Table of Contents
The Claim Is Not the Compliance
Start with the fact that reframes every vendor page you will read: HIPAA does not certify software. There is no such thing as a "HIPAA certified" AI scribe, only vendors who will sign a Business Associate Agreement and implement the required safeguards, and vendors who will not. For a typical practice, you are the covered entity and the vendor acts as your business associate, with direct HIPAA obligations of its own. The engagement, the BAA, and the risk analysis are still yours to own.
That is why "HIPAA compliant" on a homepage is the beginning of your evaluation, not the end. The phrase is marketing language, not a certification, and it is not consequence-free: the FTC explicitly warns companies not to make false or misleading claims that they are "HIPAA Compliant," "HIPAA Secure," or "HIPAA Certified." Until a signed BAA and verifiable data practices sit behind the claim, it is a starting point for your own verification. We covered the same trap for general tools in is ChatGPT HIPAA compliant and is Otter.ai HIPAA compliant; the ambient scribe category deserves the same scrutiny because it touches the most sensitive conversations in your building.
The BAA Verification Test
Before any patient conversation touches an AI note taker, get written answers to four things:
- Will you sign a BAA, at my tier? Not "are you HIPAA compliant." Some vendors sign only on enterprise plans; some make it self-serve. If the BAA is not available on the plan you are buying, that plan does not exist for you.
- Is audio or transcript data used for model training, and can we opt out in writing? "De-identified training data" still deserves a written answer, because de-identification standards vary.
- What is stored, where, and for how long? The strongest scribe postures minimize retention. Freed, for example, states that recordings are temporarily saved until note summaries and quality checks complete and are then automatically deleted, with notes deletable manually or on a 30-day timer. Whatever the answer, it belongs in your risk analysis.
- What happens on termination and breach? Export path for your notes, deletion timeline for their copies, and notification obligations. The BAA governs this; read those clauses, not just the signature line.
A vendor that answers all four in writing is evaluable. A vendor that answers with a security-page link is telling you something too.
One more item that belongs in the workflow design rather than the vendor evaluation: recording consent. Consent requirements for recording clinical conversations vary by state, and patient comfort varies more. The practices that adopt scribes smoothly build the consent moment into the visit script, document it, and give patients a real opt-out that falls back to manual notes. That is your policy work, not the vendor's, and it should exist before the first recorded visit. Behavioral health deserves extra care here: session content is the most sensitive PHI a practice holds, and the consent conversation is part of the therapeutic relationship, not paperwork.
Six AI Note Takers and Scribes Worth Evaluating
Freed targets independent clinics and solo practitioners: recordings become clinical notes, with coding assistance layered on. It publishes its posture in unusual detail: recordings are temporarily saved until note generation and quality checks finish, then automatically deleted, and it states plainly that it signs BAAs with healthcare organizations. Pricing is public from $39 per month. That combination of published terms and published pricing makes a small-practice evaluation unusually straightforward.
Abridge plays at the opposite end: generative clinical documentation deployed across 300+ health systems, built for enterprise rollouts alongside revenue cycle and nursing workflows. Its homepage leads with scale; security and compliance detail lives in its product materials and the procurement process its health-system buyers run anyway.
Suki is an AI assistant for clinicians with named integrations into Epic, Oracle Health, athenahealth, and MEDITECH, stating "HIPAA compliant" and "SOC2 Type 2 certified" publicly. The EHR list is the differentiator: if deep in-workflow EHR integration is the requirement, Suki shortlists itself. Pricing is sales-led.
Nabla publishes the broadest homepage compliance stack of the six: "HIPAA | SOC 2 TYPE II | ISO 27001 | GDPR," positioned as enterprise-grade ambient documentation for health systems and clinicians. The GDPR line matters for organizations with any European footprint. Pricing is sales-led.
DeepScribe goes deep on specialty rather than breadth: oncology first (with OncoEMR and iKnowMed integrations alongside Epic), extending into cardiology, gastroenterology, neurology, orthopedics, and urology. It cites HIPAA and SOC 2 posture. For specialty practices whose documentation has its own shape, a vendor trained on that specialty is the reasonable starting bet. Pricing is demo-gated.
Mentalyc is the behavioral-health specialist of the group: progress notes, treatment plans, and session insights for therapists, counselors, psychiatrists, and social workers. It is also the most transparent vendor on this list about the thing this article is about: "fully HIPAA-compliant and SOC 2 Type II certified," with a signed BAA downloadable directly from account settings, and published pricing from $14.99 per month billed annually ($19.99 month to month). That is what verifiable looks like at the self-serve tier.
What They Cost
The pattern splits by buyer. Self-serve tools for small practices publish pricing: Mentalyc from $14.99 per month billed annually ($19.99 month to month) and Freed from $39 per month at its entry tier. Enterprise ambient platforms (Abridge, Suki, Nabla, DeepScribe) price through sales, shaped by seat count and EHR integration scope.
The unpublished line item on every path is your own compliance work: updating your risk analysis, documenting the BAA, and training staff on the new workflow. A scribe that meaningfully cuts daily documentation time pays for that work quickly, but it is work, and it belongs in the plan. Our HIPAA compliant AI for medical practices guide covers what that implementation actually involves.
The Questions That Separate the Category
Past the verification test, three evaluation questions separate the category:
- Where do the notes land? A scribe that produces text in its own portal creates a copy-paste workflow and a second PHI store. A scribe that writes into your EHR through a real integration removes both. This single question explains most of the price spread between the self-serve and enterprise tiers.
- How does it fail? Ambient capture in a noisy exam room, accents, interruptions, multi-party visits. Ask for the correction workflow, because a clinician stuck editing a steady stream of notes is the hidden cost that kills adoption.
- Who reviews output quality over time? Model updates change output. A vendor with a documented evaluation process is safer than one shipping silent updates into your charts.
When a Note Taker Is Not Enough
A scribe automates one conversation type: the visit. The documentation burden around it usually has more moving parts: intake packets, referral processing, prior authorization documentation, records requests, and the reconciliation between what the scribe wrote and what billing needs. Point tools do not chain those together.
That surrounding workflow is custom territory: HIPAA compliant AI systems built around your EHR, your document types, and your logging and traceability requirements, operated as a managed service. The scribes on this list handle the exam room; the builds handle the paperwork pipeline around it, and the two coexist cleanly. For the wider vendor map beyond scribes, our healthcare AI companies guide covers the production-grade field.
If your practice is weighing a scribe as the first AI step, the free 30-minute AI Strategy Call is a fast way to check whether the bigger win is the visit note or the workflow around it. When the workflow is the answer, the $999 Current State Assessment maps it and hands you a proposed build with pricing.
FAQs
Is there a HIPAA certified AI note taker? No, because HIPAA certification does not exist for software. Vendors can sign BAAs and implement required safeguards; your practice remains the responsible covered entity. Treat every "HIPAA certified" claim as a prompt to run the BAA verification test.
Which AI scribes will sign a BAA? Verify at your tier before buying, because BAA availability varies by plan. Freed states it signs BAAs with healthcare organizations, Mentalyc makes a signed BAA downloadable from account settings, and the enterprise platforms publish business associate terms or incorporate them into their customer agreements. Get written confirmation that a BAA applies to the specific plan you are buying.
How much does a HIPAA compliant AI scribe cost? Entry points at review time: Mentalyc from $14.99 per month billed annually and Freed from $39 per month. Enterprise ambient platforms price through sales based on seats and EHR integration depth, and the budget line every path shares is your own compliance and rollout work.
Are AI note takers safe for therapy sessions? The behavioral-health tools built for it (Mentalyc is the clearest example) address the specific sensitivity of session content with BAAs and published compliance postures. The same verification test applies, with extra weight on data retention and training-use questions given the nature of the content.
Do AI scribes integrate with Epic and other EHRs? The enterprise tier does: Suki names Epic, Oracle Health, athenahealth, and MEDITECH; DeepScribe integrates with Epic plus specialty systems like OncoEMR. Self-serve tools more often produce notes you transfer yourself, which is a workflow and compliance difference worth pricing.
What if our documentation problem is bigger than visit notes? Then a scribe is one piece, not the answer. Intake, referrals, prior auth, and records workflows are custom automation territory, built HIPAA-ready around your EHR. That is the lane we build and operate in.
---
Sources
- Mentalyc, "Pricing". Publicly states it is "fully HIPAA-compliant and SOC 2 Type II certified," offers a signed BAA downloadable from account settings, and publishes pricing from $14.99 per month billed annually ($19.99 monthly).
- Freed, "Security". States that audio recordings are "temporarily saved in a secure and HIPAA-compliant manner until note summaries and quality checks are complete" and then automatically deleted, and that Freed signs BAAs with healthcare organizations. Pricing published from $39 per month.
- Federal Trade Commission, "Collecting, Using, or Sharing Consumer Health Information?". Warns companies not to make false or misleading claims that they are "HIPAA Compliant," "HIPAA Secure," "HIPAA Certified" or the like.
- Nabla. Publishes the compliance stack "HIPAA | SOC 2 TYPE II | ISO 27001 | GDPR" for its ambient clinical documentation platform.