NewMissing Records Detection: flags every visit, provider, and date missing from the file. See how →

Best-of guides › HIPAA compliant record review software

HIPAA compliant medical record review software: SOC 2, BAA and access controls compared

Of 10 record review vendors, 5 describe a completed SOC 2 Type II report or examination and 4 state a BAA in plain words. CaseMark publishes the fullest package: a dated Type 2 report, BAA, SSO and audit logs. Wisedocs has the deepest enterprise access controls. Ask every vendor for the report itself, not the badge.

By Ahmed Jemaa, Co-Founder & CEO of Medrecords AI · LinkedIn · Published 3 Nov 2026 · Sources checked 3 Nov 2026

This page is for hospital security, compliance and risk teams, and for physicians who send charts to a vendor. We read each vendor's own security or trust page on 3 Nov 2026 and copied what it states, word for word where it matters. Medrecords AI is ours. We have published readiness reports, not an auditor's Type II report, and the card says so.

Which medical record review software has a current SOC 2 Type II report?

On their own pages on 3 Nov 2026, CaseMark lists a 2026 SOC 2 Type 2 report, Wisedocs says Type II attested, MOS says it completed a Type II examination, and EvenUp and Supio state Type 2. Superinsight states Type 1. Ask for the report and its period.

The 10 vendors at a glance

#VendorSOC 2, as statedBAA statedTrains on your data
#1Medrecords AIThis is usReadiness reports, not Type IIYes, at signupNo, by contract
#2CaseMarkType 2 report, 2026, on requestYesNo, on Pro and Enterprise
#3Wisedocs"SOC 2 Type II attested"YesAnonymized data, per its policies
#4MOS Medical Record ReviewType II examination completedNot statedNot stated
#5EvenUpType 2 examination; reports on requestPartlyNot by third-party models
#6Supio"SOC 2 Type II certified"Not statedNo shared training pools
#7Anytime AI"aligned with SOC 2 Type II"Not statedNo, "Zero data training"
#8DigitalOwl"SOC Type II"Not statedNot stated
#9SuperinsightType 1Yes, before uploadNot stated
#10InPracticeNot statedNot statedNo

Short answer: which should you choose?

  • Choose CaseMark if your security review wants a dated SOC 2 Type 2 report, a BAA, SSO and audit logs on day 1.
  • Choose Wisedocs if you need SAML SSO, SCIM provisioning and role-based access for a large claims or IME team.
  • Choose Medrecords AI if you want case-level access, a BAA at signup, a no-training contract and per-page pricing, and can accept readiness reports for now.
  • Choose MOS Medical Record Review if you want a service with a completed SOC 2 Type II examination and nurse reviewers.

What to ask for, and why the badge is not enough

A SOC 2 Type 1 report checks that controls were designed properly as of a single date. A Type 2 report also tests whether they worked over a period. The AICPA, which sets the standard, draws that line. "Aligned with SOC 2" and "SOC 2 compliant" are not reports at all.

Under HIPAA a vendor that handles PHI for you is a business associate and needs a signed agreement that limits what it may do with the records. The Security Rule at 45 CFR 164.312 also expects access controls and audit controls on systems holding electronic PHI.

Role-based access (RBAC)Users see only what their role or assigned cases allow.
SSO and SCIMSign-in through your identity provider, and automatic removal of users who leave.
Audit logA record of who opened, edited or exported each file, which you can export.
No-training pledgeA contract term that your records are not used to train any model.

The vendors, in detail

Medrecords AI is ours and listed first. The rest are ordered by how complete their public security package is: report type, BAA, access controls, then training terms. We did not see any gated report. Every quote is from the vendor's own page, read on 3 Nov 2026.

Our platform
#1

Medrecords AI

Best for Case-level access and a no-training contract

Record review software with case-level access control, PHI audit logging you can export, a BAA at signup and a contract term that records never train a model.

Security: HIPAA compliant; TLS 1.2+ in transit, AES-256 at rest; SOC 2 and HIPAA readiness reports published 3 Nov 2026Price: 10¢ per deduplicated page, down to 5¢ at volume

What it publishes

  • People see only the cases assigned to them
  • Every upload hashed and every access, edit and export logged
  • Records never train a model, written into the BAA

Gaps on the page

  • Readiness reports from Sprinto, not an auditor's Type II attestation
  • SSO and SCIM are not stated on our security page
See security and trust →
#2

CaseMark

Best for The fullest public security package

Legal AI with a trust center that lists a dated 2026 SOC 2 Type 2 report and a HIPAA statement, both on request.

Access: "User roles and permissions restrict access"; SSO and MFA required for all accounts; audit logging for all user activitySource

What it publishes

  • Dated Type 2 report named on its trust center
  • States it signs BAAs
  • SSO, MFA and audit logs all stated

Gaps on the page

  • The no-training pledge applies to Pro and Enterprise plans only
  • Built for law firms more than clinicians
CaseMark trust center →
#3

Wisedocs

Best for Large teams that need SSO and SCIM

Record review for claims, IME and legal teams, with the most detailed enterprise access controls on this page.

Access: "role-based access controls (RBAC), SAML-based SSO, and SCIM provisioning"; MFA required; audit logs by API or reportSource

What it publishes

  • Only vendor here stating SCIM provisioning
  • "Business Associate Agreements are available"
  • Also names PHIPA and PIPEDA

Gaps on the page

  • Policies page lists "Anonymized and aggregated data training"
  • No public trust portal found
Wisedocs enterprise →
#4

MOS Medical Record Review

Best for A service with a completed Type II examination

Record review service with AI and nurse reviewers. States a completed SOC 2 Type II examination of its defined environment.

Access: "role-based access controls, audit trails"; its ReviewGenX product states "immutable logs"Source

What it publishes

  • Plain Type II wording
  • Role-based access and audit trails stated
  • HIPAA and HITECH named

Gaps on the page

  • BAA not stated on the pages we read
  • Report access not stated
MOS record review →
#5

EvenUp

Best for Plaintiff firms that want reports on request

Demand letter AI for injury firms. Its trust center describes a SOC 2 Type 2 examination and a HIPAA attestation.

Access: "role-based access, least-privilege permissions", scoped permissions, logging and monitoringSource

What it publishes

  • Says reports are available to customers and prospects on request
  • Role-based, least-privilege access
  • Bars OpenAI and Anthropic from training on case files

Gaps on the page

  • No plain offer of a BAA to customers
  • Says it uses case experience to improve its product
EvenUp trust center →
#6

Supio

Best for Plaintiff injury firms

Legal AI for injury firms. States SOC 2 Type II, monitored through Vanta, with a public trust center.

Access: "Access control procedures established" on its trust center; customer RBAC and SSO not statedSource

What it publishes

  • Public trust center at the control level
  • Names HIPAA, PHIPA and GDPR
  • Says it does not pool data into shared training models

Gaps on the page

  • BAA not stated
  • Customer access controls not described
Supio security →
#7

Anytime AI

Best for Firms that want role-based permissions and no training

Legal AI for malpractice and injury firms. Lists SOC 2 Type II, while its own FAQ says its controls are aligned with it.

Access: "Role-based access control (RBAC)", "Audit logging"; SSO not statedSource

What it publishes

  • Clear no-training pledge for any model
  • RBAC and audit logging stated
  • Documentation offered with a demo

Gaps on the page

  • "Aligned with" is weaker than an attested report
  • BAA not stated
Anytime AI security →
#8

DigitalOwl

Best for Life and disability insurers

Medical record AI for insurers, becoming ChartSwap Insights. Its trust page lists "SOC Type II" and HIPAA.

Access: RBAC stated for access to its internal systems; customer SSO and audit logs not statedSource

What it publishes

  • Trust page lists attestations
  • GDPR named
  • Long record with insurers

Gaps on the page

  • Page says "SOC Type II", never "SOC 2"
  • BAA and training terms not stated
DigitalOwl trust →
#9

Superinsight

Best for Teams that need a BAA before the first upload

Malpractice and injury chronology AI. States SOC 2 Type 1 controls and a BAA countersigned before the first upload.

Other: "ISO 42001 certified" for AI management; audit reports on its trust centerSource

What it publishes

  • BAA signed before any PHI moves
  • Trust center with audit reports
  • AI management standard named

Gaps on the page

  • Type 1 tests design at 1 date, not operation over time
  • Access controls and training terms not stated
Superinsight →
#10

InPractice

Best for Per-page buyers who need MFA

Per-page record review for QMEs, IMEs and firms. Its security page claims HIPAA compliance through Vanta and states MFA and encryption.

Access: MFA stated; AES-256 at rest; RBAC, SSO and audit logs not statedSource

What it publishes

  • Says it never trains on or shares customer data
  • MFA stated
  • Per-page pricing

Gaps on the page

  • No SOC 2 report named
  • BAA not stated on its security page
InPractice security →

A 6-question security review you can send any vendor

  1. Send the SOC 2 reportType 1 or Type 2, the period covered, and the auditor's name.
  2. Send the BAASigned before the first upload, with the permitted uses spelled out.
  3. Show who can see a caseRole or case-level access, and how a user who leaves is removed.
  4. Export the audit logWho opened, edited and exported a file, on demand.
  5. Put training in writingA contract term that records train no model, including third-party ones.
  6. Name the subprocessorsEvery company that touches the PHI, and where it is stored.

HIPAA and SOC 2 for record review software: common questions

Which medical record review software has a current SOC 2 Type II report?

On their own pages on 3 Nov 2026, CaseMark lists a 2026 SOC 2 Type 2 report, Wisedocs says Type II attested, MOS says it completed a Type II examination, and EvenUp and Supio state Type 2. Superinsight states Type 1. Ask for the report and its period.

What is the difference between SOC 2 Type 1 and Type 2?

The AICPA says a Type 1 report evaluates controls as of a specific date. A Type 2 report also tests whether those controls operated effectively over a period. Ask which period the report covers.

Which record review tools have role-based permissions?

Wisedocs states RBAC, SAML SSO and SCIM. CaseMark, EvenUp, Anytime AI and MOS state role-based access. Medrecords AI limits each user to the cases assigned to them.

Does HIPAA require a BAA with an AI record review vendor?

Yes, when the vendor handles PHI for a covered entity. HHS says the contract must set the permitted uses and disclosures of PHI. CaseMark, Wisedocs, Superinsight and Medrecords AI state a BAA in plain words.

Is Medrecords AI SOC 2 Type II?

Not yet. Medrecords AI published SOC 2 and HIPAA readiness reports on 3 Nov 2026, produced in Sprinto. They are not an auditor's attestation. A BAA is signed at signup and records never train a model.

Related

Security and trust · Chain of custody and audit trail · EHR audit trail analysis tools · Best AI medical record review software

Get our security package

Readiness reports, BAA, DPA and subprocessor list before you upload anything. First case is free on us.

Book a demo

Sources

Every security claim is quoted from the vendor's own security or trust page on the date shown. We did not open gated reports, so a vendor may hold more than its public page says.