"HIPAA compliant" appears on the marketing page of virtually every AI medical scribe on the market. But HIPAA compliance is not a certification — it is a set of requirements, and meeting them is the vendor's responsibility to demonstrate, not just claim. Before signing up for any AI scribe platform, these are the specific questions to ask.
1. Do you sign a Business Associate Agreement (BAA)?
A BAA is a legally required contract between a covered entity (your practice) and any business associate that handles protected health information (PHI) on your behalf. Without a signed BAA, using an AI scribe with patient audio is a HIPAA violation regardless of how the vendor describes their security.
Every legitimate AI medical scribe vendor will sign a BAA. Ask for it before you create an account.
2. Where is audio stored, and for how long?
Patient audio from clinical consultations is PHI. Ask: Is audio retained after the note is generated? If so, where is it stored, for how long, and who has access? The safest answer is that audio is deleted immediately after transcription. Some vendors retain audio for model training — a practice that requires specific patient consent.
3. Where is patient data stored?
Data residency matters for HIPAA. US patient data should be stored on US-based servers. Ask which cloud provider the vendor uses and whether their infrastructure is covered by a BAA with that provider. NexiScribe operates on Google Cloud Platform (GCP) with a signed GCP Business Associate Agreement — patient data is stored in US-based HIPAA-eligible infrastructure.
4. Is the connection encrypted?
Audio transmission from your device to the vendor's servers should use TLS encryption in transit. Data at rest should use AES-256 encryption. These are table-stakes requirements — any vendor that cannot confirm both should be disqualified immediately.
5. Is patient data used to train AI models?
This is the question most physicians forget to ask. Some vendors use patient consultation audio and notes to improve their AI models. This may be legal with appropriate consent, but it is a practice you should know about before it involves your patients' data.
NexiScribe does not use patient consultation data to train AI models.
