Is a BAA enough to be HIPAA compliant?

No. A BAA establishes the legal basis for a vendor to process PHI on your behalf; compliance also requires configured retention, access control, logging, consent handling, workforce controls and incident response on your side.

What blocks health-system deals most often?

Undisclosed retention windows, no contractual commitment against training on PHI, and consent handling that assumes one-party consent everywhere. All three are avoidable before the questionnaire arrives.

Do I need SOC 2 as well as HIPAA?

HIPAA is a legal obligation; SOC 2 is an assurance report. Health-system security reviews typically ask for both, and asking your vendor for the report rather than the badge is the point of the exercise.

Decision tool

Compliance readiness checklist

Eighteen controls, ordered by what actually blocks a health-system security review rather than by regulation chapter.

Written by Compare Healthcare API Editorial DeskReviewed by Technical ReviewLast reviewed 2026-09-01Rubric v1.0

Short answer

What does a health system ask before approving an AI documentation feature?

Five blockers decide most reviews: a BAA covering every subprocessor, a contractual commitment that PHI is not used for training, stated retention and deletion windows per artefact, jurisdiction-aware recording consent, and a breach-notification window shorter than the one you owe your customer. The remaining thirteen controls turn a passable review into a fast one.

Cite as: Compliance readiness checklist, Compare Healthcare API, last reviewed 2026-09-01.

0/18 complete6 of 6 blockers open

Progress is local to this browser session and never transmitted or stored.

Contracts and legal basis

Signed BAA with every subprocessor touching audio or transcriptsblockerA BAA with your documentation vendor is not sufficient if that vendor's model provider, storage or telephony subprocessors also see PHI. Ask for the subprocessor list in writing and confirm downstream agreements exist.
Subprocessor change notification with a right to objecthighModel providers change. Your contract should require advance notice of new subprocessors and give you a remedy, because your customers' agreements almost certainly require the same of you.

Model governance

Written confirmation that PHI is not used to train modelsblockerA marketing statement is not a contractual commitment. Get it in the agreement, and get the exception cases — human review of flagged output, debugging access — described explicitly.
Documented human-review conditions for audio and transcriptshighMost vendors reserve some human access for quality or debugging. Reviewers should be identified, bound by the same obligations, logged, and limited to a stated scope you can tell your customer about.

Data handling

Stated retention and deletion windows for audio, transcripts and notesblockerAsk for the default retention for each artefact separately, whether it is configurable, and how deletion is verified. Undisclosed retention is the single most common gap in this category.
Encryption in transit and at rest, with key management describedhighTLS in transit and encryption at rest are table stakes. What differentiates a mature vendor is a documented key-management model and whether customer-managed keys are available.
Data residency and cross-border processing declaredmediumConfirm which regions process and store audio, including inference. Customers with state-level or institutional residency requirements will ask, and a wrong answer discovered late kills a deployment.
De-identification method stated if any data is retained for improvementmediumIf a vendor retains de-identified data, ask which HIPAA de-identification method applies — Safe Harbor or expert determination — and who attests to it.

Assurance and audit

Current SOC 2 Type II report obtainable under NDAhighA badge is not a report. Ask for the report, check the audit period is current, and read the exceptions section rather than the cover page.
Recent third-party penetration test summary availablemediumA summary letter with scope and remediation status is normal to share. A refusal to describe testing at all is a finding in itself.
Access logging you can obtain for your own customers' auditshighYour customer's audit obligations become yours. Confirm what access and processing logs you can export, and how long the vendor keeps them.

Clinical and consent controls

Per-jurisdiction recording consent capture, not a global settingblockerAll-party consent states require every participant's consent to a recording. Your product needs jurisdiction-aware consent capture with an auditable record, not one global toggle.
Clinician review and attestation before any note enters the chartblockerDrafts are drafts. The signing clinician remains responsible for note accuracy, so your workflow must make review explicit and record who attested to what and when.
Edit trail distinguishing generated text from clinician editsmediumUseful for quality review, essential in a dispute, and increasingly requested in health-system security questionnaires.

EHR access

Least-privilege EHR scopes and per-customer enablement documentedhighRequest only the FHIR scopes you use, document why each is needed, and expect to justify write access separately from read access.

Incident response

Contractual breach-notification timeline shorter than your own obligationblockerIf your customer requires notification within a fixed window, your vendor's window must be shorter or you cannot comply. Check the number, not the intent.
A defined path for note-quality incidents, not only security incidentshighA fabricated medication in a signed note is a clinical incident with no security breach attached. Most vendor agreements are silent on this; yours should not be.

Continuity

Exit plan: data export format and deletion certificationmediumKnow how you get transcripts and notes out, in what format, and what evidence of deletion you receive. Ask before signing; it is unobtainable leverage afterwards.

Working order

Do these in sequence; each one unblocks the next.

Establish the legal basis. Sign a BAA covering your vendor and every subprocessor that touches audio, transcripts or notes, with change notification and a right to object.
Pin down data handling. Get retention and deletion windows for audio, transcripts and notes separately, plus encryption, key management and processing region in writing.
Close the model governance gap. Obtain a contractual commitment that PHI is not used for training, and a documented description of any human review of your data.
Collect assurance evidence. Request the current SOC 2 Type II report and penetration test summary, and read the exceptions rather than the badge.
Build the clinical controls. Implement jurisdiction-aware consent capture, mandatory clinician review and attestation, and an edit trail that separates generated text from clinician edits.
Prepare for failure. Confirm the vendor's breach notification window is shorter than your obligation to customers, and define a note-quality incident path separately from security incidents.
Plan the exit. Document export formats for transcripts and notes and the deletion certification you will receive on termination.

Evidence & sources

Every factual claim on this page traces to one of the primary references below. Each entry records what it supports and its evidence tier, so documentation can be told apart from judgement.

[1]HIPAA Privacy Rule, 45 CFR Parts 160 and 164
U.S. Department of Health & Human Services · Regulation · Tier A — primary documentation
Supports: What a covered entity and its business associates may do with PHI, and why a signed BAA is a precondition rather than a feature.
[2]HIPAA Security Rule
U.S. Department of Health & Human Services · Regulation · Tier A — primary documentation
Supports: Administrative, physical and technical safeguards a vendor handling recorded encounter audio must implement.
[3]Business Associate Contracts — sample provisions
U.S. Department of Health & Human Services · Regulation · Tier A — primary documentation
Supports: The contractual clauses a documentation vendor's BAA must contain.
[4]NIST SP 800-66r2 — implementing the HIPAA Security Rule
NIST · Standard · Tier A — primary documentation
Supports: Control-level guidance auditors reference when reviewing PHI-handling architecture.
[5]SOC 2 — trust services criteria
AICPA · Standard · Tier A — primary documentation
Supports: What a SOC 2 Type II report does and does not attest to during a vendor security review.
[6]HITRUST CSF
HITRUST Alliance · Standard · Tier A — primary documentation
Supports: The certification many health systems require of documentation vendors handling PHI at scale.
[7]Breach portal: notice to the Secretary of HHS breach of unsecured PHI
U.S. Department of Health & Human Services, OCR · Regulation · Tier A — primary documentation
Supports: Breach reporting obligations that flow to you as the covered entity's business associate.

Source tiers are defined on the methodology page. Outbound links are unaffiliated and carry no commercial relationship.

Frequently asked questions

Is a BAA enough to be HIPAA compliant?: No. A BAA establishes the legal basis for a vendor to process PHI on your behalf; compliance also requires configured retention, access control, logging, consent handling, workforce controls and incident response on your side. HIPAA guide.
What blocks health-system deals most often?: Undisclosed retention windows, no contractual commitment against training on PHI, and consent handling that assumes one-party consent everywhere. All three are avoidable before the questionnaire arrives. Consent index.
Do I need SOC 2 as well as HIPAA?: HIPAA is a legal obligation; SOC 2 is an assurance report. Health-system security reviews typically ask for both, and asking your vendor for the report rather than the badge is the point of the exercise.