HIPAA-Compliant AI Scribes for Therapists: Independently Audited vs Self-Reported (2026)
By Ilan Sender, Founder & Editor · Last updated Jul 30, 2026
ClinicAI is independently researched and edited. We are not clinicians, and nothing here is medical advice — we compare practice software so you can decide. How we evaluate tools.
This is an independent editorial comparison based on vendor documentation, pricing, and security pages — not on reviews collected on this site. We have not tested note accuracy; trial any shortlist on your own visit types before paying. See our methodology.
| Feature | Upheal | Mentalyc | Scribeberry | Supanote | AutoNotes | Yung Sidekick |
|---|---|---|---|---|---|---|
| Price | Free + up to $69/mo | $19.99–$119.99/mo | Free + up to $99/mo | $29.99–$89.99/mo | $29–$69/mo | $39.99–$99.99/mo |
| Free Trial | 30 days | 14 days | 3 days | 14 days | 7 days | 30 days |
| Rating | No reviews yet | No reviews yet | No reviews yet | No reviews yet | No reviews yet | No reviews yet |
| HIPAA | Independently audited | Independently audited | Self-reported | Self-reported | Self-reported | Self-reported |
| Top EHRs | None documented | SimplePractice, TherapyNotes, Jane | Epic, Jane, Cerner/Oracle Health | None documented | None documented | None documented |
| Best For | Therapists with lighter caseloads (pay-per-session pricing) or anyone open to replacing their EHR entirely | Therapists on SimplePractice, TherapyNotes, Jane, or TheraNest who want notes pushed into their EHR instead of copy-paste | Multilingual, Canadian, or cross-border practices that want a standing free tier (20 uses/month) before paying | Multilingual practices and therapists who see couples and want that supported at the entry price | High-volume note writers on a budget — flat plans with unlimited notes on every tier | Price-sensitive solo therapists who want session insights and analytics, not just notes |
| Accuracy | N/A | N/A | N/A | N/A | N/A | N/A |
| Setup Ease | N/A | N/A | N/A | N/A | N/A | N/A |
Our Recommendation
Three tools we track carry a third-party SOC 2 attestation: Upheal and Mentalyc (both purpose-built for therapy, SOC 2 Type II cited) and Scribeberry (a general scribe with no documented therapy note formats, whose SOC 2 Type 2 report is by request with no auditor named publicly). Supanote, AutoNotes, and Yung Sidekick self-report HIPAA — all offer a BAA, but cite no independent audit. If audited posture is your priority, start with Upheal or Mentalyc. This is educational, not legal advice — confirm with your own compliance counsel. Either way, your usage obligations (consent, storage, access) remain yours. Take the quiz to filter to your compliance bar.
Not sure which of these fits your practice?
Answer a few questions and get a personalized recommendation in about thirty seconds.
Take the 30-second quiz"HIPAA Compliant" Is Not One Claim — It's Two
Every AI notes tool marketed to therapists says it's "HIPAA compliant." But that phrase covers two very different things, and the difference matters if you ever have to explain your tooling to a client, a board, or a payer. On this site we label them explicitly:
- Independently audited — a third party independently audited the vendor's security controls (a SOC 2 attestation is cited).
- Self-reported — the vendor states it follows HIPAA, but cites no independent audit.
Self-reported does not mean non-compliant. It means the only party vouching for the controls is the vendor. Here's exactly where each tool we track stands, as stored in our data (verified June 2026).
This is educational, not legal advice — confirm your specific obligations with your own compliance counsel.
The HIPAA Posture of Each Therapy-Relevant Tool
| Tool | HIPAA tier | SOC 2 | BAA | Notable data handling (as stored) |
|---|---|---|---|---|
| Upheal | Independently audited | SOC 2 Type II cited | Yes (every account at signup) | — |
| Mentalyc | Independently audited | SOC 2 Type II cited | Yes (every plan) | Recordings auto-deleted within 3 days |
| Scribeberry | Self-reported (cites SOC 2 — vendor claim) | SOC 2 Type 2 (report by request; no auditor named publicly) | Yes | No audio recordings stored; no AI models trained on PHI; also self-reports PIPEDA |
| Supanote | Self-reported | None cited | Yes | — |
| AutoNotes | Self-reported ("HIPAA-aligned") | None cited | Yes (every customer) | — |
| Yung Sidekick | Self-reported | None cited | Yes (offered) | — |
What This Means for Your Decision
If audited security posture is your top priority, the two independently audited tools are Upheal and Mentalyc — both cite a SOC 2 Type II attestation. Scribeberry is the near-miss: it cites SOC 2 Type 2, but the report is available only by request and names no public auditor, so we treat that as a vendor claim until you obtain it. Of those, Upheal and Mentalyc are purpose-built for therapy (Upheal as an all-in-one EHR, Mentalyc as a notes tool with EHR push); Scribeberry is a general multi-specialty scribe that documents no therapy-specific note formats, so it belongs on your shortlist only if a general scribe meets your documentation needs — and note its audit evidence is a vendor claim, not a published attestation.
The self-reported tools — Supanote, AutoNotes, Yung Sidekick — all offer a BAA, which is the contractual piece HIPAA requires of a business associate. The gap is the independent audit, not the BAA. If you're comfortable relying on the vendor's own attestation (many solo practices reasonably are, especially at these tools' lower prices), they remain viable.
One thing no tool removes: your obligation. A BAA and a SOC 2 report cover the vendor's controls. You still control how you use the tool — recording consent, where notes are stored after generation, who can access them. The tool's posture is necessary, not sufficient.
We have not tested any tool's actual security, only recorded what each vendor documents. Treat "independently audited" as exactly that, not as "guaranteed safe."
Want a shortlist filtered to your compliance bar, EHR, and budget? Take the 30-second matcher quiz.