Skip to content
TherapyScribes

HIPAA-compliant AI therapy scribes

Clinicians in US behavioral-health settings need a BAA before any PHI touches an ambient scribe. This page ranks the vendors whose HIPAA posture we've verified.

Verified Re-verified quarterly
Reviewed by TherapyScribes EditorialFacts verified Methodology

Key takeaways

  • A signed BAA is table stakes — no BAA means the vendor cannot lawfully process PHI.
  • Ask specifically whether audio is retained after note generation; most reputable vendors default to deletion.
  • Independent SOC 2 Type II attestation is a stronger signal than self-reported HIPAA compliance.
  • SUD programs need 42 CFR Part 2 handling written into the DPA, not just HIPAA.

Ranked shortlist

  1. #1
    9.3/10
    Twofold Health

    Therapy-focused AI scribe with HIPAA-first capture and BIRP / DAP / SOAP out of the box

    Best for: behavioral-health and therapy clinicians who want a HIPAA-aligned, therapy-native scribe with BIRP / DAP / SOAP by default, Golden Thread continuity, and the lowest entry price in the category

  2. #2
    8.7/10
    Upheal

    Therapy-first AI scribe with progress-note and treatment-plan templates

    Best for: private-practice therapists who want progress notes in their preferred format with minimal cleanup

  3. #3
    8.4/10
    Mentalyc

    Mature therapy-note generator with the broadest modality template library

    Best for: established practices that need reliable progress notes across many modalities

  4. #4
    8.3/10
    Heidi Health

    Multi-specialty AI scribe with strong therapy template support and ANZ/UK reach

    Best for: therapists and psychiatrists outside the US who need a HIPAA + GDPR + Australian Privacy Act-aligned scribe

  5. #5
    7.9/10
    Eleos Health

    Enterprise behavioral-health platform for clinics, CCBHCs and SUD programs

    Best for: behavioral-health organizations, CCBHCs and community mental-health centers

  6. #6
    8.2/10
    Blueprint

    Measurement-based care platform with an ambient AI note layer

    Best for: therapists who want progress notes plus measurement-based-care outcomes in one workflow

How we scored

Ranking weights compliance (0.5), transparency of trust-page documentation (0.3) and BAA availability on the lowest paid tier (0.2). Tools without a signed BAA are excluded.

See our full methodology for weights and evidence rules.

Frequently asked

Is a HIPAA-compliant AI scribe the same as being HIPAA certified?
No — HIPAA has no formal certification program. Vendors demonstrate compliance by signing a BAA, publishing a trust page, and (ideally) providing an independent SOC 2 Type II report.
Do I need a BAA if audio is deleted immediately?
Yes. Any transient handling of PHI, including transcription in memory, is a permitted use only under a BAA with the covered entity.
Are notes stored on the vendor's servers a HIPAA risk?
Under a BAA, storage is permitted. The risk is unencrypted storage, absent access controls, or vendor breach response gaps — all of which the trust page and SOC 2 report should address.

Related feature rankings