SOC 2 vs Self-Reported HIPAA in AI Therapy Scribes: How to Read the Claims (2026)

Two Vendors, Same "HIPAA Compliant" Badge, Very Different Evidence

Vendor security pages are written to reassure, not to inform. "HIPAA compliant," "bank-level encryption," "enterprise security" — these phrases appear whether or not anyone outside the company has checked. The single most useful distinction you can learn to read is SOC 2 vs self-reported, because it tells you whether a third party audited the controls or the vendor is vouching for itself.

This is educational, not legal advice.

What SOC 2 Actually Is

SOC 2 is an independent audit, performed by a third-party firm, of how an organization handles data security (and sometimes availability, confidentiality, and privacy). A Type II report covers controls over a period of time, not just a single point — which is why it's stronger evidence than a one-time snapshot. When a vendor "cites a SOC 2 Type II attestation," it means an outside auditor examined and reported on their controls.

Self-reported HIPAA compliance means the vendor says it meets HIPAA's requirements. That can be true and diligent — but no independent party has confirmed it. The claim and the evidence are the same source.

Neither replaces a BAA, which is the contract making the vendor a HIPAA business associate. All the tools below offer a BAA; the question this article answers is what audited evidence sits behind it.

How the Therapy-Relevant Tools Stack Up

Independently audited (third-party SOC 2 attestation we could check):

• Upheal — SOC 2 Type II cited; purpose-built for therapy (all-in-one EHR).
• Mentalyc — SOC 2 Type II cited; recordings deleted within 3 days; real EHR push; purpose-built for therapy.

Cites SOC 2, but the evidence is not public (vendor claim — the amber chip on our cards):

• Scribeberry — SOC 2 Type 2, report available by request (no auditor named publicly); states no audio stored and no models trained on PHI. General multi-specialty scribe — documents no therapy-specific note formats, so it's the independently audited option only if a general scribe fits your needs.

Self-reported (no SOC 2 cited; BAA offered):

• Supanote — self-reports HIPAA; BAA available; standout 100+ language support.
• AutoNotes — self-reports "HIPAA-aligned"; BAA with every customer; widest note-format coverage at a budget price.
• Yung Sidekick — self-reports HIPAA; BAA offered; progress analytics on every plan.

How to Use This When You Buy

1. Decide your bar first. Some practices reasonably require an independent audit; others accept a vendor attestation plus a BAA, especially at lower price points. Neither is wrong — but decide before the demo so the sales pitch doesn't decide for you.
2. Read "SOC 2" carefully. "SOC 2 Type II attestation cited" is stronger than "SOC 2 in progress" or "SOC 2 report by request." Scribeberry's, for instance, is available by request and names no public auditor — verify the actual report if it's decisive for you.
3. Don't conflate self-reported with unsafe. It means the evidence is the vendor's word plus a BAA. The right response is proportionate diligence, not automatic disqualification.
4. A BAA is non-negotiable either way — and every tool here offers one.

We record what each vendor documents; we have not independently verified any vendor's security controls. Use this to ask better questions, not as a guarantee.

Want a shortlist filtered to "third-party audited only," or balanced against price and EHR fit? Take the 30-second matcher quiz.

More comparisons in AI Scribes