Healthcare AI & Medical Scribes
Suki AI
Low riskEnterprise AI voice assistant and ambient scribe for clinicians, integrated with major EHRs including Epic, Cerner/Oracle Health, athenahealth, and Meditech.
Is Suki AI safe for confidential data?
Suki is a contract-first product: it is HIPAA compliant, SOC 2 Type 2 certified, provides a BAA to its customers through standard contracting, publishes concrete retention terms (audio and transcripts deleted after 30 days, with the generated note retained per contract), and encrypts data in transit (TLS 1.2) and at rest (AES-256) on Google Cloud. The nuance small practices miss is that there is no meaningful self-serve path: Suki's compliance posture exists inside an enterprise or organizational contract, so a clinician cannot simply download it, pay with a card, and be covered by a BAA the way self-serve scribes work — which is a strength for governance and a limitation for solo adoption.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
No self-serve plan means no self-serve BAA: coverage exists only once an organization signs. That blocks casual shadow adoption of Suki itself, but it also means a solo clinician using any workaround access is not covered.
Data handling
Training on inputs
Governed by the customer contract; Suki's public materials emphasize security posture rather than a blanket public no-training statement. Confirm model-training and product-improvement rights in your agreement.
Retention
Audio and transcripts are deleted after 30 days; the generated clinical note is retained for the contract duration unless configured otherwise, and the signed note lives in the EHR.
Residency
Hosted on Google Cloud infrastructure in the United States. No published Canadian residency option — a gap for PHIPA-governed Canadian organizations to raise in contracting.
Compliance
- SOC 2Yes
- GDPR / DPANot verified
- HIPAA BAAYes
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- BAA via standard enterprise contracting
- SOC 2 Type 2 certification
- TLS 1.2 / AES-256 encryption
- 30-day audio and transcript deletion
- Trust portal (trust.suki.ai) for security documentation
Frequently asked questions
Is Suki AI HIPAA compliant?
Yes — Suki is HIPAA compliant and SOC 2 Type 2 certified, and it provides a Business Associate Agreement to customers through its standard contracting. Current certifications and infrastructure details are published through its trust portal at trust.suki.ai.
Can a small practice get a BAA with Suki?
Only by contracting with Suki directly — there is no self-serve signup where a BAA is bundled into an online checkout. For a small practice that is an important nuance: the compliance protections advertised for Suki attach to the organizational contract, so until your practice has signed one, no one in the practice is covered when using it.
Is enterprise-only contracting enough to prevent shadow AI in our organization?
It prevents shadow use of Suki specifically, since there is no free tier to sign up for. It does nothing about the broader pattern: clinicians who want AI help and lack Suki seats will use free consumer chatbots or free-tier scribes instead, outside any agreement. Seat coverage decisions and a policy for non-sanctioned tools matter as much as the vendor choice.
Policy changelog
- Initial entry published from Suki's published security documentation and cited coverage.
Sources
- Suki developer documentation: security and compliance
- Suki trust portal
- AccountableHQ: Is Suki AI HIPAA compliant?
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Suki AI is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
Enterprise ambient clinical documentation platform, deeply integrated with Epic, that records clinician-patient conversations and generates structured notes.
Free AI writing and clinical-answer assistant (renamed from Doximity GPT to Doximity Ask) bundled into the professional network used by a large majority of US physicians.
Self-serve ambient AI medical scribe that listens to patient visits and drafts clinical notes, aimed at solo clinicians and small practices.
AI medical scribe with a free tier, built by an Australian company and marketed to clinicians in the US, Canada, the UK, and Australia.