HIPAA compliant AI tools: which sign a BAA, and on which plan

Who signs a BAA, and on which plan

Seven tools put the BAA in their standard terms or offer it on any plan: Freed, Nabla, Abridge, DeepScribe, Suki, Sully.ai and Zams. Six sell it only with an Enterprise contract. Four tie it to a plan or a paid add-on. Ambience, Groq and Grammarly do not say which plan.

What the BAA leaves out

• Claude. The BAA covers the HIPAA-ready services only, after the account's primary owner switches them on. Beta features, connectors and MCP servers are outside it.
• Groq. Features that are not generally available, such as beta and preview models, are outside the addendum.
• Vida. Patient data needs its designated HIPAA setup and authorization first.
• Grammarly. Its acceptable use policy forbids patient data unless you have a current BAA with Superhuman, the company's new name.
• Hume AI. Its developer docs say to ask its legal team for a BAA, while its terms of use say Hume is not a business associate. Ask which applies before you rely on either.

HIPAA on the page, no BAA named

These tools state HIPAA compliance on a badge, a security page or a trust center. On the pages our listings record, none says it signs a BAA. Some keep the documents behind a trust center request, so ask for the BAA in writing before any patient data goes in.

• Customer service and voice: Sierra, Ada, Parloa, PolyAI, Forethought, Synthflow and Voiceflow.
• Workflow and data: Gumloop, Beam AI, Pipedream and AI for Database, whose badge says "HIPAA, Enterprise Available".
• Other work: Perplexity on its enterprise plans, Spellbook and EvenUp for law firms, Aidoc for radiology and Alhena AI for online stores, whose security and trust pages returned errors when we checked.

Terms that rule patient data out

• Coldreach and Signado: the terms say the service is not built to meet industry rules such as HIPAA.
• BuildShip: its homepage lists "HIPAA Compliant", while its terms of use say the service is not tailored to comply with HIPAA.
• VeraDial: lists HIPAA among what no plan includes.
• MiniMax: with the United States as your service region, the terms forbid data covered by HIPAA.

Before patient data goes in

1. Get the BAA signed by both sides, for the product you will use. A badge or a "HIPAA compliant" line is a claim about the vendor, and it covers nothing you send.
2. Price the plan the BAA needs. At Vapi the add-on is $2,000 a month on top of usage. At Lindy, Bland AI and ElevenLabs it means an Enterprise contract.
3. Check what the BAA leaves out: beta features, connectors, other products from the same company.
4. Switch on the HIPAA setup where the vendor has one. Claude and Vida need it before patient data goes in.

How we checked

Our listings record each tool's security and compliance claims from the vendor's own pages, with the page and the date it was read. On 25 October 2026 we read the pricing, terms, privacy and trust pages of the 20 tools in table 1 again. The lists below the table come from our listing records, read between August and October 2026. HIPAA has no official certificate, so we report what each vendor states and whether it says it signs a BAA. Browse the shelf: healthcare AI agents.