CaseloadEvaluateNotesLiteracyMySLPPricingSecurityFor districtsResources
Log inGet EASI at Northern Speech
Blog post

HIPAA Speech Therapy Documentation Software

What to look for in HIPAA speech therapy documentation software: a BAA, encryption, sign in controls, audit records and drafts you review.

The EASI team · November 1, 2026

What should HIPAA speech therapy documentation software include? It should offer a Business Associate Agreement, encrypted storage and transport, multi factor sign in, audit records, and a review step before any note becomes part of the record. EASI is HIPAA and FERPA compliant, with a BAA and insurance, and it prepares note and progress report drafts that the SLP reviews and approves.

What HIPAA asks of documentation software

HIPAA applies to covered entities, such as health care providers who bill electronically, and to the vendors that handle protected health information for them. When a software company creates, receives, keeps or sends protected health information for you, HIPAA expects a written Business Associate Agreement (BAA) between you. The HIPAA Security Rule also expects administrative, physical and technical safeguards, such as access controls, audit controls and protection of data in transit.

There is no official HIPAA certification for software. HHS does not certify technology or products, and it does not recognize private "HIPAA certifications", so "HIPAA certified" on a website is not a government approval. What you can check is the BAA, the safeguards, and how the vendor describes them.

Many school SLPs work under FERPA instead of, or as well as, HIPAA. HHS and the U.S. Department of Education publish joint guidance on which law applies to student health records. Your organization's privacy lead or counsel decides which rules apply to you.

A checklist for SLPs

Before you put client or student information into any documentation software, ask:

  1. Will you sign a BAA? If HIPAA applies to you, get it in writing before use.
  2. How is data encrypted? Ask about saved records and about data moving over the network.
  3. How do people sign in? Look for multi factor sign in and accounts for each user.
  4. Is there an audit trail? You want records of who did what, and when.
  5. Where does AI run, and who sees the data? If the software uses AI, ask which companies receive your data and whether it is used to train models.
  6. Who approves the note? Drafts are fine. The clinician should review, edit and sign every note before it becomes part of the record.
  7. What happens to data at the end? Ask for the retention and deletion terms in your agreement.

How EASI handles HIPAA documentation

EASI (Evaluative Artificial Speech Intelligence) is a connected caseload workspace for SLPs in schools and clinics. Here is how it answers the checklist, based on EASI's security and privacy pages:

  • BAA: EASI is HIPAA and FERPA compliant, with a BAA and insurance.
  • Encryption: saved clinical records use AWS server side encryption, and network requests use HTTPS.
  • Sign in: authentication runs through Amazon Cognito with multi factor authentication controls.
  • Audit records: security and clinical workflows include audit records.
  • Where AI runs: EASI's AI runs inside Amazon Web Services. Amazon Transcribe turns recordings into text, and Claude running inside Amazon Bedrock prepares the drafts you request. Student data is not sent to Anthropic, OpenAI or any other AI company, and it is not used to train AI models.
  • Subprocessors: for student data, Amazon Web Services is EASI's only subprocessor, and data stays in U.S. AWS regions.
  • Review before use: EASI prepares drafts. The SLP reviews, edits and approves every note, report and progress update.
  • Schools: EASI's National Data Privacy Agreement is signed and ready to join for districts in 15 states. See student data privacy and protection.

For the full security details, see EASI security and procurement.

What EASI documentation covers

  • Therapy notes: record a session or make a quick, dictated or structured note. EASI can prepare a draft note from a recorded session for you to review. See SLP therapy notes.
  • SOAP notes: prepare SOAP note batches from dated notes for review.
  • Progress reports: choose a date range and EASI prepares a progress report draft from dated, goal linked notes. See SLP progress reports.
  • Evaluation reports (in beta): the Report Generator fills your clinic or district template with a draft you edit, approve and sign. See SLP report writing.
  • Language samples: record, upload or import an English sample, and EASI calculates supported measures after you review and attest each transcript line. See language sample analysis software.

Frequently asked questions

Is EASI HIPAA compliant? Yes. EASI is HIPAA and FERPA compliant, with a BAA and insurance.

Will EASI sign a BAA? Yes. EASI is HIPAA and FERPA compliant, with a BAA and insurance. Districts and clinics can request the BAA, along with security architecture and data flow details, before placing regulated data in EASI.

Is there such a thing as HIPAA certified software? No. HHS does not certify software for HIPAA. Look for a signed BAA and clear descriptions of safeguards instead.

Do school SLPs need HIPAA or FERPA? It depends on the setting and the records. Many student records fall under FERPA. HHS and the Department of Education publish joint guidance, and your district's counsel decides which rules apply.

Who approves notes drafted in EASI? You do. EASI prepares drafts. You review, edit and approve every note before it becomes part of the record.

Get EASI

Individual SLPs and groups of 10 or more buy EASI through Northern Speech Services, EASI's distributor: Get EASI at Northern Speech. Districts can see how districts buy EASI, from quote to BAA.

Sources

Your caseload shouldn't take over your life.

EASI connects evaluations, reports, progress notes, planning and scheduling, with the SLP in control.

Get EASI at Northern Speech More resources