Do AI Therapy Note Tools Need a BAA? What Each Vendor Offers (2026)
By Ilan Sender, Founder & Editor · Last updated Jul 30, 2026
ClinicAI is independently researched and edited. We are not clinicians, and nothing here is medical advice — we compare practice software so you can decide. How we evaluate tools.
This is an independent editorial comparison based on vendor documentation, pricing, and security pages — not on reviews collected on this site. We have not tested note accuracy; trial any shortlist on your own visit types before paying. See our methodology.
| Feature | Upheal | Mentalyc | Supanote | AutoNotes | Yung Sidekick | Scribeberry |
|---|---|---|---|---|---|---|
| Price | Free + up to $69/mo | $19.99–$119.99/mo | $29.99–$89.99/mo | $29–$69/mo | $39.99–$99.99/mo | Free + up to $99/mo |
| Free Trial | 30 days | 14 days | 14 days | 7 days | 30 days | 3 days |
| Rating | No reviews yet | No reviews yet | No reviews yet | No reviews yet | No reviews yet | No reviews yet |
| HIPAA | Independently audited | Independently audited | Self-reported | Self-reported | Self-reported | Self-reported |
| Top EHRs | None documented | SimplePractice, TherapyNotes, Jane | None documented | None documented | None documented | Epic, Jane, Cerner/Oracle Health |
| Best For | Therapists with lighter caseloads (pay-per-session pricing) or anyone open to replacing their EHR entirely | Therapists on SimplePractice, TherapyNotes, Jane, or TheraNest who want notes pushed into their EHR instead of copy-paste | Multilingual practices and therapists who see couples and want that supported at the entry price | High-volume note writers on a budget — flat plans with unlimited notes on every tier | Price-sensitive solo therapists who want session insights and analytics, not just notes | Multilingual, Canadian, or cross-border practices that want a standing free tier (20 uses/month) before paying |
| Accuracy | N/A | N/A | N/A | N/A | N/A | N/A |
| Setup Ease | N/A | N/A | N/A | N/A | N/A | N/A |
Our Recommendation
Every dedicated therapy-notes tool we track offers a BAA, so the real choice is the posture behind it. Upheal (BAA at signup) and Mentalyc (BAA every plan) cite a third-party SOC 2 Type II attestation, and Scribeberry pairs its BAA with a SOC 2 Type 2 report available by request (no auditor named publicly); Supanote, AutoNotes, and Yung Sidekick offer a BAA but self-report HIPAA. Execute the BAA before recording any PHI, and confirm recording-retention practices. This is educational, not legal advice. Take the quiz to filter by your compliance bar.
Not sure which of these fits your practice?
Answer a few questions and get a personalized recommendation in about thirty seconds.
Take the 30-second quizThe Short Answer: Yes — and Every Tool Here Offers One
If an AI tool processes your clients' protected health information (PHI) — and an AI notes tool that hears or reads session content does — then under HIPAA that vendor is a business associate, and you need a Business Associate Agreement (BAA) in place before you send it any PHI. The good news: every dedicated therapy-notes tool we track offers a BAA. The differences are in when it applies and what audited security sits behind it.
This is educational, not legal advice — confirm your specific obligations with your own compliance counsel.
BAA Availability by Tool (as stored)
| Tool | BAA | When it applies | Independent audit |
|---|---|---|---|
| Upheal | Yes | Applies to every account at signup | SOC 2 Type II cited (verified) |
| Mentalyc | Yes | Available on every plan | SOC 2 Type II cited (verified) |
| Scribeberry | Yes | Advertised | SOC 2 Type 2 cited, report by request — no auditor named (vendor claim) |
| Supanote | Yes | Advertised | None cited (self-reported HIPAA) |
| AutoNotes | Yes | Signed with every customer | None cited (self-reported "HIPAA-aligned") |
| Yung Sidekick | Yes | Offered | None cited (self-reported HIPAA) |
What to Watch For
A BAA is necessary but not the whole picture. Two tools can both "offer a BAA" while differing sharply in independently-audited security. Upheal, Mentalyc, and Scribeberry pair their BAA with a third-party SOC 2 attestation — though Upheal and Mentalyc cite a SOC 2 Type II attestation directly, while Scribeberry's SOC 2 Type 2 report is available only by request and names no public auditor; Supanote, AutoNotes, and Yung Sidekick offer a BAA but self-report their HIPAA compliance without citing an audit. The BAA is the contract; the SOC 2 is the evidence the controls behind it were independently checked.
Confirm the BAA is actually executed before you record a single session. Several tools make the BAA available "on every plan" or "with every customer," but availability is not the same as a signed agreement. The honest workflow: sign up, request/execute the BAA, then start recording PHI.
Check what happens to recordings. Where the data is documented: Mentalyc (independently audited) auto-deletes recordings within 3 days, and Scribeberry states it stores no audio recordings and trains no models on PHI — a strong claim, though Scribeberry's own posture is self-reported. Upheal's recording-retention specifics and the self-reported tools' practices are less documented in our data — ask directly.
The Practical Takeaway
You don't have to choose between BAA-yes and BAA-no — they all offer one. You're really choosing between self-reported and independently audited posture behind that BAA. If audited posture matters to you, start with Upheal or Mentalyc (purpose-built for therapy) or Scribeberry (general scribe, no documented therapy formats). If you're comfortable with a vendor attestation at a lower price, the self-reported tools all carry a BAA too.
We document what vendors publish; we don't verify their security ourselves, and nothing here substitutes for your own compliance review.
Want a shortlist filtered to "BAA plus independent audit" or by price? Take the 30-second matcher quiz.