A Clinician's HIPAA Primer for Evaluating AI Medical Scribes

You found an AI scribe that looks promising. The demo was smooth, the note quality was good, and the price is reasonable. Then you try to get a Business Associate Agreement before your first session, and the vendor's answer is some version of "that's for enterprise plans." At that point, the evaluation is over — whether you realize it or not.

HIPAA compliance is not a checkbox. It is a legal prerequisite. Before you route a single real patient session through any AI tool, you need to understand what the law actually requires of a scribe vendor and what separates a genuinely compliant product from one that uses the word "compliant" as marketing copy.

This primer covers what clinicians need to know, and nothing more.

Covered Entities and Business Associates

HIPAA divides the healthcare world into two categories: covered entities and business associates.

A covered entity is a healthcare provider who transmits health information electronically, a health plan, or a healthcare clearinghouse. If you bill insurance, you are a covered entity. If you are a solo therapist who only takes cash, the analysis is more nuanced — but if you use any electronic health record, generate electronic documentation, or use cloud software that processes patient information, you are almost certainly a covered entity.

A business associate is any person or organization that creates, receives, maintains, or transmits protected health information (PHI) on behalf of a covered entity. An AI medical scribe fits this definition squarely. When your scribe vendor's servers receive audio of a therapy session, process that audio through a transcription engine, and return a clinical note — PHI has traveled through their infrastructure. That vendor is your business associate.

This matters because HIPAA requires covered entities to have a written contract with every business associate before any PHI changes hands. That contract is the Business Associate Agreement.

What a BAA Actually Does

A Business Associate Agreement is not a formality. It is the legal instrument that:

Defines permitted uses of PHI. A properly written BAA limits the vendor to using your patient data only to provide the contracted service — not for product development, not for AI model training, not for analytics sold to third parties.
Establishes security obligations. The vendor commits to implementing the HIPAA Security Rule safeguards: AES-256 encryption at rest, TLS in transit, access controls, audit logging.
Sets breach notification timelines. HIPAA requires notification within 60 days of discovering a breach. Your BAA should specify the vendor's obligation to notify you, and how fast.
Governs what happens to data when you leave. The BAA must address return or destruction of PHI upon contract termination. Vendors who retain data for "product improvement" after you cancel are a problem.
Creates legal accountability. Without a BAA, if a breach occurs, your exposure is greater and the vendor's contractual obligation to cooperate is not guaranteed.

A vendor who cannot or will not sign a BAA is not a compliant vendor — regardless of what their website says.

What HIPAA Requires of a Scribe Vendor

The HIPAA Security Rule lays out three categories of safeguards. Any AI scribe vendor you evaluate should be able to demonstrate all three.

Administrative safeguards include a written security management process, designated security personnel, workforce training, and a contingency plan for system failures. Ask for their SOC 2 Type II report. If they cannot produce one, proceed cautiously.

Physical safeguards govern where servers physically live and who can access them. "We use AWS" or "we use Azure" is not a complete answer. The question is whether that cloud environment is configured to HIPAA standards and whether the cloud provider has signed their own BAA with the scribe vendor. Azure, AWS, and Google Cloud all offer HIPAA-eligible services and will sign BAAs — but only if the vendor has actually configured their environment within those services' compliance scopes.

Technical safeguards are what most clinicians focus on because they are the most visible: encryption in transit (TLS 1.2 or higher), encryption at rest (AES-256), unique user identifiers, automatic session timeouts, audit logs, and integrity controls to prevent unauthorized modification of records.

For audio specifically, the minimum necessary standard applies: audio should be processed and discarded. A vendor who retains audio indefinitely — for any stated reason — is carrying PHI longer than the HIPAA minimum necessary standard requires, and that retention is a liability you inherit.

Common Red Flags When Evaluating Vendors

These are the patterns that should end a vendor evaluation before it goes further.

Red Flag	Why It Matters
No BAA at signup; requires "enterprise" plan	You cannot record PHI without a BAA in place. Period.
Audio retained after note generation	Retention beyond what is necessary violates the minimum necessary standard and creates breach exposure.
Third-party transcription without a sub-BAA	If the vendor uses Deepgram, AssemblyAI, or another third-party speech engine, that engine is a sub-processor touching PHI. The vendor must have a BAA with that engine.
No SOC 2 Type II report available	SOC 2 Type II is the industry standard for demonstrating security controls are actually in place and operating.
Privacy policy allows training on your data	Patient data cannot be used to train general AI models without explicit patient authorization.
No breach notification timeline specified	"We will notify you" is not enough. The BAA should specify a timeline.
Data stored outside HIPAA-eligible cloud environments	General-purpose cloud configurations are not automatically HIPAA-eligible.
Session timeout is not configurable or absent	Unattended sessions with PHI visible are a Security Rule violation.

What to Ask Every Vendor Before You Trial

Do not rely on the marketing page. Run every candidate through this checklist directly — in writing, so you have a record.

BAA and legal:

Is a BAA available before I enter any patient data, on the plan I am evaluating?
Can I receive a copy of the BAA to review before signing up?
Does your BAA address sub-processors, including your transcription engine provider?
What is your breach notification timeline in the BAA?
How is PHI handled when I cancel?

Data handling:

Is audio retained after the note is generated? If yes, for how long and why?
Is my patient data used for training AI models?
Do you share or sell any derived data with third parties?

Security:

What encryption standard is used at rest and in transit?
Which cloud provider hosts my data, and is that environment HIPAA-eligible?
Does your cloud provider have a signed BAA with you?
Do you have a SOC 2 Type II report I can review?

Operational:

Where are your servers physically located?
What is your access control model — who at your company can access PHI?
How are audit logs maintained and for how long?

Scriber's Compliance Posture

Scriber signs a Business Associate Agreement with every user at signup, on every paid plan. There is no enterprise gate and no sales call required. You can review the BAA before you create an account.

Audio is processed in memory and discarded once the transcript and note are generated. Nothing is retained for training, debugging, or analytics. The infrastructure runs on Microsoft Azure, which is a HIPAA-eligible cloud environment covered by Microsoft's own HIPAA BAA with Scriber. Encryption is AES-256 at rest and TLS 1.2+ in transit.

Details are on the security page and the BAA page. Clinicians running solo or small practices should also see Scriber for therapists and Scriber for psychologists for practice-size-specific information.

The Evaluation Threshold

Most vendors will pass the demo. Far fewer will pass a direct BAA inquiry before you spend time on a full trial. Start with the BAA question — it is the fastest filter and the most consequential one.

If a vendor requires you to be on an enterprise plan to receive a BAA, the product is not available to you in a compliant form at the tier you are evaluating. Move on.

HIPAA violations in this context are not hypothetical. The Department of Health and Human Services Office for Civil Rights has imposed fines against covered entities who used software vendors without a BAA in place. The vendor often receives a separate fine. Neither outcome is good for a clinical practice.

Evaluate AI scribes the same way you evaluate any other clinical tool: efficacy first, safety always.

Ready to see Scriber's compliance documentation? Review the BAA and security details before your first session — no sales call required. Or explore how Scriber is built for HIPAA-compliant clinical documentation and the AI scribe wiki for deeper technical and clinical context.