Which AI tools can your practice trust with patient data?
A buyer's guide for small medical, dental and therapy practices. We read each vendor's BAA, privacy terms and pricing page, then give a plain-English verdict. Every fact links to the vendor's own page and the date we checked it.
Staff AI-use checklist for your practice
Your team is already using AI. Before anyone pastes patient information into ChatGPT, Copilot or a scribe, work through these 12 steps: which tools and plans are approved, whether the BAA is actually signed, which features to switch off, and how to keep it current.
Compliance toolkit
Find tools by practice and job
Medical practice
Dental practice
Therapy / behavioral health
BAA fine print to read before you sign
BAAs are contracts, and they differ. We flag the clauses a practice should know about: liability caps, training on de-identified data, keeping data after you cancel, and features left out of coverage.
Get PHI-Safe AI updates by email
Signing up joins The VRC Newsletter from VanRein Compliance. It will include PHI-Safe AI updates (vendor BAA, training and retention changes) along with VanRein Compliance's other compliance news. You can unsubscribe any time.
Form not loading? Subscribe on newsletter.vanreincompliance.com.
What the verdicts mean
Safe with BAA The vendor publicly offers a BAA on every plan we list. Safe on specific plans only A BAA exists, but only on some plans. Not for patient data The vendor says it won't sign a BAA on any plan we list. Unverified The vendor's public pages don't confirm a BAA. That isn't a no; ask the vendor.
"Safe" means only that a BAA is available. You still need the right plan, a signed BAA, the right settings and your own risk analysis.