Upheal for Therapists (2026): HIPAA, BAA and Pricing Explained

Quick answer: Upheal is HIPAA compliant for therapy notes. It signs a Business Associate Agreement with every account, including free ones, accepted at signup rather than through a sales process. It deletes session recordings by default and uses session data for AI training only with explicit opt‑in consent. On price, Upheal's AI Notes plan is $39 a month and Twofold is $49 a month billed annually. For therapists documenting a full caseload, Twofold is generally the better option: it matches Upheal on BAA coverage, its price includes CPT and ICD‑10 coding and unlimited AI assistant use, and it never writes session audio to disk, where Upheal deletes recordings by default but lets you keep them.

If you are evaluating Upheal, three questions decide it: whether the platform is genuinely HIPAA compliant, whether you get a signed BAA without a sales call, and what it actually costs for the way you work. This guide answers each one against Upheal's own published material, with pricing rechecked on 7 October 2026, then shows where Twofold Health is the stronger fit and where it is not.

Is Upheal HIPAA compliant?

Yes. Upheal operates as a HIPAA Business Associate, receiving PHI from Covered Entities to perform services on their behalf, and it publishes its compliance terms rather than keeping them behind a sales process. It states that it holds SOC 2 certification and maintains a public trust center for verification.

One precision worth noting: Upheal's public compliance page states SOC 2 certification but does not specify whether the report is Type I or Type II. The distinction matters — Type I attests that controls are designed correctly at a point in time, while Type II tests that they operated effectively over a period, typically six to twelve months. If your practice or payer requires a Type II report, request the report itself through Upheal's trust center rather than relying on the marketing claim.

Does Upheal sign a BAA — including on the free plan?

Yes, on every account. Upheal enters into a BAA with each therapist who uses the platform, and Covered Entities agree to its terms at signup, with a copy sent in the welcome email. Practice administrators get organization‑wide coverage coextensive with their providers. The publicly posted agreement carries an effective date of March 25, 2026.

This is a genuine strength, and it is worth being direct about it: a BAA that attaches at signup — rather than one you must request, negotiate, or upgrade a plan to obtain — is the right posture for solo and small practices. Any vendor that gates the BAA behind an enterprise tier is asking you to carry uncovered risk on the plans below it. Upheal does not do that. Neither does Twofold, which includes a signed BAA on every plan.

How much does Upheal cost in 2026?

Upheal has changed its pricing since this guide was first published. The $1‑per‑session plan capped at $69 a month is no longer on its pricing page. Its documentation plan, AI Notes, is now a flat $39 a month for unlimited notes, unlimited AI assistant use is a $39 add‑on, and its EHR is sold separately at $1 a session or $99 a month. New accounts get a 30‑day free trial with no credit card required, and Upheal offers a 30‑day money‑back guarantee.

The EHR plans carry fees that are easy to miss when budgeting. Card payments cost 2.9% plus $0.30 per transaction, and insurance billing costs $0.30 per claim and $0.15 per eligibility check. They apply only if you run payments and claims through Upheal, and they grow with client volume.

Is Upheal actually free?

Yes. After the 30‑day trial, an account can stay on the free plan with no credit card on file. The free plan writes AI notes from typed text, dictation and uploaded files, but it does not record sessions, covers individual therapy only and has no treatment plans. For a clinician seeing a handful of clients, or one testing AI documentation before committing budget, that is a low‑risk way to start.

Twofold does not match this. Twofold's free tier is a 7‑day trial with full feature access and no card required — generous for evaluation, but it ends. If a permanently free plan is your requirement, Upheal wins that point outright and this guide will not pretend otherwise.

What does Upheal do with your recordings and session data?

Recordings are deleted by default after processing unless you choose to save them, and Upheal requires explicit opt‑in consent before any recorded session data is used for training. De‑identified data may be used for service improvement only with express written consent, which you can revoke. Upheal states it does not sell personal information and commits to notifying providers when served with a subpoena, except where legally barred from doing so.

The meaningful distinction against Twofold is architectural rather than promissory. Upheal deletes recordings by default but allows you to keep them, so retention becomes a per‑clinician setting that a practice has to govern. Twofold never stores session audio at all — it is processed in real time to produce the transcript and note, then deleted, and is never written to disk. There is no toggle that changes this, which means there is no misconfiguration to audit for and no stored audio to produce under subpoena. Similarly, Upheal gates AI training behind opt‑in consent; Twofold does not offer the option, because PHI is never used to train any model.

What Upheal and Twofold cost over a year

With Upheal's current plans, caseload no longer changes the documentation price: AI Notes and Twofold are both flat, with unlimited notes. What changes the bill is the extras you need. Twofold's Personal plan is $49 a month billed annually, or $69 billed monthly with a $19 first month, and includes CPT and ICD‑10 coding and unlimited AI assistant use.

The honest summary: for notes alone, Upheal's AI Notes plan costs $10 a month less than Twofold's annual plan, about $120 a year. If you use the AI assistant beyond Upheal's monthly limit, the comparison becomes $78 against $49, and Upheal's pricing page doesn't list CPT or ICD‑10 coding on any plan. Upheal's EHR plans are the ones to look at if you also want it to run scheduling, payments and claims.

Upheal vs Twofold on HIPAA, BAA and pricing

Which is better for therapists: Upheal or Twofold?

For most therapists documenting a steady caseload, Twofold is the better option. The two are close to equivalent on the compliance questions that usually drive the search: both sign a BAA covering every account without gating it behind an enterprise tier. What separates them is what the price includes and how each handles session audio. Twofold's $49 a month covers unlimited notes, CPT and ICD‑10 coding and unlimited AI assistant use, where Upheal charges $39 for notes and another $39 for unlimited assistant use. Twofold also never stores recordings, where Upheal deletes them by default but allows them to be saved.

Upheal is the better option in three specific cases: you want the lowest price for notes alone, where AI Notes is $10 a month less than Twofold's annual plan; you want a permanently free plan, which Twofold does not offer; or you need an issued SOC 2 report today, since Twofold's Type II certification is still in progress. Those are real reasons, and they are covered below.

When Upheal is the better choice

There are real cases where Upheal is the correct decision, and they are worth stating plainly:

• You want the lowest price for notes alone. Upheal's AI Notes plan is $39 a month, $10 less than Twofold's annual plan, and the free plan lets you start at zero if typed or dictated notes are enough.
• You need a completed SOC 2 report today. Twofold's Type II certification is still in progress; if your organization's procurement requires an issued report, request Upheal's through its trust center and verify the type.
• You want telehealth and billing in one platform. Upheal bundles HIPAA-compliant video and insurance claim submission. Twofold works alongside any video platform and any EHR but does not run your claims.
• You want the option to retain recordings. Some supervision and training workflows genuinely need saved audio. Twofold cannot do this by design.

When Twofold is the better choice

• You want coding and the AI assistant in the price. Twofold's $49 a month includes CPT and ICD-10 coding and unlimited AI assistant use. On Upheal, unlimited assistant use is a $39 add-on, and its pricing page doesn't list coding.
• You want one price with nothing to add. Twofold has a single paid plan with every feature, so the invoice is the same in a heavy month and a light one, and there are no add-ons to track across a team.
• Your policy is that session audio must never persist. Twofold's no-storage architecture removes the setting entirely rather than defaulting it safely.
• You want PHI categorically excluded from model training. Consent-based opt-in is a reasonable posture; no-option-at-all is a stronger one, and it is one less consent flow to govern across a team.
• You need multi-specialty coverage. Upheal is built for behavioral health. Twofold covers behavioral health alongside primary care, psychiatry, pediatrics and physical therapy under one contract.

The verdict for 2026

On HIPAA and BAA availability, Upheal and Twofold are close to parity, and both deserve credit for it: each signs a BAA on every account without gating it behind an enterprise tier. Upheal is ahead on SOC 2, holding a certification while Twofold's Type II is still in progress, and its permanent free plan is a real advantage for clinicians who are not ready to spend.

For the clinician this guide is written for, a therapist with a steady, full‑time caseload who wants a predictable invoice and the most conservative possible data posture, Twofold is the better option. Its $49 a month includes coding and unlimited AI assistant use, the price does not move with a heavy month, session audio is never written to disk, and PHI is excluded from model training as an architectural fact rather than a consent setting you have to manage across every clinician on the team.

If you want the lowest price for notes alone, a permanently free plan, an issued SOC 2 report or integrated claims billing, Upheal is the more sensible choice. Pick on what the price needs to include and on which compliance guarantees you need to be structural rather than configurable. Those two questions settle it more reliably than any feature list.