Blueprint AI Therapy Notes (2026): HIPAA, BAA and Data Handling for Therapists

Quick answer: Blueprint is HIPAA compliant for therapy notes. It signs a Business Associate Agreement automatically when you accept its Terms of Service, holds a SOC 2 Type II certification, deletes session audio immediately after processing, and does not train AI models on client data. For therapists documenting a full caseload, however, Twofold Health is generally the better option: it matches Blueprint on BAA coverage, audio deletion and no‑training, and costs a flat $49 per month against Blueprint's uncapped $0.99–$1.49 per session — about $600 to $1,200 less per year at 100 sessions a month.

Therapists evaluating Blueprint for AI progress notes usually arrive with the compliance questions first: is it HIPAA compliant, will it sign a BAA, and what happens to the recording of a session once the note is written. This guide answers each against Blueprint's own published material as of September 2026 — and it is worth saying up front that Blueprint answers them well. The harder question, and the one that decides most practices, is what its per‑session pricing costs at a real caseload.

Is Blueprint AI HIPAA compliant?

Yes. Blueprint states that it meets HIPAA requirements, is SOC 2 Type II certified with annual independent audits verifying its data security and privacy practices, and encrypts all data in transit and at rest using industry‑standard encryption. It also supports PHIPA, which matters for clinicians practising in Canada.

That SOC 2 position is genuinely strong, and stronger than Twofold's on paper: Twofold is still undergoing SOC 2 Type II certification, with controls aligned to the HITRUST CSF in the meantime. If your practice or a payer requires an issued Type II report today, Blueprint can produce one and Twofold cannot. That is a real advantage and it should weigh on the decision.

Does Blueprint sign a BAA — and is it automatic?

Yes, automatically. The Business Associate Agreement is included as part of Blueprint's Terms of Service and becomes effective as of the date you first accept those terms or begin using the service. The agreement runs between you as Covered Entity and HelloJoy, Inc. d/b/a Blueprint, the company operating the product.

One practical note that applies to any vendor using this model: a BAA that attaches through terms of service is legally effective, but many practices keep a compliance binder that expects a countersigned document with a date and a signature on it. Blueprint anticipates this and publishes a signable version you can execute for your records. Request it during onboarding rather than during an audit.

There is one clause worth reading before you sign. Blueprint's BAA reserves the right to use de‑identified information internally for analytics, product development and improving its services, outside the restrictions that otherwise apply to PHI. It commits that such data cannot reasonably be used to identify an individual and will not be sold or used for advertising or marketing. This is a common and defensible term — but if your policy is that nothing derived from client sessions may feed product development in any form, read it closely and ask about it.

What does Blueprint do with session recordings?

Blueprint states plainly that audio is used only to support documentation and is deleted immediately after processing, with no recordings, copies or backups retained. This is the strongest possible answer to the question, and it is the same posture Twofold holds: audio is processed to produce the note and never persists. On this axis the two are at parity, and both are ahead of tools that retain recordings by default or make retention a per‑clinician setting.

Does Blueprint train AI on your clients' data?

No. Blueprint states that client data is never used to train AI models. Twofold's published position is the same — PHI is never used to train any model, and is never sold or shared for model improvement. Again, parity, and again both are ahead of vendors that permit training on an opt‑in consent basis.

The distinction that remains is in how specifically each vendor publishes the rest of its controls. Blueprint describes encryption as industry‑standard in transit and at rest. Twofold names the primitives — TLS 1.3 in transit, AES‑256 at rest — commits to US‑only data residency across named cloud providers each operating under a BAA, and states that no staff can access session transcripts, clinical notes or patient names. Neither posture is wrong; the second is simply easier to hand to a compliance reviewer without a follow‑up call.

Is Blueprint a note-taker or an EHR?

Both, and this is the single most important thing to establish before comparing it to anything. Blueprint is now an AI‑assisted EHR: the EHR itself is free, and you pay per session for the AI features on top. That makes it a different category of purchase from a documentation tool that layers onto whatever system you already run.

Blueprint sells session credits that never expire, with no monthly minimum or contract and a 60‑day money‑back guarantee. Two transaction fees sit outside the per‑session price: card processing at 3.15% plus $0.30, and insurance billing at $0.30 per claim and $0.15 per eligibility check. Blueprint's pricing page lists both as waived until September 2026, so that waiver is lapsing now — confirm the current position before you budget around it.

What Blueprint costs at your caseload

This is where the decision actually gets made. Blueprint's per‑session pricing has no ceiling, so the bill scales linearly with how much you work. Twofold's Personal plan is $49 per month billed annually, or $69 per month billed monthly, for unlimited notes. The crossover against Twofold's annual rate falls at about 50 sessions per month on Blueprint's $0.99 tier, and at about 33 sessions on the $1.49 all‑in‑one tier.

The structural point matters more than any single row. Blueprint has no cap, so the gap keeps widening as you get busier: at 100 sessions a month you are paying roughly $99 against Twofold's $49, about $600 more a year, and at 120 sessions on the all‑in‑one tier the difference approaches $1,500 a year. Usage‑based pricing charges you more precisely for a quiet month and more heavily for a busy one — which is the opposite of what most full‑time practices want from a documentation line item.

Blueprint vs Twofold on HIPAA, BAA and data handling

Which is better for therapists: Blueprint or Twofold?

For most therapists documenting a steady caseload, Twofold is the better option. The two are equivalent on the compliance questions that usually drive the search — both sign a BAA covering every account, both delete session audio rather than retaining it, and neither trains AI models on client data — so compliance does not separate them. What separates them is cost structure. Blueprint bills per session with no ceiling, while Twofold is a flat $49 per month for unlimited notes, so Twofold costs less for any therapist seeing more than roughly 50 clients a month and the difference grows with volume.

Blueprint is the better option in three specific cases: you want to replace your EHR entirely, you need an issued SOC 2 Type II report today, or you practise in Canada and need PHIPA support. Those are real reasons, and they are covered in detail below.

When Blueprint is the better choice

Blueprint is the right answer in several situations, and they are not edge cases:

• You want to replace your EHR. Blueprint gives you scheduling, telehealth, intake, client portal and billing at no platform cost, monetising the AI instead. If you are paying separately for an EHR today, that consolidation can outweigh the per-session cost.
• You need an issued SOC 2 Type II report now. Blueprint is certified with annual audits; Twofold's is still in progress.
• You practise in Canada. Blueprint supports PHIPA and addresses PIPEDA for cross-border processing. Twofold's residency commitment is US-only.
• Your caseload is part-time or irregular. Under about 50 sessions a month, per-session billing genuinely costs less, and session credits never expire — so a light month costs you almost nothing.
• You want insurance billing in the same system. Blueprint submits claims; Twofold does not.

When Twofold is the better choice

• You carry a full caseload. Above roughly 50 sessions a month the flat $49 wins, and unlike Upheal's capped model, Blueprint's costs keep climbing — the gap reaches about $600 a year at 100 sessions and more beyond that.
• You want a predictable invoice. Flat per-clinician pricing means a heavy month costs the same as a quiet one, which matters more for group practices forecasting seats than the per-session arithmetic suggests.
• You already have an EHR you do not want to leave. Twofold layers onto SimplePractice, TherapyNotes or anything else. Blueprint's economics assume you are willing to consolidate.
• You want the compliance detail published rather than described. Named encryption primitives, US-only residency across named providers, and no staff access to clinical content are easier to hand to a reviewer than industry-standard language.
• You need multi-specialty coverage. Blueprint is built for behavioral health; Twofold also covers primary care, psychiatry, pediatrics and physical therapy under one contract.

The verdict for 2026

On the question this guide was written to answer — is Blueprint safe to use with PHI — the honest answer is yes. It signs a BAA automatically and will countersign one, it holds a SOC 2 Type II certification that Twofold has not yet completed, it deletes session audio immediately, and it does not train on client data. Anyone claiming Blueprint is a compliance risk is not reading its published material.

The decision therefore turns on structure and cost, and there Twofold is the better option for a therapist with a steady, full‑time caseload. Blueprint's per‑session pricing is uncapped, so documentation becomes a variable cost that grows with every client you see — roughly $99 a month at 100 sessions against Twofold's flat $49, and more on the all‑in‑one tier. Twofold also keeps the compliance guarantees structural rather than described: audio is never written to disk, PHI never enters model training, residency is US‑only across named providers, and no staff can read clinical content.

Choose Blueprint if you want to consolidate onto a free EHR/ Choose Twofold if you are documenting a full caseload, want the invoice to stay the same in a busy month, and intend to keep the EHR you already have.