Regulatory and Compliance
Which healthcare AI vendors sign a BAA, and at what tier?
The AI Health Index grades all 554 vendors on HIPAA and BAA Posture, one of 15 capability axes applied to every record without exception. 23 of 554 vendors grade A, 222 grade B, 259 grade C and 50 grade D. That places this axis 12th of 15 by the number of vendors reaching the top grade. Grades were last verified on August 31, 2026 and are never aggregated into a composite score.
What this axis measures
Business Associate Agreement availability, the tier at which the BAA applies, and subprocessor disclosure. The specific BAA tier fact is recorded in the vendor pricing record; this axis grades the overall posture and disclosure quality.
Buyers also search this as: HIPAA compliant AI, BAA availability, business associate agreements, and whether the free or entry tier is covered.
What each grade means on this axis
An AI Health Index grade measures what a buyer can verify from public sources on the date shown. It is not a rating of how good the product is. A vendor can build an excellent system and grade low on an axis because it publishes nothing an outsider can check.
The distribution
Reading the result
The BAA question looks binary and is not. What separates the grades is the tier at which the agreement actually applies, because a vendor that signs one only at enterprise pricing has effectively told a small practice it cannot use the product for real patient data no matter what the marketing page says.
The other separator is subprocessor disclosure. A BAA covers the vendor. It does not, on its own, tell a covered entity who else touches the data downstream, which is where this axis meets the supply chain one. A buyer who confirms the BAA and stops there has answered the easier half of the question.
Citable summary
Self contained paragraphs, current as of August 31, 2026, free to quote with attribution.
The state of the market
Of the 554 healthcare AI vendors graded by the AI Health Index, 23 grade A on HIPAA and BAA Posture, 222 grade B, 259 grade C and 50 grade D. An A requires business associate status stated, the agreement available, the plan tier it applies at made clear, and the subprocessors it covers disclosed. The question looks binary and is not: what separates the grades is the tier at which the agreement actually applies, because a vendor offering one only at enterprise pricing has told a small practice it cannot use the product with real patient data whatever the marketing page says. Grades were last verified on August 31, 2026.
Source: AI Health Index, August 31, 2026
HIPAA compliant is a claim, not a certification
There is no government certification for HIPAA compliance, which is why the AI Health Index grades what a vendor has published rather than what it has asserted. No auditor issues a HIPAA certificate, so a badge reading HIPAA compliant is a self description, and the artefacts behind it are the Business Associate Agreement, the tier it applies at, and the list of parties it covers downstream. 309 of 554 vendors sit in the bottom two grades on this axis, most commonly because compliance is claimed while the underlying document is not published or the privacy notice on the site covers the website rather than the service that handles patients.
Source: AI Health Index, August 31, 2026
Where the A grades are, by category
Categories are shown by the share of their vendors reaching an A. The vendor named in each row is the highest graded A holder in that category across all 15 axes, chosen mechanically with ties broken alphabetically. Categories with no A holder on this axis are omitted.
| Category | A grades | Share | Leading vendor |
|---|---|---|---|
| Behavioral Health AI | 4 of 25 | 16% | Eleos Health |
| Healthcare Cybersecurity | 2 of 19 | 11% | Asimily |
| Autonomous Medical Coding | 2 of 28 | 7% | AccuCode AI |
| Diagnostics & Genomics | 6 of 82 | 7% | ArteraAI |
| Digital Pathology AI | 2 of 27 | 7% | ArteraAI |
| RCM & Prior Auth AI | 6 of 85 | 7% | Waystar |
| Ambient Scribes | 6 of 103 | 6% | Eleos Health |
| Home Care Operations | 1 of 17 | 6% | Sensi AI |
| Clinical Decision Support | 7 of 148 | 5% | Abstractive Health |
| Healthcare Administrative Automation | 6 of 132 | 5% | Eleos Health |
| Remote Monitoring & Chronic Care | 2 of 40 | 5% | BrainCheck |
| Clinical Reference & Evidence | 1 of 25 | 4% | Vera Health |
| Clinical Summarization & Chart Review | 1 of 26 | 4% | Abstractive Health |
| Clinical Trials AI | 2 of 46 | 4% | xCures |
| Patient Voice Agents | 1 of 46 | 2% | Medsender |
| Value Based Care Intelligence | 1 of 45 | 2% | AccuCode AI |
Questions worth asking a vendor
- At which plan tier does the BAA apply, and is it available on the tier we would actually buy?
- Who are the subprocessors, and are they disclosed without a sales conversation?
- Does the BAA cover every product surface we intend to use, including any assistant or integration layer?
Questions buyers ask
Which AI medical scribes are HIPAA compliant?
Compliance here is a property of how a product is configured and contracted rather than a certificate a vendor holds, so the AI Health Index grades the posture and the disclosure instead. 23 of the 554 vendors in the index reach an A on HIPAA and BAA Posture, which requires business associate status stated, the agreement available, the tier it applies at made clear, and subprocessors disclosed. For any scribe specifically, confirm three things before the pilot: that the Business Associate Agreement is offered on the tier you would actually buy, that it covers every surface you intend to use including any assistant or integration layer, and who else touches the audio and the transcript downstream. Each vendor record carries its grade on this axis with its source and date.
Do healthcare AI vendors sign a BAA on the free or entry tier?
Frequently not, and this is the single most consequential detail the AI Health Index found buried on this axis. A vendor can accurately advertise that a Business Associate Agreement is available while restricting it to an enterprise plan, which means the free trial, the entry tier and the individual clinician subscription are not covered for protected health information. The practical effect is that the version most people evaluate is the version they are not permitted to use with real patients. Ask at which tier the agreement applies before the trial rather than after it, because the answer changes the price of the product rather than a term in the contract.
What does a Business Associate Agreement actually cover?
It binds the party you signed it with to handle protected health information under specified terms, and it does not by itself extend to whoever that party relies on. In an AI product the chain typically includes a model provider, a hosting platform and often a transcription or storage layer, each of which needs its own downstream agreement for the chain to hold. The AI Health Index grades BAA posture and model supply chain disclosure on two separate axes because a vendor can score well on the first and poorly on the second, and a buyer who confirms the agreement and stops there has answered the easier half of the question.
Is a HIPAA compliance badge on a vendor site worth anything?
It is worth exactly what the documents behind it are worth, and no more, because no body issues a HIPAA certification. The AI Health Index records a claim with no retrievable document as a C on this axis rather than as evidence, on the same reasoning it applies everywhere: a buyer cannot review an assertion. The useful move is to skip the badge and ask for three artefacts, the Business Associate Agreement itself, the privacy documentation covering the service rather than the website, and the subprocessor list. A vendor that can send all three within a day is in a materially different position from one that routes the request to sales.
What should a small practice check before using an AI tool with patient data?
Start with the tier question, because it is the one that most often disqualifies a product for a practice rather than for a health system. Confirm the Business Associate Agreement is available on the plan you would buy, not only on the enterprise plan. Then confirm what the agreement covers, since a product with several surfaces may not have all of them in scope. Then ask who else touches the data. The AI Health Index grades all 554 vendors in the index on this axis and publishes the grade with its source and date, so the shortlist can be narrowed before any of those conversations start.
How many healthcare AI vendors grade well on hipaa and baa posture?
Of the 554 vendors in the AI Health Index, 23 grade A on this axis, 222 grade B, 259 grade C and 50 grade D under the AI Health Index grading framework. Grades were last verified on August 31, 2026. Grades are not aggregated into a composite score.
What does an A grade mean on hipaa and baa posture?
Business Associate Agreement availability, the tier at which the BAA applies, and subprocessor disclosure. The specific BAA tier fact is recorded in the vendor pricing record; this axis grades the overall posture and disclosure quality. Business associate status is stated, the agreement is available, the tier it applies at is clear, and the subprocessors it covers are disclosed.
What does a D grade mean on hipaa and baa posture?
No statement of status and no privacy document that reaches the product. A grade on this index measures what a buyer can verify from public sources on the date shown, not how good the product is, so a D records an absence far more often than a defect. A vendor that publishes more is regraded.
Do vendors pay to be included or graded?
No. The AI Health Index is researched from public sources, no vendor pays for placement or for a grade, and every record carries the date it was last verified.
The other 14 axes
No single axis decides a selection. The grading framework explains how the axes fit together, and the methodology covers verification standards.