Independence & methodology
How we check
- Vendor's own words only. Each answer cites the vendor's trust center, HIPAA page, help article or legal terms, with the date we checked it. Third-party blogs and directories don't count.
- Plan by plan. Many vendors sign a BAA only on enterprise plans, and some leave AI features out of it. We record each plan separately.
- No guessing. If the vendor doesn't say, we mark it Unverified. Unverified is not a "no."
- Nine questions per plan: BAA available, BAA self-serve, BAA fine print, trains on your data by default, retention, SOC 2, ISO/IEC 42001, HITRUST, and starting price as published.
- Practice fit (medical, dental, therapy) is our editorial category, based on who the vendor says the product is for.
- Re-checked on a schedule. Changes go to the change log and The VRC Newsletter.
Independence policy
- Verdicts are mechanical. A tool's verdict comes only from the BAA field: a BAA on every listed plan = Safe with BAA; on some plans = Safe on specific plans only; the vendor says no BAA on every plan = Not for patient data; anything else = Unverified. No editor can override it, and neither can a sponsor.
- No affiliate links. We take no referral fees from listed vendors at launch. If that ever changes, every affected link will be labeled.
- No paid listings. Vendors can't pay to be added, removed or moved up.
- Sponsors never change a rating, a field or the order of results. Sponsored placements are labeled "Sponsor" and kept apart from the directory.
- A vendor can send a correction with a link to its own public page. We publish the change and the date.
- Conflict-of-interest disclosure: PHI-Safe AI is published by the team behind VanRein Compliance (VRC), a healthcare compliance and audit firm. We list any vendor that is also a VRC client.
Not legal advice
This site summarizes what vendors publish. It is not legal advice and does not certify that any product is HIPAA compliant. HHS does not certify software. A signed BAA is required but not enough on its own: you still need the right plan, the right configuration, a risk analysis and workforce training.