Is an AI Scribe HIPAA Compliant?
Short answer: an AI scribe is HIPAA compliant for your practice only when the vendor signs a Business Associate Agreement (BAA) and handles patient data correctly. SOAPNoteAI signs a BAA and is HIPAA compliant—so you can use it with real notes, not just demos.
Signed BAA. Encryption in transit and at rest. First 20 notes free, no credit card.
HIPAA Compliance Is Not a Checkbox
No software is “HIPAA compliant” all by itself. Compliance is a property of how a vendor handles your patients’ data—and the agreement you have with them. For an AI scribe, four things have to be true.
1. A signed Business Associate Agreement
The vendor signs a BAA, taking on legal responsibility for the PHI it processes for you. Without this, nothing else matters—using the tool for patient data would itself be a violation.
2. Encryption in transit and at rest
Your audio, transcripts, and finished notes are encrypted while moving over the network and while stored. SOAPNoteAI uses industry-standard encryption in both states.
3. Access controls
Only authorized people and systems can reach the data. PHI should never be sitting in the open, in logs, or in an analytics tool where it does not belong.
4. No model training on your PHI
A HIPAA-serious scribe does not quietly use your sessions or notes to train AI models. Your clinical data is used to generate your note—nothing more.
If a tool can’t confirm all four in writing, it is not ready for real patient notes—no matter how good the demo looks.
What a BAA Is, and Why It Matters
The Business Associate Agreement is the single most important thing to check—and the easiest to skip.
A Business Associate Agreement is the HIPAA-required contract between your practice (the covered entity) and any vendor that touches protected health information on your behalf. It makes that vendor legally accountable for safeguarding the data. In plain terms: it is the paperwork that turns “we promise we’re careful” into an enforceable obligation.
This is why general-purpose tools are risky for clinical notes. A consumer voice recorder, a note-taking app, or a public chatbot will not sign a BAA for your practice—so feeding real patient information into them is a compliance problem before you even consider how the data is stored. It’s not about whether the tool is “good”; it’s about whether anyone has agreed, on paper, to be responsible for the PHI.
SOAPNoteAI signs a BAA. That is the baseline that lets a solo therapist, an NP, or a group practice use it for real documentation rather than test data.
How SOAPNoteAI Protects Your Data
Only the facts—here is what SOAPNoteAI actually does with the information you put in.
A signed BAA
SOAPNoteAI signs a Business Associate Agreement, so the vendor relationship itself is HIPAA-appropriate.
Industry-standard encryption
Your audio, transcripts, and notes are encrypted in transit and at rest.
Access controls
Access to your data is restricted—it is not exposed in analytics, error messages, or to people who have no reason to see it.
Dictation without recording
You can skip recording the session entirely and instead dictate a short recap afterward. The AI builds the SOAP note from that. For sensitive visits, the safest recording is the one you never make.
Your notes are yours
SOAPNoteAI does not train AI models on your sessions or notes. The data is used to produce your documentation, and that is it.
Works with your existing EHR
There is no migration and no new system of record. SOAPNoteAI generates the note; you keep charting where you already do—including a 1-click sync into a SimplePractice appointment via the Chrome extension.
See how the SimplePractice sync works on the AI scribe for SimplePractice page, or compare SOAPNoteAI to other scribes on the comparison hub.
A HIPAA Checklist for Evaluating Any AI Scribe
Copy this and ask any vendor—including us—before you send real patient data. If the answer to the first question is no, you can stop there.
Will you sign a Business Associate Agreement (BAA)?
The dealbreaker. No BAA means the tool cannot lawfully handle your patients’ PHI.
Is data encrypted in transit and at rest?
Both states matter—moving over the network and sitting in storage.
Do you train AI models on my data?
You want a clear no. Your sessions should not become training material.
Who can access my data, and how is access controlled?
Least-privilege access and no PHI leaking into logs or analytics.
What is retained, and can I delete it?
Know the retention window and how deletion works for your account.
Is it appropriate for behavioral health notes?
Sensitive settings benefit from privacy options like dictation without recording.
SOAPNoteAI answers yes to the BAA, encryption, access-control, no-training, and behavioral-health questions above—and will put the retention specifics in writing before you sign.
Compliance Is Not the Same as Consent
A signed BAA covers your relationship with the vendor. It does not, by itself, cover how you inform patients about the way their visit is documented—especially if you record. Those are two separate responsibilities, and it’s easy to conflate them.
We keep the practical, step-by-step patient-consent walkthrough on its own page so this one can stay focused on vendor compliance. For consent language you can adapt to your setting, read the AI scribe patient consent guide. And if you’d rather not record at all, dictation mode lets you document from a spoken recap instead of a session recording.
Want the broader HIPAA and data-handling FAQ across the whole product? It lives on the AI note assistant overview.
Compliant Documentation, Without the Enterprise Price
A signed BAA usually reads as “call sales.” SOAPNoteAI starts at $29/mo (Lite, 30 audio notes) or $200/yr, with a Standard tier at $69/mo for unlimited audio notes and a Pro tier at $79/mo that adds typed/shorthand text input. Prefer to pay as you go? One-time note packs start at $59—no subscription. Every plan includes the HIPAA-compliant handling and BAA described above, and your first 20 notes are free with no credit card.
Create Your SOAP Note in 2 Minutes
Start with 20 free SOAP notes. No credit card required.
Plans from $29/mo · HIPAA-compliant with signed BAA · 1-click sync to SimplePractice
Frequently Asked Questions
An AI scribe is HIPAA compliant for your practice only when the vendor signs a Business Associate Agreement (BAA) and handles protected health information (PHI) correctly—encryption in transit and at rest, access controls, and a commitment not to train models on your data. No tool is 'HIPAA compliant' on its own; compliance is a property of how the vendor operates plus the agreement you have in place. SOAPNoteAI signs a BAA and is HIPAA compliant, which is what makes it appropriate to use with real patient notes.
Yes. SOAPNoteAI signs a Business Associate Agreement. A BAA is the HIPAA-required contract that makes a vendor legally accountable for the PHI it handles on your behalf. Without a signed BAA, using any third-party tool for patient data is itself a HIPAA problem—so a BAA is the first thing to confirm before you put real notes into any AI scribe.
No. SOAPNoteAI does not use your sessions or notes to train AI models. Your notes are yours. This 'no-training' commitment is one of the core things to verify with any AI scribe, because a tool that quietly trains on your inputs is handling PHI in a way most practices are not comfortable with.
It can be, provided the same conditions are met: a signed BAA, encryption, access controls, and no model training on your data. Behavioral health notes are especially sensitive, so a privacy-forward option matters. SOAPNoteAI offers a dictation mode—you dictate a short recap afterward instead of recording the session—so you can produce a structured SOAP, DAP, or BIRP note without ever recording the client.
A signed BAA covers the vendor relationship, but it does not replace informing your patients about how their visit is documented. Consent practices depend on your setting, your state, and whether you record. We keep a practical, step-by-step patient-consent guide separate from this page—see the AI scribe patient consent guide for language you can adapt. If you prefer not to record at all, dictation mode lets you skip session recording entirely.
Your notes belong to you and are protected with industry-standard encryption in transit and at rest, under a signed BAA, with access controls limiting who can reach the data. If you use dictation mode, there is no session recording to store in the first place. For specifics on retention and deletion for your account, ask us directly before you sign your BAA—any serious AI scribe should be able to answer that in writing.
This page explains how SOAPNoteAI approaches HIPAA compliance and is provided for general informational purposes—it is not legal advice. Your obligations depend on your practice, your state, and your specific setting; consult qualified counsel for your own compliance decisions. Pricing and features are accurate as of July 2026 and may change.