Heidi Health

Ambient capture and note generation is the main product, and the products around it are model driven too. Heidi Evidence answers clinical questions with citations, Heidi Comms coordinates patient calls, and Dictate turns speech into text.

Heidi II, unveiled in September 2026, adds agents that act on the administrative work around a visit. A clinician asks for a task in plain language, and an agent plans it, carries it out and returns the result for review. Heidi's early examples include preparing a full day of patient charts in advance and sweeping a panel for patients due for immunizations, blood tests, screening or recalls. Agents can be saved as Routines and run across a whole patient list.

Remote, Heidi's hardware device, pairs with the scribe to capture audio in any room. Every one of these products depends on the models.

The scribe drafts and the clinician decides. Heidi generates notes and summaries from the captured encounter, and the clinician reviews, edits and finalizes them before they go to the EHR. The clinician also sets the retention limits on what is kept.

Heidi II carries the same pattern into agents. A clinician asks for a task, the agent plans and carries it out, and the result comes back for review. Approval controls apply according to the workflow and the settings chosen by the clinician or organization, and when Heidi cannot complete a task it says so and explains why.

Above the product, ISO 42001 brings a documented corrective action process for limitations found in the AI, with internal verification and executive participation, audited externally on a three year cycle.

Heidi's research preprints measure errors on simulated visits and synthetic speech. What the product does when audio is poor, when speakers overlap or when part of an encounter cannot be resolved is not described, and neither is any marking of low confidence passages for the reviewing clinician. Across 110 languages, transcription confidence will vary more than in a single language deployment.

The Medical Knowledge team, clinicians turned prompt engineers, regularly reviews Heidi's models and templates and checks outputs for accuracy, and identifiable details are removed from transcripts and processed separately. Its research team has posted preprints measuring serious errors in notes from simulated visits and the clinical risk of transcription errors across 77 languages, with the multilingual results grouped by how well resourced each language is. The product itself works in 110 languages, and its ISO 42001 certification requires a documented inventory and control set for the AI systems in scope, examined by an external auditor.

The foundation model, its version and its update policy are not named.

What happens to customer content in the chain is described more fully than who handles it. Data is never used for secondary purposes such as model training or commercialization, and clinical data is never shared or sold. Residency is set by jurisdiction, with United States data held for United States users and Canadian information stored only in Canadian data centers. Agents in Heidi II run under the same privacy policy, retention settings and regional hosting as the rest of the product.

The contract terms down the chain are described. Subcontractors that create, receive, maintain or transmit protected health information for Heidi are bound by business associate agreements that pass HIPAA obligations through to them. Subprocessors that never handle it, such as payment processors and identity providers, sign data processing agreements that require deletion once a task is done and forbid them from storing, reusing or training models on the data.

The names stay off the public pages. No foundation model provider, model class or version, or hosting provider is published, and the current subprocessor list comes from Heidi's compliance team on request. ISO 42001 certification also means an externally audited inventory of the AI systems in scope exists.

Heidi's clinical AI research team has posted three preprints on medRxiv. In 385 simulated visits, Heidi's unedited notes were 60% less likely than clinician written notes to contain a serious documentation error. A multilingual study built on five clinical dictation scripts rendered as synthetic speech reports that, across 77 languages, 97.5% of transcription errors carried low clinical risk and 0.42% were critical or high. A third paper reports that the automated judge behind this work agreed with clinicians about as well as clinicians agreed with each other. The multilingual paper states that its authors are Heidi employees and that Heidi funded it.

Both error studies use simulated visits or synthetic speech rather than live encounters, and no evaluation by an outside party is published.

Volume is the clearest operating figure. Heidi reports around 2.8 million patient visits a week and says its scribe has supported more than 175 million visits and 67 million clinical hours. Its Note insights feature groups a clinician's repeated edits and proposes word library entries, automatic edit rules and template changes to approve.

Audio is discarded as soon as Heidi transcribes it, and an audio file recorded offline stays on the clinician's device. What persists is transcripts and notes, kept under retention limits the clinician sets, and once a note is transferred to the EHR everything can be deleted with no record kept.

Data is never used for secondary purposes such as model training or commercialization, and clinical data is never shared or sold. Identifiable details are removed from transcripts and notes and processed separately from the rest. Data stays in the user's region, with United States data held for United States users and Canadian information stored only in Canadian data centers. Privacy impact assessments have been completed across multiple Canadian provinces and territories, with examples available on request.

SOC 2 Type II across all five trust services criteria, privacy included, sits behind these commitments, along with encryption in transit and at rest, audit logging and annual penetration testing.

Model behavior gets a lighter description. The Medical Knowledge team reviews models and templates and checks outputs for accuracy, clinicians are asked to review every note before it reaches the EHR, and clinical safety teams review new features before and after release. How a safety event is reported, escalated and closed is not described.

Heidi acts as a business associate under HIPAA and makes a BAA available to every covered entity it works with. Its HIPAA page applies that to every plan, and the Free plan is listed with HIPAA compliant security and privacy. The page describes administrative, physical and technical safeguards, regular risk analysis, workforce HIPAA training, minimum necessary access, incident response and United States data hosting, managed continuously rather than through a point in time audit.

The standard clinic agreement covers HIPAA in section 16 and attaches the BAA as Annexure A. In it Heidi acknowledges acting as a subcontractor business associate, and the BAA governs where it conflicts with other terms. Subcontractors that handle protected health information for Heidi are bound by their own BAAs, which carry HIPAA obligations through to them.

The clinic agreement's opening sections do not say whether it governs an individual clinician on the Free or Clinician plan as well as an organization.

The certification set is broad and independently examined. It covers ISO/IEC 27001:2022 for information security, ISO 9001 for quality management, SOC 2 Type II across all five trust services criteria including privacy, UK Cyber Essentials Plus, TX-RAMP Level 2, and ISO 42001, the AI management system standard, with its three year cycles of external audit and a documented corrective action policy. Heidi says it was the first ambient medical scribe to hold ISO 42001.

A trust center is linked from every page. Heidi's homepage points to the documents it holds, including a SOC 2 Type 2 letter and the ISO 27001, ISO 42001, Cyber Essentials and TX-RAMP certificates.

Engineering practice sits alongside the paperwork. Audio is discarded after transcription, protected health information is de identified and processed apart from the rest of the transcript, the platform is penetration tested every year, and monitoring and third party verification are ongoing. Privacy impact assessments completed across multiple Canadian provinces and territories, with examples available on request, add evidence produced for regulators. Audit dates and certificate expiry are not stated on the main site.

Heidi claims no FDA clearance for its scribe, which produces documentation a clinician reviews and finalizes.

The platform now reaches well past documentation. Heidi Evidence answers clinical questions with citations, and Heidi says peer reviewed research from partners such as the New England Journal of Medicine, Wiley and Cochrane will join BMJ Group's clinical decision support information. Heidi has acquired AutoMedica, described receptionist workflows, entered a revenue cycle management partnership and added billing code support to Routines. Heidi II agents read and write appointments and clinical mail across a practice's systems.

Those functions sit in different regulatory territory inside one platform: evidence querying is clinical decision support, a receptionist product puts AI in contact with patients, and coding and revenue cycle work touch reimbursement. Heidi says Heidi II's capabilities will not be available in the United Kingdom or the European Union. How Evidence and the agents relate to FDA rules is not published.

AI governance here is certified rather than self declared. Heidi holds ISO 42001, the international standard for AI management systems, and says it was the first ambient medical scribe to achieve it. The standard means an independently audited management system with defined controls and accountability, three year certification cycles, regular external audits and internal reviews. Heidi pairs it with an improvement policy that requires documented corrective actions, internal verification and executive participation when a limitation in the AI is identified. ISO 27001 was the step before it, and ISO 9001 is also held.

Release controls sit on top. Heidi II capabilities are staged by region and setting, and internal clinical safety teams review features through a clinical risk lens before and after release. Data is never used for secondary purposes such as model training or commercialization.

Bias reporting is narrower. Heidi's multilingual error study groups results by language resource level and reports worse word error rates for low resource languages on its most complex dictation scripts. No analysis by accent, dialect or demographic group of speakers is published, so for a product used in 110 languages from 190 countries, performance for particular groups of patients and clinicians is not shown.

Recourse at Heidi rests on audited process and firm data commitments, not on contract terms for output. ISO 42001 certification means an external auditor has examined a documented management system covering the AI in scope, including its inventory, risk treatment and how controls operate. A named certifying body issued it, and the scope statement can be requested to see what was covered.

The data commitments carry no hedging. Data is never used for secondary purposes such as model training or commercialization, clinical data is never shared or sold, and retention is set by the clinician. Privacy impact assessments have been completed for multiple Canadian jurisdictions, with examples available on request. As part of how it prepares for a data breach, Heidi also says all of its users, free or paid, are insured.

A management system standard certifies that processes exist and operate, not that a given note is right. It creates no obligation to the customer when a note is wrong, and no accuracy commitment, remediation duty or indemnity is published.

On Heidi's United States plans, EHR integration comes with Teams, which is priced on request. On the Free and Clinician plans, clinicians work from templates and copy the finished note into the chart.

The Teams integrations reach the main hospital and ambulatory systems. For Epic, Heidi describes ambient documentation, structured writeback and clinical task automation across Hyperspace, Hyperdrive and Haiku. For Oracle Cerner, it writes documentation back to MPage components in PowerChart and FirstNet. The athenahealth and Veradigm connections sync the schedule and push notes into the chart, with athenahealth notes landing in linked, structured fields, and eClinicalWorks is reached through Vim with a one click push.

Integrations come in two forms. Embed places a lightweight widget inside the EHR so the clinician never switches screens, and Connect builds a deeper system level link for organizations that need more data to flow. Heidi Desktop adds dictation anywhere on screen and captures telehealth audio straight from the call. Practice management and office tools such as Cliniko, Halaxy, Outlook and SharePoint are on the list too.

Residency is built in by region. Heidi's servers stay in the region where the user is based, United States data is held for United States users, and Canadian information is stored only in Canadian data centers. Teams customers can arrange custom terms and hosting.

Compliance is named jurisdiction by jurisdiction, covering HIPAA in the United States, GDPR in the European Union, NHS requirements in the United Kingdom, PIPEDA in Canada, the Australian Privacy Principles, New Zealand's Privacy Act, Singapore's PDPA, Hong Kong's PDPO and South Africa's POPIA. Privacy impact assessments have been completed across multiple Canadian provinces and territories.

The footprint is wide. Heidi reports around 2.8 million patient visits a week in 110 languages from 190 countries. Its Canadian deployment is the most specifically evidenced and sits in the public sector, spanning Ontario Health Teams, government funded community clinics, Primary Care Networks, Family Health Teams, regional health authorities and hospitals. Those buyers bring procurement scrutiny that commercial ones often do not.

Delivery is cloud based across web, mobile and desktop apps. No uptime figure or implementation timeline is published, and the subprocessor list is shared on request rather than posted.

Most of what Heidi costs is on its pricing page. Free is $0 for one seat with unlimited ambient documentation. Clinician is $110 per user per month billed annually or $150 billed monthly, excluding sales tax, and starts with a 14 day free trial. Medical trainees who verify their student status get Clinician free.

Clinician seats come in two sizes. A Max seat carries five times the usage allowance of a Standard seat for agents and Routines, and costs $299 per user per month billed annually. Scribing and evidence questions never draw on that allowance, and Heidi says it never charges overages.

Teams, for practices, provider groups and health systems, is priced on request. It is the plan that carries EHR integration, single sign on and custom terms and hosting. Heidi restructured its pricing in February 2026.

Coverage runs across languages and borders. The company reports around 2.8 million patient visits a week in 110 languages from 190 countries, and states coverage of more than 200 specialties.

Buyers range from a single clinician on the free plan to practices, provider groups and health systems on Teams, and medical trainees get the Clinician plan free. Public sector care in Canada is among its documented settings, from Ontario Health Teams to regional health authorities and hospitals.

The product runs on web, mobile and desktop, and Remote, a hardware device, captures audio in any room. Heidi II's agent features roll out first in English and French and are not offered in the United Kingdom or the European Union.