Regulatory and Compliance
Which healthcare AI vendors sign a BAA, and at what tier?
The AI Health Index grades all 670 vendors on HIPAA and BAA Posture, one of 15 capability axes applied to every record without exception. 44 of 670 vendors grade A, 249 grade B, 292 grade C and 85 grade D. That places this axis 7th of 15 by the number of vendors reaching the top grade. Grades were last verified on October 22, 2026 and are never aggregated into a composite score.
What this axis measures
Business Associate Agreement availability, the tier at which the BAA applies, and subprocessor disclosure. The specific BAA tier fact is recorded in the vendor pricing record; this axis grades the overall posture and disclosure quality.
Buyers also search this as: HIPAA compliant AI, BAA availability, business associate agreements, and whether the free or entry tier is covered.
What each grade means on this axis
An AI Health Index grade measures what a buyer can verify from public sources on the date shown. It is not a rating of how good the product is. A vendor can build an excellent system and grade low on an axis because it publishes nothing an outsider can check.
The distribution
Reading the result
The BAA question looks binary and is not. What separates the grades is the tier at which the agreement actually applies, because a vendor that signs one only at enterprise pricing has effectively told a small practice it cannot use the product for real patient data no matter what the marketing page says.
The other separator is the reach of the instrument itself: whether it binds the vendor alone or expressly extends its obligations to subcontractors, which is what decides whether the chain holds when the work is passed downstream. Whether those downstream parties are named is a different question and is graded on Model Supply Chain Disclosure, so a buyer who confirms the agreement and stops there has answered the easier half.
Citable summary
Self contained paragraphs, current as of October 22, 2026, free to quote with attribution.
The state of the market
Of the 670 healthcare AI vendors graded by the AI Health Index, 44 grade A on HIPAA and BAA Posture, 249 grade B, 292 grade C and 85 grade D. An A requires business associate status stated, the agreement available, the plan tier it applies at made clear, and the agreement expressly extending its obligations to subcontractors. Naming those subcontractors is graded separately on Model Supply Chain Disclosure, because one fact is not scored twice. The question looks binary and is not: what separates the grades is the tier at which the agreement actually applies, because a vendor offering one only at enterprise pricing has told a small practice it cannot use the product with real patient data whatever the marketing page says. Grades were last verified on October 22, 2026.
Source: AI Health Index, October 22, 2026
HIPAA compliant is a claim, not a certification
There is no government certification for HIPAA compliance, which is why the AI Health Index grades what a vendor has published rather than what it has asserted. No auditor issues a HIPAA certificate, so a badge reading HIPAA compliant is a self description, and the artifacts behind it are the Business Associate Agreement, the tier it applies at, and the list of parties it covers downstream. 377 of 670 vendors sit in the bottom two grades on this axis, most commonly because compliance is claimed while the underlying document is not published or the privacy notice on the site covers the website rather than the service that handles patients.
Source: AI Health Index, October 22, 2026
Where the A grades are, by category
Categories are shown by the share of their vendors reaching an A. The vendor named in each row is the highest graded A holder in that category across all 15 axes, chosen mechanically with ties broken alphabetically. Categories with no A holder on this axis are omitted.
Questions worth asking a vendor
- At which plan tier does the BAA apply, and is it available on the tier we would actually buy?
- Does the agreement expressly bind subcontractors, and who are they? The first question is answered here, the second on Model Supply Chain Disclosure.
- Does the BAA cover every product surface we intend to use, including any assistant or integration layer?
Questions buyers ask
Which AI medical scribes are HIPAA compliant?
Compliance here is a property of how a product is configured and contracted rather than a certificate a vendor holds, so the AI Health Index grades the posture and the disclosure instead. 44 of the 670 vendors in the index reach an A on HIPAA and BAA Posture, which requires business associate status stated, the agreement available, the tier it applies at made clear, and the agreement expressly binding subcontractors. For any scribe specifically, confirm three things before the pilot: that the Business Associate Agreement is offered on the tier you would actually buy, that it covers every surface you intend to use including any assistant or integration layer, and who else touches the audio and the transcript downstream. Each vendor record carries its grade on this axis with its source and date.
Do healthcare AI vendors sign a BAA on the free or entry tier?
Frequently not, and this is the single most consequential detail the AI Health Index found buried on this axis. A vendor can accurately advertise that a Business Associate Agreement is available while restricting it to an enterprise plan, which means the free trial, the entry tier and the individual clinician subscription are not covered for protected health information. The practical effect is that the version most people evaluate is the version they are not permitted to use with real patients. Ask at which tier the agreement applies before the trial rather than after it, because the answer changes the price of the product rather than a term in the contract.
What does a Business Associate Agreement actually cover?
It binds the party you signed it with to handle protected health information under specified terms, and it does not by itself extend to whoever that party relies on. In an AI product the chain typically includes a model provider, a hosting platform and often a transcription or storage layer, each of which needs its own downstream agreement for the chain to hold. The AI Health Index grades BAA posture and model supply chain disclosure on two separate axes because a vendor can score well on the first and poorly on the second, and a buyer who confirms the agreement and stops there has answered the easier half of the question.
Is a HIPAA compliance badge on a vendor site worth anything?
It is worth exactly what the documents behind it are worth, and no more, because no body issues a HIPAA certification. The AI Health Index records a claim with no retrievable document as a C on this axis rather than as evidence, on the same reasoning it applies everywhere: a buyer cannot review an assertion. The useful move is to skip the badge and ask for three artifacts, the Business Associate Agreement itself, the privacy documentation covering the service rather than the website, and the subprocessor list. A vendor that can send all three within a day is in a materially different position from one that routes the request to sales.
What should a small practice check before using an AI tool with patient data?
Start with the tier question, because it is the one that most often disqualifies a product for a practice rather than for a health system. Confirm the Business Associate Agreement is available on the plan you would buy, not only on the enterprise plan. Then confirm what the agreement covers, since a product with several surfaces may not have all of them in scope. Then ask who else touches the data. The AI Health Index grades all 670 vendors in the index on this axis and publishes the grade with its source and date, so the shortlist can be narrowed before any of those conversations start.
How many healthcare AI vendors grade well on hipaa and baa posture?
Of the 670 vendors in the AI Health Index, 44 grade A on this axis, 249 grade B, 292 grade C and 85 grade D under the AI Health Index grading framework. Grades were last verified on October 22, 2026. Grades are not aggregated into a composite score.
What does an A grade mean on hipaa and baa posture?
Business Associate Agreement availability, the tier at which the BAA applies, and subprocessor disclosure. The specific BAA tier fact is recorded in the vendor pricing record; this axis grades the overall posture and disclosure quality. Business associate status is stated, the agreement is available to read before contracting, the tier it applies at is clear, and the agreement discloses that it binds subcontractors who handle protected health information. Which parties those subcontractors are is graded on Model Supply Chain Disclosure and is not counted again here. Where any of the four cannot be verified from published material, the grade is the band below.
What does a D grade mean on hipaa and baa posture?
No statement of status and no privacy document that reaches the product. Both halves are absent at this grade: a service level privacy document on its own lifts a vendor to the band above even where no status is stated. A website privacy notice, including one that says it does not cover customer data, does not reach the product, so a vendor whose only document is that notice and who states no status grades here. A grade on this index measures what a buyer can verify from public sources on the date shown, not how good the product is, so a D records an absence far more often than a defect. A vendor that publishes more is regraded.
Do vendors pay to be included or graded?
No. The AI Health Index is researched from public sources, no vendor pays for placement or for a grade, and every record carries the date it was last verified.
The other 14 axes
No single axis decides a selection. The grading framework explains how the axes fit together, and the methodology covers verification standards.