HIPAA-compliant AI medical scribes: what to look for

Choosing a HIPAA AI scribe for 2026? Verify vendor BAA, encryption at rest, audit logs, and data deletion policies before signing.

9 Jun 2026 9 min read

HIPAA-compliant AI medical scribes: what to look for

A 2025 OCR settlement cost one pediatric clinic $240,000 for unsecured ePHI exposure through a third-party transcription vendor. The vendor lacked a signed Business Associate Agreement. The clinic thought "HIPAA-compliant" was a marketing claim, not a legal obligation.

If you're evaluating an AI scribe for your practice, you're likely choosing between vendors whose websites all promise "HIPAA compliance." Yet 68% of small practices have never reviewed a BAA or verified server-side encryption policies before deploying a new clinical tool.

This guide walks you through the technical and legal checklist you need before signing with any HIPAA AI scribe vendor in 2026. You'll learn what to verify in contracts, which encryption standards matter, and what questions separate marketing from actual compliance.

What HIPAA compliance actually requires from an AI scribe vendor

HIPAA doesn't certify vendors. The U.S. Department of Health and Human Services does not issue "HIPAA-certified" stamps. Any vendor claiming certification is misrepresenting the framework.

Instead, HIPAA requires covered entities (you) to ensure that business associates (the AI scribe vendor) implement administrative, physical, and technical safeguards when handling ePHI. The vendor must sign a Business Associate Agreement that binds them to those obligations.

A compliant HIPAA AI scribe must:

• Sign a BAA enumerating permitted uses of ePHI and subcontractor disclosure limits.
• Encrypt data at rest (minimum AES-256) and in transit (TLS 1.2+).
• Provide access controls, audit logging, and breach notification procedures.
• Document data retention and deletion policies aligned with your practice's record retention schedule.
• Train staff on HIPAA security rules and maintain internal compliance programs.

If the vendor refuses to sign a BAA or pushes you to a "privacy policy" instead, walk away. Without a BAA, you are liable for any breach originating from their systems.

Verifying encryption: at rest, in transit, and at the model layer

Encryption protects ePHI in three stages: storage, transmission, and processing. Many vendors encrypt during upload but store plaintext transcripts on unencrypted databases.

Ask the vendor:

• At rest: AES-256 or equivalent for database storage. Confirm whether encryption keys are managed by the vendor or a third-party key management service (AWS KMS, Azure Key Vault). Vendor-managed keys reduce your control; third-party KMS is preferable if you want separation of duties.
• In transit: TLS 1.2 or higher for all API calls. Verify that audio uploads use HTTPS with valid certificates, not self-signed or expired certs.
• During processing: Does the AI model process ePHI in memory only, or is audio temporarily persisted to disk before transcription? Some vendors cache files in unencrypted temp storage during batch jobs. Confirm deletion timeframes.

HIPAA doesn't prohibit storing data outside the U.S., but many states have explicit requirements. New York's SHIELD Act and California's CMIA impose additional safeguards. If you practice in the EU or treat EU residents via telemedicine, GDPR applies concurrently with HIPAA — and GDPR is stricter about cross-border transfer.

The Business Associate Agreement: non-negotiable clauses

The BAA is your primary enforcement mechanism. It must specify:

• Permitted uses: The vendor may only use ePHI for transcription and related services you authorize. Marketing, analytics, or model training on your patient data requires explicit opt-in and separate consent.
• Subcontractors: If the vendor relies on cloud infrastructure (AWS, Google Cloud) or third-party NLP engines, those subcontractors must also sign downstream BAAs. Confirm whether the vendor discloses subcontractor identities and updates you when they change.
• Breach notification: Within 60 days of discovery, the vendor must notify you of any unauthorized access or disclosure. You then notify patients within 60 days of learning of the breach (total 120 days from discovery). Delays cost practices tens of thousands in OCR penalties.
• Data retention and destruction: The BAA should align with your state's medical record retention requirements (typically 7–10 years for adults, longer for minors). When the contract ends, the vendor must return or destroy all ePHI within 30 days and certify destruction in writing.
• Right to audit: You (or an independent auditor) have the right to inspect the vendor's safeguards. Most vendors resist full audits but should provide SOC 2 Type II reports or attestation letters annually.

If the vendor's standard BAA excludes any of these clauses, request amendments. A vendor unwilling to negotiate data destruction timelines or subcontractor disclosure is prioritizing operational convenience over your legal exposure.

Audit logs and access controls: who touched your data?

HIPAA's Security Rule mandates audit controls: you must know who accessed ePHI, when, and for what purpose. The AI scribe vendor should log:

• User authentication events (login, logout, failed attempts).
• Audio upload timestamps and originating IP addresses.
• Transcript generation and retrieval.
• Data exports or integrations with EHR systems.
• Administrative changes (user additions, permission edits).

Logs should be immutable and retained for at least six years (§164.316(b)(2)(i)). Ask whether you can export logs on demand or whether the vendor requires a formal request process.

Role-based access control (RBAC) limits data exposure. Only the physician who recorded the visit should access that transcript by default. Administrative staff may need read-only access for billing or scheduling, but blanket access for all users in your practice violates minimum necessary principles.

If the scribe integrates with your EHR, confirm that API calls enforce OAuth 2.0 or similar token-based authentication and that tokens expire after short intervals (15–60 minutes). Persistent, non-expiring API keys are security liabilities.

Data deletion policies: does the audio disappear?

Some AI scribes retain raw audio indefinitely for "quality improvement" or "model retraining." Others delete audio within minutes of transcription. The difference matters under both HIPAA and state wiretap laws.

Confirm in writing:

• When the audio file is deleted (immediately, within one hour, or longer).
• Whether any copy persists in backup systems or disaster recovery snapshots.
• How you can verify deletion (audit log entry, API confirmation, automated email).

If the vendor claims "we don't store audio," ask whether backups or CDN edge caches temporarily hold copies. Many vendors use distributed caching for performance but fail to purge caches on schedule.

Under GDPR Article 17 (if treating EU patients), patients have a right to erasure. The AI scribe must support deletion requests you forward from patients within 30 days.

Minimum necessary and de-identification: does the AI need full PHI?

HIPAA's minimum necessary standard requires limiting ePHI access to the minimum needed for the intended purpose. If the AI scribe only needs visit audio and demographic context, it shouldn't ingest full EHR data dumps.

Some vendors request API access to your EHR to pre-populate templates with patient history. Confirm:

• Which data fields the integration pulls (problem list, medication list, allergies, vitals).
• Whether the vendor caches that data or discards it after note generation.
• Whether you can restrict API permissions to read-only and specific patient encounters.

De-identification under §164.514(b) removes 18 HIPAA identifiers, rendering data exempt from Privacy Rule restrictions. If you want to use AI-generated notes for research or training without patient consent, the vendor must support programmatic de-identification (redacting names, MRNs, dates, addresses). Manual de-identification after export is time-consuming and error-prone.

Ask whether the vendor offers a de-identified export mode and whether it uses regex-based redaction (prone to false negatives) or NLP entity recognition (more reliable but computationally expensive).

Red flags: what disqualifies a vendor immediately

Reject any HIPAA AI scribe vendor that:

• Refuses to sign a BAA before trial or "evaluation period."
• Markets itself as "HIPAA-certified" or "FDA-approved" when it is neither.
• Requires you to accept a unilateral privacy policy instead of negotiating contract terms.
• Stores data in regions without equivalent legal protections (e.g., countries lacking adequacy decisions under GDPR).
• Uses patient audio for model training without explicit, separate consent from you and the patient.
• Cannot produce a SOC 2 Type II report, ISO 27001 certificate, or HITRUST certification (one of the three is table stakes in 2026).
• Fails to document subprocessors or cloud infrastructure providers in writing.
• Offers no data portability mechanism if you terminate the contract.

If the vendor's leadership team has no prior healthcare compliance experience and the website lacks a compliance or legal documentation page, that's an institutional red flag. HIPAA compliance is not a feature you bolt on — it's foundational architecture.

Frequently asked questions

No. One BAA covers the entire covered entity (your practice). Individual physicians don't sign BAAs with vendors; the practice administrator or compliance officer signs on behalf of the organization. However, each physician must acknowledge internal HIPAA policies governing use of the AI scribe.

Anonymization is difficult to execute correctly. If the audio contains any of the 18 HIPAA identifiers — patient name spoken aloud, date of birth, address fragments — it remains PHI. Unless you implement a certified de-identification workflow before upload, you need a BAA. Most practices lack the technical capacity to reliably strip identifiers from audio in real time.

You are still liable for notifying affected patients and OCR, but the BAA shifts some financial and legal responsibility to the vendor. The vendor must indemnify you for costs directly attributable to their negligence. Without a BAA, you bear full liability because you violated HIPAA by disclosing ePHI to an unauthorized party.

Annually, or whenever the vendor changes ownership, infrastructure providers, or data processing locations. Request updated SOC 2 reports each year and review breach logs quarterly. If the vendor resists transparency, consider switching before a compliance gap becomes an OCR investigation.

HIPAA does not require on-premises storage. Cloud deployment is compliant if the cloud provider (AWS, Azure, Google Cloud) signs a BAA and implements required safeguards. Most modern HIPAA AI scribe platforms use cloud infrastructure; the key is ensuring the vendor manages encryption, access controls, and audit logging correctly.

Related articles

• Where is AI-transcribed medical data stored? — 2026 infrastructure, regional compliance, and retention policies
• Privacy by design in AI medical applications — GDPR Article 25 principles for clinical AI architecture
• Free vs paid AI medical scribes: real differences — compliance gaps in consumer-grade transcription tools