# HIPAA compliant AI tools: which sign a BAA, and on which plan

> Source: AgentsIndex — https://agentsindex.ai/guides/hipaa-compliant-ai-tools-baa
> By: Team AgentsIndex, Editorial team
> Claims last verified: 2026-10-25
> Last updated: 2026-10-25
> Read time: 7 min read
> Covers: The short answer, Who signs a BAA, and on which plan, What the BAA leaves out, HIPAA on the page, no BAA named, Terms that rule patient data out, Before patient data goes in, How we checked

20 AI tools that say they sign a business associate agreement, the plan each needs and what it costs, from Freed's $39 a month to Vapi's $2,000 add-on.

## The short answer

A HIPAA badge on a vendor's site does not let you put patient data into its tool. A signed business associate agreement (BAA) does. We read the terms of 20 AI tools we list that say they sign one, on 25 October 2026. Only 7 of them offer it on every plan or as part of their standard terms. For the rest it takes an Enterprise contract or a paid add-on: $500 a month at Trigger.dev, $2,000 a month at Vapi, and a $499 plan at Workforce Wave.

Many more tools show HIPAA on a badge or in a trust center without saying, on the pages we read, that they sign a BAA. A few have terms that rule patient data out.

## Who signs a BAA, and on which plan

**Table 1. AI tools that say they sign a BAA, read on their own pages on 25 October 2026**

| Tool | What it does | Where the BAA comes from | Plan you need | Price of that plan |
| --- | --- | --- | --- | --- |
| [Freed](/freed-ai) | Medical scribe | Part of the terms you accept | Any plan, including the trial | From $39 a month |
| [Nabla](/nabla) | Medical scribe | In the terms, required to use it | Any plan | $119 per clinician a month |
| [Abridge](/abridge) | Medical scribe | A standard BAA, published | Any contract | Not published |
| [DeepScribe](/deepscribe) | Medical scribe | An exhibit to the terms | Any contract | Not published |
| [Suki](/suki-ai) | Medical scribe | Its terms | Any contract | Not published |
| [Sully.ai](/sully-ai) | Medical assistant agents | Every covered entity customer | Any contract | Not published |
| [Zams](/obviously-ai) | Sales and operations agents | A standard BAA on request | Not stated | From $50 per user a month |
| [Ambience Healthcare](/ambience-healthcare) | Medical scribe and coding | "As applicable", per its privacy policy | Not stated | Not published |
| [Workforce Wave](/workforcewave) | Phone and chat agents | On the plan | Platform or Enterprise | $499 a month |
| [Vida](/vida) | Phone, text and chat agents | Advanced Privacy add-on | Any plan, with the add-on | Add-on priced by sales |
| [Trigger.dev](/trigger-dev) | Developer workflows | A paid add-on | Hobby or Pro, or Enterprise | $500 a month extra |
| [Vapi](/vapi) | Voice agent platform | A compliance add-on | Any plan, with the add-on | $2,000 a month extra |
| [Bland AI](/bland-ai) | Phone agents | Enterprise contract | Enterprise | Custom |
| [ElevenLabs](/elevenlabs) | Voice and phone agents | Enterprise contract | Enterprise | Custom |
| [Deepgram](/deepgram) | Speech to text | Enterprise contract | Enterprise | Custom |
| [Lindy](/lindy-ai) | Assistant agents | Enterprise contract | Enterprise | Custom |
| [Stack AI](/stack-ai) | No-code agent builder | Enterprise contract | Enterprise | Custom |
| [Claude](/claude) | AI assistant | For its HIPAA-ready services | Enterprise, or the API | Custom |
| [Groq](/groq) | Model hosting | An addendum to your agreement | Not stated | Usage |
| [Grammarly](/grammarly) | Writing assistant | On request through sales | Not stated | Not published |

Seven tools put the BAA in their standard terms or offer it on any plan: Freed, Nabla, Abridge, DeepScribe, Suki, Sully.ai and Zams. Six sell it only with an Enterprise contract. Four tie it to a plan or a paid add-on. Ambience, Groq and Grammarly do not say which plan.

## What the BAA leaves out

- **Claude.** The BAA covers the HIPAA-ready services only, after the account's primary owner switches them on. Beta features, connectors and MCP servers are outside it.
- **Groq.** Features that are not generally available, such as beta and preview models, are outside the addendum.
- **Vida.** Patient data needs its designated HIPAA setup and authorization first.
- **Grammarly.** Its acceptable use policy forbids patient data unless you have a current BAA with Superhuman, the company's new name.
- **Hume AI.** Its developer docs say to ask its legal team for a BAA, while its terms of use say Hume is not a business associate. Ask which applies before you rely on either.

## HIPAA on the page, no BAA named

These tools state HIPAA compliance on a badge, a security page or a trust center. On the pages our listings record, none says it signs a BAA. Some keep the documents behind a trust center request, so ask for the BAA in writing before any patient data goes in.

- **Customer service and voice:** [Sierra](/sierra), [Ada](/ada), [Parloa](/parloa), [PolyAI](/polyai), [Forethought](/forethought), [Synthflow](/synthflow) and [Voiceflow](/voiceflow).
- **Workflow and data:** [Gumloop](/gumloop), [Beam AI](/beam-ai), [Pipedream](/pipedream) and [AI for Database](/aifordatabase), whose badge says "HIPAA, Enterprise Available".
- **Other work:** [Perplexity](/perplexity) on its enterprise plans, [Spellbook](/spellbook) and [EvenUp](/evenup) for law firms, [Aidoc](/aidoc) for radiology and [Alhena AI](/alhena-ai) for online stores, whose security and trust pages returned errors when we checked.

## Terms that rule patient data out

- [Coldreach](/coldreach-ai) and [Signado](/signado): the terms say the service is not built to meet industry rules such as HIPAA.
- [BuildShip](/buildship): its homepage lists "HIPAA Compliant", while its terms of use say the service is not tailored to comply with HIPAA.
- [VeraDial](/veradial): lists HIPAA among what no plan includes.
- [MiniMax](/minimax): with the United States as your service region, the terms forbid data covered by HIPAA.

## Before patient data goes in

1. **Get the BAA signed** by both sides, for the product you will use. A badge or a "HIPAA compliant" line is a claim about the vendor, and it covers nothing you send.
2. **Price the plan the BAA needs.** At Vapi the add-on is $2,000 a month on top of usage. At Lindy, Bland AI and ElevenLabs it means an Enterprise contract.
3. **Check what the BAA leaves out**: beta features, connectors, other products from the same company.
4. **Switch on the HIPAA setup** where the vendor has one. Claude and Vida need it before patient data goes in.

## How we checked

Our listings record each tool's security and compliance claims from the vendor's own pages, with the page and the date it was read. On 25 October 2026 we read the pricing, terms, privacy and trust pages of the 20 tools in table 1 again. The lists below the table come from our listing records, read between August and October 2026. HIPAA has no official certificate, so we report what each vendor states and whether it says it signs a BAA. Browse the shelf: [healthcare AI agents](/categories/healthcare-ai-agents).

## Questions buyers ask

### Is there a HIPAA certification for AI tools?

No. HIPAA has no official certificate. A vendor can pass a third-party HIPAA assessment or a SOC 2 audit, but what lets you send it patient data is a signed BAA.

### Which AI medical scribes sign a BAA?

Freed, Nabla, Abridge, DeepScribe, Suki and Sully.ai say so in their terms or trust pages. Freed includes it in the terms of every account, from $39 a month.

### Does Claude sign a BAA?

Yes, for its HIPAA-ready services on the Enterprise plan and the API. The account owner switches them on, and beta features, connectors and MCP servers are not covered.

## Sources

1. [Freed, Help center: BAA](https://help.getfreed.ai/), read 25 October 2026
2. [Nabla, Business Associate Agreement](https://www.nabla.com/docs/terms-baa), read 25 October 2026
3. [Abridge, Business Associate Agreement](https://www.abridge.com/terms/business-associate-agreement), read 25 October 2026
4. [DeepScribe, Terms](https://www.deepscribe.ai/terms), read 25 October 2026
5. [Suki, Terms of service](https://www.suki.ai/terms-of-service), read 25 October 2026
6. [Sully.ai, Trust](https://www.sully.ai/trust), read 25 October 2026
7. [Zams, Security](https://zams.com/security), read 25 October 2026
8. [Ambience Healthcare, Privacy policy](https://www.ambiencehealthcare.com/privacy), read 25 October 2026
9. [Workforce Wave, Pricing](https://www.workforcewave.com/pricing), read 25 October 2026
10. [Vida, Pricing](https://vida.io/pricing) and [FAQ](https://vida.io/faq), read 25 October 2026
11. [Trigger.dev, Pricing](https://trigger.dev/pricing), read 25 October 2026
12. [Vapi, Pricing](https://vapi.ai/pricing), read 25 October 2026
13. [Bland AI, Pricing](https://www.bland.ai/pricing), read 25 October 2026
14. [ElevenLabs, Pricing](https://elevenlabs.io/pricing), read 25 October 2026
15. [Deepgram, Pricing](https://deepgram.com/pricing), read 25 October 2026
16. [Lindy, Pricing](https://www.lindy.ai/pricing), read 25 October 2026
17. [Stack AI, Pricing](https://www.stackai.com/pricing), read 25 October 2026
18. [Claude, Pricing](https://claude.com/pricing), read 25 October 2026
19. [Groq, Customer business associate addendum](https://console.groq.com/docs/legal/customer-business-associate-addendum), read 25 October 2026
20. [Grammarly, Compliance](https://www.grammarly.com/compliance) and [Acceptable use policy](https://www.grammarly.com/acceptable-use-policy), read 25 October 2026
21. [Hume AI, Privacy](https://dev.hume.ai/docs/resources/privacy) and [Terms of use](https://www.hume.ai/terms-of-use), read 25 October 2026