Business Associate Agreements: What Solo Practitioners Need to Know

A Business Associate Agreement is the legal document that makes HIPAA compliance enforceable when you use a vendor to process patient data. If you use an AI scribe without a BAA, HIPAA compliance is not optional — it is impossible.

Why solo practitioners need a BAA

If you are a solo clinician using an AI scribe, your patients' protected health information is leaving your office and going to a third-party vendor's servers. Under HIPAA, that vendor is a "business associate." The law requires a written contract between you and them spelling out their obligations.

Without a BAA:

No enforceable obligations. The vendor is a business associate by law, but there is no contract that you can point to when enforcing their compliance obligations.
No recourse if breached. If the vendor's servers are compromised and patient data is exposed, you cannot sue them for violating the terms of your agreement — because there is no agreement.
Acquisition risk. If the vendor is bought by another company, you have no contractual say in what happens to your patient data.
Regulatory exposure. HIPAA investigators will ask: "Where is your BAA with this vendor?" If the answer is "We don't have one," that is a violation, and you are liable.

Many AI scribe vendors do not offer BAAs to small practices because handling small contracts costs money. They require a minimum 100-clinician organization or a 6-figure annual contract. This leaves solo practitioners in a position where they either:

Use the vendor without a BAA (illegal under HIPAA).
Do not use the vendor at all.
Find a vendor that treats small practices with the same compliance rigor as large ones.

Scriber signs a BAA with every customer at signup, regardless of practice size. You do not negotiate it. You do not need a lawyer to review it. You sign it, and your compliance obligation is in place.

What a BAA actually says

A typical BAA is 15-20 pages of legal language, but the practical substance boils down to these obligations on the vendor:

1. Use limitation. The vendor can only use your patient data to provide the service you hired them for — transcription and note generation. They cannot sell it, use it to train their own AI models, or do anything else with it.

2. Encryption and security. The vendor must encrypt data at rest and in transit using specific standards. AES-256 for data at rest and TLS 1.2+ for data in transit are standard.

3. Access controls. Only people who need to access the data (the vendor's staff processing your transcriptions) can access it. Everyone else is locked out. This is enforced through role-based access control.

4. Audit logging. Every access to patient data is logged. If you ever need to know who looked at what and when, you can get that information.

5. Data deletion and retention. The vendor must have a policy for how long data is kept and when it is deleted. For temporary artifacts like audio, this is usually "as soon as the note is generated." For clinical notes, the vendor keeps them for as long as you need them.

6. Breach notification. If patient data is compromised, the vendor must notify you immediately and help you notify affected patients.

7. Subpoena cooperation. If law enforcement or a court asks the vendor for patient data, the vendor must tell you first (unless a court orders them not to) and comply only with legal process.

8. Termination of the contract. When you stop using the vendor, they must delete or return all your patient data within a specified timeframe.

9. Audit rights. You (or your compliance officer) can audit the vendor's security controls and get regular compliance certifications.

10. Data ownership. You own your patient data. The vendor is just holding it and processing it on your behalf.

The BAA signing process with Scriber

Scriber's BAA process is designed for small practices and solo clinicians:

Sign up for Scriber and choose your practice type (solo, small group, etc.).
The BAA is presented during onboarding. You review it (or have your lawyer review it — the BAA is straightforward and most compliance attorneys can review it in 30 minutes).
You sign electronically and the BAA is countersigned and takes effect immediately.
You are covered. Your patient data is now protected under a signed contract.

That is it. No minimum contract size, no negotiation required, no 90-day legal review cycle. Scriber treats solo practitioners the same as large health systems when it comes to compliance.

If you have questions about the BAA or want your lawyer to review it before you sign, Scriber provides a clean copy in advance. Compliance teams typically ask for a SOC 2 Type II audit report as well — Scriber has one and will share it under NDA.

What happens to your data under the BAA

Once the BAA is in place:

Audio files are encrypted, processed for transcription, and deleted (typically within 24 hours).
Generated notes are encrypted and stored for as long as you need them. You can download, export, or delete them yourself.
Audit logs of all access are maintained and available to you on request.
Your practice data (clinician names, practice address) is used only for operational purposes like sending you email notifications. It is not shared with anyone else.

If you ever close your account or want all data deleted, Scriber provides a data export and then deletes everything within 30 days (or per your state's medical record retention law if retention is required).

What a BAA does not do

A few clarifications on what is often misunderstood:

A BAA does not guarantee perfect security. It requires the vendor to implement reasonable safeguards and audit them. "Reasonable" is the HIPAA standard, not "military grade." If a vendor claims unbreakable security, they are overselling.
A BAA does not mean the vendor is HIPAA-compliant without doing anything else. You (the covered entity) are responsible for choosing vendors, auditing them, and making sure your overall practice infrastructure is compliant. The BAA is one piece of the puzzle.
A BAA does not prevent breaches. It requires the vendor to disclose them if they happen and to provide you with information you need to notify patients. The goal is to detect and respond to breaches, not prevent them entirely.
A BAA does not restrict how you use the notes Scriber generates. Once the note is in your hands, what you do with it is up to you and your state laws. You can file it in your EHR, print it, share it with other providers, archive it — the BAA does not govern that.

Common concerns from solo practitioners

"If I sign a BAA, am I liable if Scriber gets breached?" No. The BAA spells out Scriber's obligations, and if Scriber fails to meet them, Scriber is liable to you. Your liability is limited to making sure you chose a compliant vendor. Once you have a signed BAA and Scriber is doing what the BAA requires, you have done your due diligence. If Scriber is breached and you can show the BAA was in place, your compliance posture is strong.

"What if Scriber goes out of business?" The BAA requires Scriber to return or delete your data within 30 days of termination. If Scriber's assets are sold to another company, Scriber is required to notify you. Your data is yours to control.

"Do I need a lawyer to review the BAA?" You do not have to, but you can. Many solo practitioners just sign it; others have their attorney review it in under an hour. Scriber's BAA is standard and not unusual in any way.

"Does the BAA cover telehealth platforms like Doxy.me?" Scriber's BAA covers Scriber's processing of your patient data. Doxy.me (or Zoom, Google Meet, etc.) has its own BAA with you. If you use Scriber with Doxy.me, you have a BAA with each vendor. This is standard and compliant.

Bottom line

A BAA is not a burden for solo practitioners — it is a protection. It puts in writing what the vendor's compliance obligations are and gives you recourse if they fail. Scriber makes it simple by offering the BAA at signup with no minimum practice size. For solo clinicians, this is the difference between using an AI scribe legally and using it without a compliance net.

BAA for Solo Practitioners: What You Really Need | Scriber Wiki