# HIPAA compliant medical record review software (2026)

> 10 medical record review tools compared on what they publish: SOC 2 report type, BAA, role-based access, SSO, audit logs and model training.

Canonical page: https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/

---
New — **Missing Records Detection:** flags every visit, provider, and date missing from the file. [See how →](https://medrecords.ai/product/missing-records-identification/)
[Best-of guides](https://medrecords.ai/best/) › HIPAA compliant record review software

## HIPAA compliant medical record review software: SOC 2, BAA and access controls compared

Of 10 record review vendors, 5 describe a completed SOC 2 Type II report or examination and 4 state a BAA in plain words. CaseMark publishes the fullest package: a dated Type 2 report, BAA, SSO and audit logs. Wisedocs has the deepest enterprise access controls. Ask every vendor for the report itself, not the badge.

By [Ahmed Jemaa](https://medrecords.ai/authors/ahmed-jemaa/), Co-Founder & CEO of Medrecords AI · [LinkedIn](https://www.linkedin.com/in/ahmedjemaa-aj/) · Published 3 Nov 2026 · Sources checked 3 Nov 2026
This page is for hospital security, compliance and risk teams, and for physicians who send charts to a vendor. We read each vendor's own security or trust page on 3 Nov 2026 and copied what it states, word for word where it matters. Medrecords AI is ours. We have published readiness reports, not an auditor's Type II report, and the card says so.

### Which medical record review software has a current SOC 2 Type II report?

On their own pages on 3 Nov 2026, CaseMark lists a 2026 SOC 2 Type 2 report, Wisedocs says Type II attested, MOS says it completed a Type II examination, and EvenUp and Supio state Type 2. Superinsight states Type 1. Ask for the report and its period.

### The 10 vendors at a glance

| # | Vendor | SOC 2, as stated | BAA stated | Trains on your data |
| --- | --- | --- | --- | --- |
| #1 | Medrecords AI — This is us | Readiness reports, not Type II | Yes, at signup | No, by contract |
| #2 | CaseMark | Type 2 report, 2026, on request | Yes | No, on Pro and Enterprise |
| #3 | Wisedocs | "SOC 2 Type II attested" | Yes | Anonymized data, per its policies |
| #4 | MOS Medical Record Review | Type II examination completed | Not stated | Not stated |
| #5 | EvenUp | Type 2 examination; reports on request | Partly | Not by third-party models |
| #6 | Supio | "SOC 2 Type II certified" | Not stated | No shared training pools |
| #7 | Anytime AI | "aligned with SOC 2 Type II" | Not stated | No, "Zero data training" |
| #8 | DigitalOwl | "SOC Type II" | Not stated | Not stated |
| #9 | Superinsight | Type 1 | Yes, before upload | Not stated |
| #10 | InPractice | Not stated | Not stated | No |

[](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-1) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-2) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-3) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-4) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-5) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-6) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-7) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-8) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-9) [](https://medrecords.ai/best/hipaa-compliant-medical-record-review-software/#pick-10)

### Short answer: which should you choose?

- **Choose CaseMark if** your security review wants a dated SOC 2 Type 2 report, a BAA, SSO and audit logs on day 1.
- **Choose Wisedocs if** you need SAML SSO, SCIM provisioning and role-based access for a large claims or IME team.
- **Choose Medrecords AI if** you want case-level access, a BAA at signup, a no-training contract and per-page pricing, and can accept readiness reports for now.
- **Choose MOS Medical Record Review if** you want a service with a completed SOC 2 Type II examination and nurse reviewers.

### What to ask for, and why the badge is not enough

A SOC 2 Type 1 report checks that controls were designed properly as of a single date. A Type 2 report also tests whether they worked over a period. The AICPA, which sets the standard, draws that line. "Aligned with SOC 2" and "SOC 2 compliant" are not reports at all.

Under HIPAA a vendor that handles PHI for you is a business associate and needs a signed agreement that limits what it may do with the records. The Security Rule at 45 CFR 164.312 also expects access controls and audit controls on systems holding electronic PHI.

**Role-based access (RBAC)** — Users see only what their role or assigned cases allow.
**SSO and SCIM** — Sign-in through your identity provider, and automatic removal of users who leave.
**Audit log** — A record of who opened, edited or exported each file, which you can export.
**No-training pledge** — A contract term that your records are not used to train any model.

### The vendors, in detail

Medrecords AI is ours and listed first. The rest are ordered by how complete their public security package is: report type, BAA, access controls, then training terms. We did not see any gated report. Every quote is from the vendor's own page, read on 3 Nov 2026.

Our platform
#1

#### Medrecords AI

*Best for* Case-level access and a no-training contract
Record review software with case-level access control, PHI audit logging you can export, a BAA at signup and a contract term that records never train a model.

**Security:** HIPAA compliant; TLS 1.2+ in transit, AES-256 at rest; SOC 2 and HIPAA readiness reports published 3 Nov 2026 — **Price:** 10¢ per deduplicated page, down to 5¢ at volume

##### What it publishes

- People see only the cases assigned to them
- Every upload hashed and every access, edit and export logged
- Records never train a model, written into the BAA

##### Gaps on the page

- Readiness reports from Sprinto, not an auditor's Type II attestation
- SSO and SCIM are not stated on our security page

[See security and trust →](https://medrecords.ai/security/)
#2

#### CaseMark

*Best for* The fullest public security package
Legal AI with a trust center that lists a dated 2026 SOC 2 Type 2 report and a HIPAA statement, both on request.

**Access:** "User roles and permissions restrict access"; SSO and MFA required for all accounts; audit logging for all user activity[Source](https://trust.casemark.com)

##### What it publishes

- Dated Type 2 report named on its trust center
- States it signs BAAs
- SSO, MFA and audit logs all stated

##### Gaps on the page

- The no-training pledge applies to Pro and Enterprise plans only
- Built for law firms more than clinicians

[CaseMark trust center →](https://trust.casemark.com)
#3

#### Wisedocs

*Best for* Large teams that need SSO and SCIM
Record review for claims, IME and legal teams, with the most detailed enterprise access controls on this page.

**Access:** "role-based access controls (RBAC), SAML-based SSO, and SCIM provisioning"; MFA required; audit logs by API or report[Source](https://www.wisedocs.ai/policies)

##### What it publishes

- Only vendor here stating SCIM provisioning
- "Business Associate Agreements are available"
- Also names PHIPA and PIPEDA

##### Gaps on the page

- Policies page lists "Anonymized and aggregated data training"
- No public trust portal found

[Wisedocs enterprise →](https://www.wisedocs.ai/product/enterprise)
#4

#### MOS Medical Record Review

*Best for* A service with a completed Type II examination
Record review service with AI and nurse reviewers. States a completed SOC 2 Type II examination of its defined environment.

**Access:** "role-based access controls, audit trails"; its ReviewGenX product states "immutable logs"[Source](https://www.mosmedicalrecordreview.com)

##### What it publishes

- Plain Type II wording
- Role-based access and audit trails stated
- HIPAA and HITECH named

##### Gaps on the page

- BAA not stated on the pages we read
- Report access not stated

[MOS record review →](https://www.mosmedicalrecordreview.com)
#5

#### EvenUp

*Best for* Plaintiff firms that want reports on request
Demand letter AI for injury firms. Its trust center describes a SOC 2 Type 2 examination and a HIPAA attestation.

**Access:** "role-based access, least-privilege permissions", scoped permissions, logging and monitoring[Source](https://trust.evenuplaw.com)

##### What it publishes

- Says reports are available to customers and prospects on request
- Role-based, least-privilege access
- Bars OpenAI and Anthropic from training on case files

##### Gaps on the page

- No plain offer of a BAA to customers
- Says it uses case experience to improve its product

[EvenUp trust center →](https://trust.evenuplaw.com)
#6

#### Supio

*Best for* Plaintiff injury firms
Legal AI for injury firms. States SOC 2 Type II, monitored through Vanta, with a public trust center.

**Access:** "Access control procedures established" on its trust center; customer RBAC and SSO not stated[Source](https://www.supio.com/security)

##### What it publishes

- Public trust center at the control level
- Names HIPAA, PHIPA and GDPR
- Says it does not pool data into shared training models

##### Gaps on the page

- BAA not stated
- Customer access controls not described

[Supio security →](https://www.supio.com/security)
#7

#### Anytime AI

*Best for* Firms that want role-based permissions and no training
Legal AI for malpractice and injury firms. Lists SOC 2 Type II, while its own FAQ says its controls are aligned with it.

**Access:** "Role-based access control (RBAC)", "Audit logging"; SSO not stated[Source](https://www.anytimeai.ai/security)

##### What it publishes

- Clear no-training pledge for any model
- RBAC and audit logging stated
- Documentation offered with a demo

##### Gaps on the page

- "Aligned with" is weaker than an attested report
- BAA not stated

[Anytime AI security →](https://www.anytimeai.ai/security)
#8

#### DigitalOwl

*Best for* Life and disability insurers
Medical record AI for insurers, becoming ChartSwap Insights. Its trust page lists "SOC Type II" and HIPAA.

**Access:** RBAC stated for access to its internal systems; customer SSO and audit logs not stated[Source](https://www.digitalowl.com/trust)

##### What it publishes

- Trust page lists attestations
- GDPR named
- Long record with insurers

##### Gaps on the page

- Page says "SOC Type II", never "SOC 2"
- BAA and training terms not stated

[DigitalOwl trust →](https://www.digitalowl.com/trust)
#9

#### Superinsight

*Best for* Teams that need a BAA before the first upload
Malpractice and injury chronology AI. States SOC 2 Type 1 controls and a BAA countersigned before the first upload.

**Other:** "ISO 42001 certified" for AI management; audit reports on its trust center[Source](https://www.superinsight.ai)

##### What it publishes

- BAA signed before any PHI moves
- Trust center with audit reports
- AI management standard named

##### Gaps on the page

- Type 1 tests design at 1 date, not operation over time
- Access controls and training terms not stated

[Superinsight →](https://www.superinsight.ai)
#10

#### InPractice

*Best for* Per-page buyers who need MFA
Per-page record review for QMEs, IMEs and firms. Its security page claims HIPAA compliance through Vanta and states MFA and encryption.

**Access:** MFA stated; AES-256 at rest; RBAC, SSO and audit logs not stated[Source](https://www.inpractice.ai/security)

##### What it publishes

- Says it never trains on or shares customer data
- MFA stated
- Per-page pricing

##### Gaps on the page

- No SOC 2 report named
- BAA not stated on its security page

[InPractice security →](https://www.inpractice.ai/security)

### A 6-question security review you can send any vendor

1. **Send the SOC 2 report** — Type 1 or Type 2, the period covered, and the auditor's name.
2. **Send the BAA** — Signed before the first upload, with the permitted uses spelled out.
3. **Show who can see a case** — Role or case-level access, and how a user who leaves is removed.
4. **Export the audit log** — Who opened, edited and exported a file, on demand.
5. **Put training in writing** — A contract term that records train no model, including third-party ones.
6. **Name the subprocessors** — Every company that touches the PHI, and where it is stored.

### HIPAA and SOC 2 for record review software: common questions

#### Which medical record review software has a current SOC 2 Type II report?

On their own pages on 3 Nov 2026, CaseMark lists a 2026 SOC 2 Type 2 report, Wisedocs says Type II attested, MOS says it completed a Type II examination, and EvenUp and Supio state Type 2. Superinsight states Type 1. Ask for the report and its period.

#### What is the difference between SOC 2 Type 1 and Type 2?

The AICPA says a Type 1 report evaluates controls as of a specific date. A Type 2 report also tests whether those controls operated effectively over a period. Ask which period the report covers.

#### Which record review tools have role-based permissions?

Wisedocs states RBAC, SAML SSO and SCIM. CaseMark, EvenUp, Anytime AI and MOS state role-based access. Medrecords AI limits each user to the cases assigned to them.

#### Does HIPAA require a BAA with an AI record review vendor?

Yes, when the vendor handles PHI for a covered entity. HHS says the contract must set the permitted uses and disclosures of PHI. CaseMark, Wisedocs, Superinsight and Medrecords AI state a BAA in plain words.

#### Is Medrecords AI SOC 2 Type II?

Not yet. Medrecords AI published SOC 2 and HIPAA readiness reports on 3 Nov 2026, produced in Sprinto. They are not an auditor's attestation. A BAA is signed at signup and records never train a model.

### Related

[Security and trust](https://medrecords.ai/security/) · [Chain of custody and audit trail](https://medrecords.ai/product/audit-trail-chain-of-custody/) · [EHR audit trail analysis tools](https://medrecords.ai/best/ehr-audit-trail-analysis-tools/) · [Best AI medical record review software](https://medrecords.ai/best/ai-medical-record-review-software/)

### Get our security package

Readiness reports, BAA, DPA and subprocessor list before you upload anything. First case is free on us.

[Book a demo](https://medrecords.ai/demo/)

### Sources

Every security claim is quoted from the vendor's own security or trust page on the date shown. We did not open gated reports, so a vendor may hold more than its public page says.

- CaseMark trust center: [trust.casemark.com](https://trust.casemark.com), read 3 Nov 2026
- Wisedocs policies: [wisedocs.ai](https://www.wisedocs.ai/policies), read 3 Nov 2026
- MOS Medical Record Review: [mosmedicalrecordreview.com](https://www.mosmedicalrecordreview.com), read 3 Nov 2026
- EvenUp trust center: [trust.evenuplaw.com](https://trust.evenuplaw.com), read 3 Nov 2026
- Supio security: [supio.com](https://www.supio.com/security), read 3 Nov 2026
- Anytime AI security: [anytimeai.ai](https://www.anytimeai.ai/security), read 3 Nov 2026
- DigitalOwl trust: [digitalowl.com](https://www.digitalowl.com/trust), read 3 Nov 2026
- Superinsight: [superinsight.ai](https://www.superinsight.ai), read 3 Nov 2026
- InPractice security: [inpractice.ai](https://www.inpractice.ai/security), read 3 Nov 2026
- AICPA and CIMA, SOC engagements: [aicpa-cima.com](https://www.aicpa-cima.com/professional-insights/video/maintaining-high-standards-for-soc-engagements), read 3 Nov 2026
- HHS, sample business associate agreement provisions: [hhs.gov](https://www.hhs.gov/hipaa/for-professionals/covered-entities/sample-business-associate-agreement-provisions/index.html), read 3 Nov 2026
- 45 CFR 164.312, technical safeguards: [law.cornell.edu](https://www.law.cornell.edu/cfr/text/45/164.312), read 3 Nov 2026