ClinicScribeCompare
Independent · Vendor-neutralNo paid inclusion, placement, or scoreSix-dimension rubric11 scribes tracked300-visit evaluation corpusVerified January 01, 1970Vol. II · No. 03ISSN 27·40·2XIndependent · Vendor-neutralNo paid inclusion, placement, or scoreSix-dimension rubric11 scribes tracked300-visit evaluation corpusVerified January 01, 1970Vol. II · No. 03ISSN 27·40·2X
§ 01 / Trust · Original data

HIPAA, BAA, SOC 2, and HITRUST posture benchmark

100% of reviewed AI scribes will sign a BAA; only 45% carry HITRUST.

Updated July 01, 2026 · Method: Share of AI scribes with each named compliance attestation

Key statistics

Sign a BAA
100%
SOC 2 Type II
100%
HITRUST
45%
US data residency default
100%

TL;DR — citable facts

  • 11 of 11 vendors (100%) will sign a HIPAA BAA on the standard commercial plan.
  • 11 of 11 (100%) hold a current SOC 2 Type II report.
  • Only 5 of 11 (45%) carry HITRUST — the single strongest posture signal for hospital procurement.
  • 100% of reviewed vendors default to US data residency.
  • No vendor in the corpus trains its production models on customer PHI without an explicit opt-in as of this issue.

Attestation coverage

AttestationVendorsShare
HIPAA BAA (standard plan)11 / 11100%
SOC 2 Type II11 / 11100%
HITRUST5 / 1145%
US data residency default11 / 11100%

Per-vendor posture

VendorBAASOC 2HITRUSTResidency
Twofold HealthYesYesYesUS
FreedYesYesNoUS
Nabla CopilotYesYesYesUS / EU
AbridgeYesYesYesUS
SukiYesYesYesUS
DeepScribeYesYesNoUS
Heidi HealthYesYesNoUS / AU
Sunoh.aiYesYesNoUS
Tali AIYesYesNoUS / CA
Augmedix GoYesYesYesUS
Playback HealthYesYesNoUS

Findings

BAA availability is table stakes; HITRUST is the real differentiator

Nearly every serious AI scribe will now sign a BAA — the question has shifted to whether that BAA is available at the small-clinic entry price or gated behind a mid-market tier. HITRUST, by contrast, remains rare and expensive, which is why it disproportionately correlates with hospital-system procurement approval.

Training on PHI: the quiet policy shift of 2025–2026

As of this issue, every reviewed vendor has moved to a 'no training on customer PHI without explicit opt-in' policy. This was not true in 2024, when three vendors defaulted to opt-out. Read each contract's data-use clause — marketing language and MSA language still diverge for two vendors we track.

How we produced these numbers

  • 'Signs a BAA' means the vendor ships an unmodified BAA at the standard commercial price. Vendors that gate BAAs behind enterprise tiers are counted 'No.'
  • SOC 2 status is verified by requesting the report or a Type II bridge letter dated within 12 months of the update date.
  • HITRUST is counted only when the vendor holds a valid r2 or i1 certification in its own name (not inherited from an infrastructure provider).

Full editorial standards are documented in our methodology and independence policy.

Related insights