Why BAA at Signup Matters for Solo and Small-Practice Clinicians

If you are a solo clinician evaluating AI scribes, you have probably hit this wall: you find a product you like, you try to get compliant before using it with real patients, and you discover that a Business Associate Agreement requires an "enterprise" plan, a custom quote, or a call with a sales team. You are on the $29-per-month individual plan. You are not enterprise. You move on, or — more often than vendors would like to admit — you start using the product anyway.

That second outcome is a HIPAA violation.

This post explains what a BAA actually is, why some vendors gate it, what the legal and financial consequences are for a solo clinician who records PHI without one, and how to identify vendors who take compliance seriously enough to make it available before a session starts.

What a BAA Is and What It Is Not

A Business Associate Agreement is a contract. HIPAA requires it. That is the short version.

The longer version: under the Health Insurance Portability and Accountability Act, any organization that creates, receives, maintains, or transmits protected health information on your behalf is classified as a "business associate." An AI scribe vendor is a business associate the moment you click record on a session with a real patient, because their servers receive and process audio that is PHI.

HIPAA's Privacy Rule and Security Rule both require that covered entities — which includes most practicing clinicians — have a signed BAA with every business associate before any PHI is exchanged. This is not ambiguous. It is one of the most clearly stated requirements in the law.

The BAA is not a rubber stamp. A properly written agreement does three things:

Limits how the vendor can use your patient data. They can process it to provide the service. They cannot use it to train AI models, sell derived insights, or share it with other parties outside those expressly named in the agreement.
Defines the vendor's security obligations. Encryption standards, access controls, breach notification timelines, and incident response procedures are all specified.
Creates legal accountability. If the vendor mishandles PHI, the BAA governs the consequences. Without it, your exposure as the covered entity is higher and the vendor's obligation to cooperate in remediation is not contractually guaranteed.

What a BAA is not: a guarantee that a vendor is actually secure. A BAA is a legal instrument. Whether the vendor's engineering actually implements what the BAA promises is a separate question, which is why SOC 2 Type II reports, third-party audits, and published security documentation matter alongside the BAA.

Why Some Vendors Gate the BAA

There is a real business reason and a cynical business reason.

The real reason: BAA management has legal overhead. Enterprise sales teams negotiate custom terms, legal teams review indemnification clauses, and compliance officers maintain the executed agreement inventory. For a vendor whose business model centers on large group practices and hospital systems, the cost of reviewing and countersigning a BAA for every $29-per-month user is high relative to that user's revenue.

The cynical reason: gating the BAA behind an enterprise tier is a revenue lever. A clinician who has already invested time setting up the product, connecting their workflow, and generating a few sample notes is far more likely to upgrade to a more expensive plan than a clinician who encounters the compliance gate before they start.

The consequence for the clinician is the same in both cases. If you cannot get a BAA at the plan you are on, you cannot use the product in a compliant way.

Some vendors add a layer of ambiguity by claiming that their "free tier" does not involve "real" HIPAA-covered use. This is a rationalization, not a legal defense. If you are entering any information about a real patient — a name, a date, session content, a clinical note — PHI is in the system. The BAA requirement applies.

What Happens If You Record PHI Without a BAA

HIPAA enforcement distinguishes between four tiers of culpability, based on whether the violation was the result of reasonable unawareness, willful neglect that was corrected, or uncorrected willful neglect. Using an AI scribe without a BAA, after you have been put on notice that PHI requires one, falls into the upper tiers.

Penalties are per violation, per year of non-compliance, and have a per-category annual cap of $1.9 million (adjusted for inflation). For a solo clinician, a single OCR investigation can result in:

Fines ranging from $100 to $50,000 per violation, depending on culpability tier
Corrective action plans requiring documented security overhauls audited by HHS
State-level liability, because most states have their own health data privacy laws that parallel and sometimes exceed HIPAA
Reputational exposure — OCR posts the names of covered entities fined on its public breach portal

Enforcement against individual clinicians and small practices has accelerated. The Office for Civil Rights does not reserve investigations for hospital systems. A 2023 settlement involved a solo physician and a $100,000 penalty stemming from inadequate safeguards on an EHR system. The underlying facts were not dramatically different from what happens when a clinician uses a non-BAA'd AI tool.

The risk is not hypothetical. It is scaled to the size of your practice, but it is real.

Vendor Red Flags for Solo and Small Practices

These patterns signal that a vendor is not designed with solo-clinician compliance in mind.

BAA gated behind enterprise tier. If the pricing page shows "BAA available on Business or Enterprise plans," the individual or solo clinician plan is not compliant. This is not a minor inconvenience — it is the product being legally unavailable to you at the price you are evaluating.

"Contact sales" for compliance documentation. If you cannot download and review the BAA before you sign up, that friction is by design. A vendor who is confident in their compliance posture publishes the BAA and lets you read it.

Audio retention for any stated purpose. Some vendors retain audio for "quality improvement," "model training," or "debugging." Retention beyond what is necessary to deliver the service violates HIPAA's minimum necessary standard and creates a larger breach surface. No audio retention is the only defensible position.

Third-party transcription without disclosed sub-BAAs. AI scribe vendors commonly use third-party speech-to-text engines (Deepgram, AssemblyAI, and others). Those engines receive your patient audio. If the vendor has not obtained a BAA from each sub-processor, the chain of custody on PHI has a gap.

Privacy policy allows "aggregate" or "de-identified" data use. De-identification under HIPAA has a specific technical definition under the Safe Harbor method. Vendors who vaguely describe using "de-identified" data for product improvement often have not met that standard. Ask for specifics.

No SOC 2 Type II report. The BAA establishes what the vendor promises. A SOC 2 Type II report, issued by an independent auditor after a 6–12 month observation period, provides evidence that the security controls are actually operating. A vendor who cannot produce one has not been independently verified.

What Good Looks Like

A vendor built for solo clinicians does not make compliance harder for the people who need it most. The checklist is short:

BAA available on every paid plan, including the lowest tier
BAA is readable before signup — no sales call required
Audio discarded after note generation, not retained
Sub-processor BAAs in place for every third-party engine touching PHI
Encryption at rest (AES-256) and in transit (TLS 1.2+)
Cloud infrastructure running on a HIPAA-eligible environment with a cloud-provider BAA
SOC 2 Type II report available on request
Breach notification timeline specified in the BAA (not just "we will notify you")

If a vendor cannot check every item on that list, they are asking you to absorb compliance risk that belongs to them.

Scriber's Approach

Scriber signs a Business Associate Agreement with every user at every paid plan, starting at signup. There is no enterprise gate, no minimum seat count, and no sales call. A solo therapist starting their first AI-assisted documentation workflow receives identical compliance coverage to a 50-clinician group practice.

Audio is processed in memory and discarded the moment the transcript and note are generated. It is never retained for training, debugging, or quality improvement. The infrastructure runs on Microsoft Azure within a HIPAA-eligible configuration, covered by Microsoft's own HIPAA BAA with Scriber. All data is encrypted with AES-256 at rest and TLS 1.2+ in transit.

The BAA and security details are published and readable before you create an account. The security page covers the full technical posture. For practice-size-specific context, Scriber for therapists and Scriber for solo practices cover the solo-clinician workflow. The AI scribe wiki has deeper coverage of compliance questions that come up during evaluation.

The argument for gating the BAA behind an enterprise tier has a logic that makes sense for the vendor's revenue model. It has no logic for your compliance posture.

Review Scriber's BAA before your first session — no sales call, no upgrade required. See what compliance looks like at every plan or explore Scriber's HIPAA-compliant documentation workflow.