Security and BAA questions for medical record review software
Short answer: get a signed BAA before the first upload, and read it against the 10 items HIPAA requires in 45 CFR 164.504(e)(2). Then ask 4 things the regulation doesn't force: which AI model providers see the records, whether records ever train a model, how long files are kept after a case closes, and which SOC 2 report type and period you can read.
Limits: Vendor facts come from each vendor's own website, read on 2026-11-12; we haven't run every product, and prices, terms and security claims change, so get them in writing before you sign.
Where your records travel after upload
A record review tool is rarely 1 company. The vendor runs the app, a cloud provider hosts it, and 1 or more AI model providers read the pages. Each hop that creates, receives, stores or transmits protected health information has to be covered: the vendor by its BAA with you, and each of its own subcontractors by an agreement with the vendor carrying the same restrictions, under 45 CFR 164.504(e)(2)(ii)(D).
The practical question is the dashed lines. "We are HIPAA compliant" says nothing about whether the AI model provider behind the product signed one. Ask for the subcontractor list by name.
The 10 items a BAA must contain
We read 45 CFR 164.504(e) from the eCFR on 2026-11-12. A business associate contract must cover the items below. Use the right-hand column when you read a vendor's draft.
| Clause | What it requires | What to check in the vendor's draft |
|---|---|---|
| (e)(2)(i) | Sets the permitted uses and disclosures of the records | Is the use limited to providing the service to you? Watch for "product improvement" or "analytics" uses |
| (ii)(A) | No use or disclosure beyond the contract or the law | No carve-out for training, research or benchmarking on your data |
| (ii)(B) | Appropriate safeguards, and the Security Rule for electronic records | Named safeguards: encryption, access control, logging |
| (ii)(C) | Report unauthorized uses and disclosures, including breaches | A notice deadline in days, shorter than the 60-day legal limit |
| (ii)(D) | Subcontractors agree to the same restrictions | A list of subcontractors, including AI model providers, and how you hear about changes |
| (ii)(E) to (G) | Support patient access, amendment and accounting of disclosures | Who handles a patient request, and how fast |
| (ii)(H) | Follow the Privacy Rule where it carries out your obligations | Usually boilerplate; confirm it is present |
| (ii)(I) | Open its books and records to HHS on request | Usually boilerplate; confirm it is present |
| (ii)(J) | Return or destroy the records at termination, if feasible | A deletion method, a deadline, and written confirmation, including backups |
| (e)(2)(iii) | You can terminate if the vendor breaks a material term | No penalty or lock-in that makes termination impractical |
This is a reading aid, not legal advice. Have counsel review any BAA your organization signs, especially if your own policies or state law add terms.
14 security questions to send before a trial
The BAA sets the legal floor. These questions find out how the vendor actually runs. Send them in writing and keep the answers; they become part of your due diligence file.
- Do you have a SOC 2 report? Type 1 or Type 2, for what period, and can we read it under NDA?
- Which subcontractors create, receive, store or transmit our records? Please list them by name, including AI model providers and hosting.
- Do our records, outputs or anything derived from them train, tune or evaluate any model, yours or a provider's? Where is that promise written?
- In which countries are our records stored and processed, including by AI model providers and backups?
- How long do you keep uploaded files, outputs and logs after a case is closed or deleted? Can we delete a case ourselves?
- When we leave, how do we export everything, and how do you confirm deletion?
- Is data encrypted at rest and in transit, and with what standards?
- Do you support MFA for every user, and SSO for our identity provider?
- Can we restrict access by case and role, and see a log of who opened which file?
- Which of your staff can see our records, under what circumstances, and is that access logged?
- When was your last penetration test, and can we see a summary?
- How many days after discovery will you notify us of a breach, and who contacts whom?
- Do you carry cyber insurance?
- Has the company had a reportable breach in the last 3 years?
A small practice can send all 14 in 1 email. A hospital security team will have its own questionnaire; these questions fill the gaps such questionnaires often leave around AI model providers and training.
What 16 vendors publish about BAAs, SOC 2 and training
Read from each vendor's own website on 2026-11-12. "Not stated" means the pages we read didn't say; it doesn't mean the vendor lacks it. Ask them directly.
| Product | BAA, as stated | SOC 2, as stated | Training on your data, as stated | Source, captured |
|---|---|---|---|---|
| InPractice | BAA included in standard Terms | Not stated on pages read | States it never uses customer information to train AI models | inpractice.ai/pricing, inpractice.ai/security, inpractice.ai/free-trial-inpractice, 2026-11-12 |
| Dodonai | Not checked (security page did not load) | Not checked | Not checked | dodon.ai/pricing, 2026-11-12 |
| MediScan | BAAs available | Independent SOC 2 audits stated | Not stated on pages read | mediscan.ai/pricing, mediscan.ai/security, 2026-11-12 |
| OctopusLM | Not stated on pricing page | Not stated on pricing page | Not stated on pricing page | octopuslm.co/pricing.html, 2026-11-12 |
| CaseMark | BAA available on monthly plans | Not stated on pricing page | Not stated on pricing page | casemark.com/pricing, 2026-11-12 |
| Legalyze | States BAAs are in place with its AI providers | Not stated on pricing page | States models do not train on customer data | legalyze.ai/pricing, 2026-11-12 |
| Superinsight | BAA countersigned before first upload | SOC 2 Type 1 stated | Not stated on pages read | superinsight.ai/pricing, 2026-11-12 |
| BastionGPT | Signed BAA on every plan, including the trial | Not stated on pricing page | States data never trains AI models | bastiongpt.com/pricing, 2026-11-12 |
| Hathr AI | BAA included, signed within 24 hours | Not stated on pricing page | Not stated on pricing page | hathr.ai/pricing, 2026-11-12 |
| Casefleet | BAA for annual accounts, extra fee | Not stated on pricing page | Not stated on pricing page | casefleet.com/pricing, 2026-11-12 |
| InjuryMgmt | BAA available | Not stated on pricing page | Not stated on pricing page | injurymgmt.com/pricing, 2026-11-12 |
| Wisedocs | Not stated on page read | SOC 2 attestation stated | Not stated on page read | wisedocs.ai/product/medical-record-review, 2026-11-12 |
| DigitalOwl | Not stated on pages read | SOC Type II listed on trust page | Not stated on pages read | digitalowl.com/trust, 2026-11-12 |
| Filevine MedChron | Not stated on page read | SOC 2 and HITECH standards stated | Not stated on page read | filevine.com/platform/medical-record-chronology-tool, 2026-11-12 |
| Supio | Not stated on page read | SOC 2 Type II stated | States client data never trains foundation models | supio.com, 2026-11-12 |
| Medical Insightz | BAA mentioned | Describes platform as SOC 2 aligned | Not stated | medicalinsightz.com/ai-powered-review, 2026-11-12 |
| Medrecords AI (ours) | BAA signed at signup | SOC 2 | Customer records never train a model (in the BAA) | medrecords.ai/pricing.md, 2026-11-12 |
2 patterns stand out. Only some vendors put a training promise in writing on their public pages, and fewer say whether it is in the contract. And BAA terms vary from "included in standard Terms" to "available on monthly plans" to "annual accounts, extra fee". That last detail changes the price, so it belongs in the total cost calculator as a setup fee.
Red flags that should end a conversation
- The vendor asks you to upload records for a trial before a BAA is signed.
- "HIPAA certified" with no auditor, scope or date named. Ask who certified what, and when; the HIPAA rules don't set up a vendor certification of their own.
- A training opt-out that lives in a settings toggle rather than in the contract.
- No list of subcontractors, or "we use leading AI providers" with no names.
- No deletion timeline, or deletion that excludes backups with no end date.
- A SOC 2 claim with no type or period, or a report you can't read.
Questions about security and BAAs
Does a physician in solo practice need a BAA with the vendor?
If you are a HIPAA covered entity, or you review records as a business associate of one, yes. The vendor is handling protected health information on your behalf, which is the situation 45 CFR 164.504(e) covers.
Is a SOC 2 Type 1 report enough?
Type 1 shows the controls were designed properly on a date. Type 2 shows they worked over a period, usually several months. For records you are legally responsible for, prefer Type 2, and read the exceptions section.
How fast must a vendor report a breach?
HHS says a business associate must notify the covered entity without unreasonable delay and no later than 60 days from discovery. Ask for a shorter number in your contract so you have time to meet your own deadlines.
Can a vendor use de-identified data from my files?
Only if your contract allows it. Many BAAs permit de-identification; if you don't want your files used that way, strike or narrow that clause before you sign.