendor asserted · Reviewed 11/2/2026
Mentalyc's security page states that a HIPAA BAA is created at signup. This documents a vendor-described account process; it does not verify a particular organization's authorized acceptance or coverage of external integrations.
Microsoft describes Dragon Copilot as an AI assistant for drafting clinical documentation. Its documentation discusses HIPAA support, up-to-90-day retention for specified data and de-identification or pseudonymization for model improvement.
CLINICAL DOCUMENTATION / HIPAA SCOPE
BAA availability not established
Microsoft documents HIPAA-supporting environments, retention and model-improvement data handling. The sources reviewed here do not establish the buyer's applicable BAA; confirm Dragon-specific licensing and contractual coverage.
vendor asserted · Reviewed 11/2/2026
Microsoft's Dragon Copilot FAQ says its environments are built to support HIPAA and other listed privacy standards, and that specified audio, recognized text, transcript and flowsheet data may be retained for up to 90 days. These are vendor-documented practices, not a deletion test.
Nabla describes clinical AI for healthcare documentation, dictation and coding workflows. Its posted terms address human review, HIPAA-covered use and an Appendix I BAA; contractual applicability and clinical suitability require separate review.
CLINICAL DOCUMENTATION / HIPAA SCOPE
Vendor documents BAA availability
Posted terms include an Appendix I BAA for HIPAA-covered use. They also discuss de-identified data use and require human review of outputs; confirm the applicable regional agreement.
vendor asserted · Reviewed 11/2/2026
Nabla's posted terms require human review of generated outputs and assign customers responsibility for validating appropriateness before clinical use, billing or claims submission. HIPAA-related contract language does not establish output accuracy or clinical safety.
Nabla's posted terms include a HIPAA section requiring covered-entity or business-associate customers using the services with PHI to comply with the Appendix I BAA at account creation. Scope: this posted contractual provision; the applicable regional agreement, service edition and an individual customer's acceptance are not verified.
A current published claim makes a product discoverable here. Its original classification remains visible. A negative statement, a restricted feature or a qualified promise can also mention a framework: matching text is not a positive compliance assessment.
A BAA is a scoped agreement.
HHS explains that a cloud provider handling ePHI on behalf of a covered entity or business associate may itself be a business associate, even when it cannot decrypt the data. Establish the relationship, obtain the appropriate agreement and assess the safeguards for the service you intend to use.
SOC 2 is an assurance report; ISO 27001 concerns an information security management system. Neither label alone answers your HIPAA deployment question. Ask for the relevant report or certificate, its scope, date and exclusions, and evaluate what it actually covers.
The HIPAA Security Rule addresses administrative, physical and technical safeguards. Your risk analysis, workforce practices, integrations and configuration remain part of the assessment. Review before sharing PHI and when material circumstances change.
Identify who decides the purposes and who processes on instructions. Review the DPA, subprocessors, transfers, rights assistance and retention for the actual service. A vendor privacy claim or an EU hosting option leaves those questions open.
Assess the intended purpose, operator role and current applicable obligations before selecting controls. A mapping platform can help organize work; its policy pack does not establish legal applicability, a completed conformity assessment or customer compliance.
A claim starts the conversation. Evidence moves it forward.
Review the service handling protected health information, its BAA and shared responsibilities. Prepare a scoped assessment before sharing PHI.
A BAA offering is not an executed agreement or a compliance finding. These questions prepare a review; they are not an exhaustive assessment.
Answers stay in this page’s memory. Export before leaving or switching frameworks; switching clears answers. Record source links and review notes, never patient information or credentials. “Evidence received” is not a finding of compliance.
01 / Scope & responsibilityWhich exact service, edition and deployment will handle our PHI, and in what role?
Request a data-flow diagram, service schedule and responsibility matrix. Identify your covered-entity or business-associate role and each recipient before evaluating controls.
02 / The agreementWill you sign a BAA covering that service before receiving PHI?
Request the proposed BAA and the covered-service list. Check permitted uses, subcontractor obligations, incident reporting, return or destruction and termination provisions with your reviewer.
Request names, functions, processing locations and the contractual flow-down. Include model providers, logging, support and backup services; do not assume the main vendor contract covers every integration.
04 / AI & secondary useCan prompts, outputs or patient records be retained or used for model training?
Request service-specific terms and configured retention/training settings. Document permitted uses and exceptions; an enterprise promise may not apply to a consumer account or another model endpoint.
05 / Access & identityHow are access privileges approved, limited, reviewed and removed?
Request role definitions, authentication options, privileged-access controls and joiner/leaver procedures. Test access boundaries with synthetic records, including support access.
06 / Security safeguardsHow are ePHI risks assessed and safeguards maintained?
Request a current risk-analysis summary, remediation ownership, encryption/key-management design and relevant assurance scope. Compare the actual service boundary; SOC 2 or ISO documentation does not substitute for a HIPAA assessment.
07 / AuditabilityCan we investigate who accessed or changed patient information?
Request sample audit events, log retention, export options and access protections. Test whether the actions and identities your investigation needs are recorded without leaking PHI into general logs.
08 / Incidents & notificationsHow will you detect, investigate and report security incidents and breaches?
Request the response process, contractual reporting commitments, escalation contacts and a recent exercise summary. Separate incident reporting from the legal determination and notification of a breach.
09 / Continuity & recoveryHow will patient information remain available during disruption?
Request backup, restoration and contingency procedures with recovery-test evidence. Agree acceptable recovery objectives for your clinical workflow; test downtime procedures before launch.
10 / Retention, rights & exitHow can we retrieve, amend where applicable, retain and remove records?
Request export formats, assistance with applicable individual rights, deletion exceptions and backup schedules. Reconcile retention duties and contract termination with your own policies.
11 / Your deploymentWhich controls and responsibilities remain with our team?
Request an implementation checklist covering configuration, integrations, workforce training, access reviews and risk acceptance. Assign an owner and evidence date to each unresolved item.
12 / Change & re-reviewWhat triggers a new review after purchase?
Request change notices for terms, models, subprocessors, features and material incidents. Recheck scope before connecting new data or activating another service; retain dated decisions and evidence.
QUESTIONS ANSWERED
Before you shortlist.
Does GovernAtlas certify these products?
No. Discovery links published claims to their sources. Inclusion, payment and a framework mention do not establish compliance or suitability for your deployment.
What if a vendor has no matching evidence?
Our current coverage may be incomplete. Use the checklist to ask the vendor for documents and submit public sources for editorial review. An unknown result is not an adverse finding.
Can I use the checklist for a clinical AI tool?
Use it for the PHI-handling review, then separately evaluate clinical safety, intended use, human oversight and any applicable medical-device requirements. HIPAA alone does not establish clinical safety or effectiveness.
Can companies pay for a better evidence classification?
No. Public research and this checklist stay free. Company subscriptions do not change editorial gates, evidence classifications or search eligibility.
GovernAtlas editorial buying method · reviewed November 2, 2026. Primary references: HHS business associates, HHS risk analysis. The checklist is a preparation aid, not an exhaustive legal assessment.