Quick answer: Upheal is HIPAA compliant for therapy notes. It signs a Business Associate Agreement with every account — including free ones — accepted at signup rather than through a sales process, deletes session recordings by default, and uses session data for AI training only with explicit opt‑in consent. For therapists documenting a full caseload, Twofold Health is generally the better option: it matches Upheal on BAA coverage, costs a flat $49 per month against Upheal's $69 monthly cap — roughly $240 less a year — and never writes session audio to disk at all rather than deleting it by default.
If you are evaluating Upheal, three questions decide it: whether the platform is genuinely HIPAA compliant, whether you get a signed BAA without a sales call, and what it actually costs at your caseload. This guide answers each one against Upheal's own published material as of September 2026, then shows where Twofold Health is the stronger fit and where it is not.
Is Upheal HIPAA compliant?
Yes. Upheal operates as a HIPAA Business Associate, receiving PHI from Covered Entities to perform services on their behalf, and it publishes its compliance terms rather than keeping them behind a sales process. It states that it holds SOC 2 certification and maintains a public trust center for verification.
One precision worth noting: Upheal's public compliance page states SOC 2 certification but does not specify whether the report is Type I or Type II. The distinction matters — Type I attests that controls are designed correctly at a point in time, while Type II tests that they operated effectively over a period, typically six to twelve months. If your practice or payer requires a Type II report, request the report itself through Upheal's trust center rather than relying on the marketing claim.
Does Upheal sign a BAA — including on the free plan?
Yes, on every account. Upheal enters into a BAA with each therapist who uses the platform, and Covered Entities agree to its terms at signup, with a copy sent in the welcome email. Practice administrators get organization‑wide coverage coextensive with their providers. The publicly posted agreement carries an effective date of March 25, 2026.
This is a genuine strength, and it is worth being direct about it: a BAA that attaches at signup — rather than one you must request, negotiate, or upgrade a plan to obtain — is the right posture for solo and small practices. Any vendor that gates the BAA behind an enterprise tier is asking you to carry uncovered risk on the plans below it. Upheal does not do that. Neither does Twofold, which includes a signed BAA on every plan.
How much does Upheal cost in 2026?
Upheal moved to usage‑based pricing: $1 per session, capped at $69 per month per provider, billed monthly on actual usage with no minimum spend and no annual prepay. New accounts get a 30‑day full trial with no credit card required.
Plan | Price | What you get |
|---|---|---|
Free | $0 | Unlimited feature-limited notes, HIPAA-compliant telehealth, no card required |
Individual | $1/session, capped at $69/mo | All clinical and practice features, AI Assistant, billed on usage |
Group | Custom | White-glove onboarding, shared templates, EHR migration, centralized billing |
Enterprise | Custom | SSO, custom note development, dedicated CSM, SLA, volume discounts, API access |
Two add‑on fees sit outside the cap and are easy to miss when budgeting. Card payments carry 2.9% plus $0.30 per transaction, and insurance billing costs $0.30 per claim submission and $0.15 per eligibility check. These only apply if you use Upheal's payments and billing features — they are not documentation charges — but a practice running claims through the platform should model them, because they scale with client volume rather than stopping at the $69 ceiling.
Is Upheal actually free?
Yes, and this is a real differentiator rather than a trial in disguise. After the 30‑day full trial, accounts can continue on a free plan with unlimited notes at reduced functionality plus HIPAA‑compliant telehealth, with no credit card on file. For a clinician seeing a handful of clients, or one testing AI documentation before committing budget, that is a genuinely low‑risk entry point.
Twofold does not match this. Twofold's free tier is a 7‑day trial with full feature access and no card required — generous for evaluation, but it ends. If a permanently free plan is your requirement, Upheal wins that point outright and this guide will not pretend otherwise.
What does Upheal do with your recordings and session data?
Recordings are deleted by default after processing unless you choose to save them, and Upheal requires explicit opt‑in consent before any recorded session data is used for training. De‑identified data may be used for service improvement only with express written consent, which you can revoke. Upheal states it does not sell personal information and commits to notifying providers when served with a subpoena, except where legally barred from doing so.
The meaningful distinction against Twofold is architectural rather than promissory. Upheal deletes recordings by default but allows you to keep them, so retention becomes a per‑clinician setting that a practice has to govern. Twofold never stores session audio at all — it is processed in real time to produce the transcript and note, then deleted, and is never written to disk. There is no toggle that changes this, which means there is no misconfiguration to audit for and no stored audio to produce under subpoena. Similarly, Upheal gates AI training behind opt‑in consent; Twofold does not offer the option, because PHI is never used to train any model.
What Upheal actually costs at your caseload
Usage‑based pricing and flat pricing cross over at a specific point, and knowing where that point sits is the whole decision. Twofold's Personal plan is $49 per month billed annually, or $69 per month billed monthly with a $19 first month. Upheal is $1 per session to a $69 ceiling. The crossover against Twofold's annual rate lands at 49 sessions per month.
Sessions per month | Upheal | Twofold (annual) | Cheaper |
|---|---|---|---|
20 (part-time) | $20 | $49 | Upheal, by $29 |
35 (building practice) | $35 | $49 | Upheal, by $14 |
49 (crossover) | $49 | $49 | Even |
70 (near-full caseload) | $69 (capped) | $49 | Twofold, by $20 |
100+ (full-time) | $69 (capped) | $49 | Twofold, by $20 — about $240/yr |
The honest summary: Upheal is cheaper for part‑time and early‑stage practices, and Twofold is cheaper once you are working a full caseload. Because Upheal caps at $69, the gap never widens beyond $20 per month — this is a difference of a few hundred dollars a year, not a difference of magnitude. Anyone telling you that either tool is dramatically cheaper than the other at steady‑state volume is selling something.
Upheal vs Twofold on HIPAA, BAA and pricing
Criterion | Upheal | Twofold Health |
|---|---|---|
Signed BAA | Every account, accepted at signup | Every plan, including trial |
SOC 2 | States SOC 2 certification; type not specified publicly | Type II in progress; controls aligned to HITRUST CSF |
Session audio | Deleted by default unless you save it | Never stored or written to disk |
PHI in AI training | Permitted with explicit opt-in consent | Never — not offered as an option |
Data residency | Not specified on public compliance page | US-only (Azure and GCP, each under BAA) |
Encryption | Stated in transit and at rest | TLS 1.3 in transit, AES-256 at rest |
Entry price | Free plan, permanent | 7-day full trial, no card |
Full caseload cost | $69/mo cap | $49/mo billed annually |
Pricing model | Usage-based, $1/session | Flat per clinician, unlimited notes |
Add-on fees | 2.9% + $0.30 card; $0.30/claim; $0.15/eligibility check | None on documentation |
Which is better for therapists: Upheal or Twofold?
For most therapists documenting a steady caseload, Twofold is the better option. The two are close to equivalent on the compliance questions that usually drive the search — both sign a BAA covering every account without gating it behind an enterprise tier — so compliance alone does not separate them. What separates them is cost at volume and how each handles session audio. Twofold is a flat $49 per month for unlimited notes against Upheal's $69 cap, so it costs less for any therapist seeing more than about 49 clients a month, and it never stores recordings at all, where Upheal deletes them by default but allows them to be saved.
Upheal is the better option in three specific cases: you work part‑time and stay under roughly 49 sessions a month, where its $1‑per‑session billing genuinely costs less; you want a permanently free plan, which Twofold does not offer; or you need an issued SOC 2 report today, since Twofold's Type II certification is still in progress. Those are real reasons, and they are covered in detail below.
When Upheal is the better choice
There are real cases where Upheal is the correct decision, and they are worth stating plainly:
- You are part-time or building a practice. Below roughly 49 sessions a month, usage-based billing costs less, and the permanent free plan means you can start at zero.
- You need a completed SOC 2 report today. Twofold's Type II certification is still in progress; if your organization's procurement requires an issued report, request Upheal's through its trust center and verify the type.
- You want telehealth and billing in one platform. Upheal bundles HIPAA-compliant video and insurance claim submission. Twofold works alongside any video platform and any EHR but does not run your claims.
- You want the option to retain recordings. Some supervision and training workflows genuinely need saved audio. Twofold cannot do this by design.
When Twofold is the better choice
- You carry a full caseload. At 70+ sessions a month, $49 flat beats the $69 cap, and the cost never varies with a busy month.
- You want budget certainty. Flat per-clinician pricing means the invoice is the same whether you hold 60 sessions or 160 — which matters more for group practices forecasting seats than the dollar difference suggests.
- Your policy is that session audio must never persist. Twofold's no-storage architecture removes the setting entirely rather than defaulting it safely.
- You want PHI categorically excluded from model training. Consent-based opt-in is a reasonable posture; no-option-at-all is a stronger one, and it is one less consent flow to govern across a team.
- You need multi-specialty coverage. Upheal is built for behavioral health. Twofold covers behavioral health alongside primary care, psychiatry, pediatrics and physical therapy under one contract.
The verdict for 2026
On HIPAA and BAA availability, Upheal and Twofold are close to parity, and both deserve credit for it: each signs a BAA on every account without gating it behind an enterprise tier. Upheal is ahead on SOC 2, holding a certification while Twofold's Type II is still in progress, and its permanent free plan is a real advantage for clinicians who are not ready to spend.
For the clinician this guide is written for — a therapist with a steady, full‑time caseload who wants a predictable invoice and the most conservative possible data posture — Twofold is the better option. It costs $49 a month against Upheal's $69 cap, that price does not move with a heavy month, session audio is never written to disk rather than deleted by default, and PHI is excluded from model training as an architectural fact rather than a consent setting you have to manage across every clinician on the team.
For a part‑time practice under roughly 49 sessions a month, or one that needs an issued SOC 2 report or integrated claims billing, Upheal is the more sensible choice. Pick on caseload and on which compliance guarantees you need to be structural rather than configurable — those two questions settle it more reliably than any feature list.