Medical chronology software security terms
Answer in brief: 17 of 32 vendors mention HIPAA and 18 mention SOC 2, but only 9 state on the pages we read that they sign or include a BAA. A physician or hospital uploading patient records needs a signed BAA before the first page goes in. Get it in writing, along with where the records are processed and whether they train any model.
Limits: Every product fact comes from the vendor's own website, read on 2026-11-12 and linked in each row. We have not tested these products, and "not published" means we did not find the fact on the pages we read, not that the product lacks it.
Security and data terms by product
Each cell repeats the vendor's own wording in short form. We have not audited any vendor, and we did not request SOC 2 reports.
| Product | Security and data terms stated | Source, read on |
|---|---|---|
| Medrecords AI (ours) | HIPAA, SOC 2, BAA signed at signup; customer records never train a model | our product page, 2026-11-12 |
| CaseMark | BAA available on monthly plans | casemark.com/pricing; features page, 2026-11-12 |
| InPractice | Not on the 2 pages we read | inpractice.ai/pricing; chronology page, 2026-11-12 |
| Wisedocs | HIPAA, PIPEDA, SOC 2 Type II | wisedocs.ai product page, 2026-11-12 |
| DigitalOwl | HIPAA and SOC 2 | digitalowl.com; law firm blog, 2026-11-12 |
| EvenUp MedChrons | Not on the page we read | evenuplaw.com guide, 2026-11-12 |
| Supio | HIPAA, GDPR, SOC 2 Type 2; data not pooled into shared training | supio.com; chronology blog, 2026-11-12 |
| Eve | Encrypted; data never used to train shared models | eve.legal; chronology guide, 2026-11-12 |
| ProPlaintiff | HIPAA and SOC 2 | chronology page; own comparison post, 2026-11-12 |
| MedChron by Filevine | SOC 2 and HITECH stated | filevine.com features, 2026-11-12 |
| Superinsight | HIPAA; BAA countersigned before first upload; SOC 2 Type 1 | superinsight.ai/pricing; superinsight.ai, 2026-11-12 |
| Legalyze | HIPAA; data not used for training; BAAs with its AI providers | legalyze.ai/pricing; chronology page, 2026-11-12 |
| Dodonai | HIPAA, SOC 2, signed BAAs; data not used to train (compare page) | dodon.ai/pricing; compare page, 2026-11-12 |
| Casefleet | Signs a BAA on annual accounts for an added fee | casefleet.com/pricing, 2026-11-12 |
| InFactIQ | AES 256-bit encryption | infactiq.com, 2026-11-12 |
| Tavrn | SOC 2 Type II, AES-256, MFA and SSO; data not used to train (own blog) | tavrn.ai; chronology blog, 2026-11-12 |
| Inquery | HIPAA, SOC 2 audited, signs BAAs; data never trains models | inquery.ai/pricing; inquery.ai, 2026-11-12 |
| NexLaw ChronoVault | SOC 2 Type II; 256-bit encryption | nexlaw.ai/pricing; ChronoVault page, 2026-11-12 |
| SmartAdvocate SmartIntelligence | SOC 2 compliance page | smartadvocate.com article, 2026-11-12 |
| Lexitas Record Insights | HIPAA, SOC 2 Type 2; encrypted in transit | lexitaslegal.com Record Insights, 2026-11-12 |
| MediScan AI | US-hosted, HIPAA, SOC 2 audits, MFA, audit logging | mediscan.ai/pricing; mediscan.ai, 2026-11-12 |
| ReviewGenX by MOS | HIPAA; end-to-end encryption | mosmedicalrecordreview.com, 2026-11-12 |
| LezDo TechMed | SOC 2 Type II attestation; HIPAA | lezdotechmed.com, 2026-11-12 |
| Hathr.AI | HIPAA with a BAA included | hathr.ai/pricing, 2026-11-12 |
| Newcase | SOC 2 Type II; BAAs with every AI provider; records never used to train | newcase.ai chronology page, 2026-11-12 |
| VerixAi | Not published | cormetrix.com own guide, 2026-11-12 |
| LongHealth EvalPath | HIPAA; HITRUST r2 certified | longhealth.io EvalPath, 2026-11-12 |
| ChartInsight | HIPAA program; encrypted; no model training on customer data | chartinsight.ai; internal medicine page, 2026-11-12 |
| Lawft | Encrypted at rest and in transit | lawft.com chronology page, 2026-11-12 |
| Expert Institute ExpertIQ | Not on the page we read | expertinstitute.com ExpertIQ, 2026-11-12 |
| Anytime AI | SOC 2, HIPAA, AES-256; states no training on customer data | anytimeai.ai chronology page, 2026-11-12 |
| Chronicle | SOC 2 Type II; encrypted in transit and at rest | chroniclelegal.com feature page, 2026-11-12 |
What the terms mean, and what they don't
| Term on the page | What it means | What it doesn't prove |
|---|---|---|
| "HIPAA compliant" | The vendor says its handling of health data meets the HIPAA rules | There is no official HIPAA certification; the phrase alone binds the vendor to nothing |
| BAA | A business associate agreement: a contract that makes the vendor answer for protecting the PHI you send | Its terms vary; read who the subcontractors are |
| SOC 2 Type I | An auditor checked that controls were designed properly on 1 date | That the controls worked over time |
| SOC 2 Type II | An auditor tested that controls worked over a review period of months | Which systems were in scope; ask for the report under NDA |
| HITRUST r2 | A healthcare-specific certification with a wide control set (LongHealth states it) | Anything about the chronology's quality |
| "Not used to train models" | The vendor says your records won't improve its or a provider's AI | Unless it's in the BAA or contract, it can change with a policy update |
| AES-256, TLS 1.2 | Encryption at rest and in transit | Who can read the data once decrypted inside the service |
What we could and couldn't confirm
- 9 state a BAA: Medrecords AI (ours, signed at signup), CaseMark (monthly plans), Superinsight (countersigned before first upload), Legalyze (with its AI providers), Dodonai, Casefleet (annual accounts, extra fee), Inquery, Hathr.AI (included) and Newcase (with every AI provider). Note that a BAA with the vendor's AI providers is not the same as a BAA with you.
- 10 say records don't train models, in different words: Medrecords AI (in the BAA), Supio, Eve, Legalyze, Dodonai, Tavrn, Inquery, Newcase, ChartInsight and Anytime AI.
- SOC 2 type is often missing. Some name Type II, Superinsight names Type 1, and several say only "SOC 2".
- 4 pages we read say nothing on security: InPractice, EvenUp, VerixAi and Expert Institute ExpertIQ. They may well have terms; their chronology pages don't print them.
- Location is rare. MediScan states US hosting. Medrecords AI offers an on-premises deployment on its Enterprise plan. Most pages don't say where records are processed.
7 questions to send before the first upload
- Will you sign a BAA with us before we upload, and is there a fee?
- Which subcontractors, including AI model providers, receive our records, and do you hold BAAs with each?
- Where are records stored and processed, and can that change without notice?
- Is the no-training promise in the contract or the BAA, or only in a policy page?
- Can we see your SOC 2 Type II report, and which systems does it cover?
- How do we delete a case, and how long until backups are purged?
- Who on your staff can open our cases, and is that access logged?
A vendor that answers all 7 in writing within a few days is easier to buy from than one that sends a security page link. Hospitals will have their own vendor questionnaire; these 7 are the minimum for a solo physician or small clinic.
General AI assistants and chronologies
Hathr.AI is in the directory because physicians ask whether a HIPAA chat assistant with a BAA can build a chronology. It can answer questions on a short file. It isn't built to cite every row to a page, remove duplicates or export a chronology, so check every line it gives you. A consumer chatbot account without a BAA is not a place for patient records at all.