HIPAA Compliant AI Scribe
What makes an AI scribe HIPAA compliant: the BAA, the safeguards and six questions to ask any vendor, with our own answers and the sources.
The Short Answer
No AI scribe is "HIPAA certified", because no such certification exists. The U.S. Department of Health and Human Services says it "does not endorse or otherwise recognize private organizations' 'certifications' regarding the Security Rule" (HHS FAQ). "HIPAA compliant" is a statement a vendor makes about itself, so the useful question is what you can check.
- Will the vendor sign a business associate agreement (BAA)? The rules require this in writing before a vendor handles patient information for you.
- What happens to the recording? How long it is kept and whether it is used to train AI.
- Who else handles the data? The companies the vendor sends recordings and notes to, and whether the same terms bind them.
- What stays your job? Patient consent, your risk analysis and reading every note stay with the practice.
VoiceboxMD in one paragraph: a BAA is included on every plan, including the trial. Visit audio is deleted within 7 days. VoiceboxMD does not train AI on your recordings. Each clinician signs in with their own login. The details and the sources are below.
This page is general information, not legal advice. Your compliance officer or attorney decides what your practice needs.
What HIPAA Compliant Means for an AI Scribe
An AI scribe hears the visit and writes the note, so it handles patient information on your behalf. Under HIPAA that makes the vendor your business associate. HHS gives this example of a business associate: "Independent medical transcriptionist, or the vendor of an app, that provides transcription services to a physician" (HHS, Business Associates). Three duties follow from that.
A written agreement
A practice may let a business associate handle patient information "if the covered entity obtains satisfactory assurance that the business associate will appropriately safeguard the information". Those assurances "must be documented through a written contract" or other written agreement (45 CFR 164.502(e)).
Security Rule safeguards
The Security Rule applies to the vendor directly. Its technical safeguards cover access control, audit controls, integrity, person or entity authentication and transmission security (45 CFR 164.312).
Breach notice
A business associate that discovers a breach must tell the practice "without unreasonable delay and in no case later than 60 calendar days after discovery" (45 CFR 164.410).
See it in your own EHR. The trial takes minutes, no sales call.
Try it freeWhat the BAA Has to Say
The Privacy Rule lists what a business associate contract must contain. These are the terms that matter most when the business associate is an AI scribe. The source for every row is 45 CFR 164.504(e)(2).
| The contract must | Why it matters for a scribe |
|---|---|
| Set out the permitted and required uses of patient information | It limits what the vendor may do with recordings and notes |
| Require appropriate safeguards and compliance with the Security Rule for electronic information | The vendor commits to the safeguards in writing |
| Require the vendor to report any use or disclosure the contract does not allow, including breaches | You hear about a problem from the vendor, not from a patient |
| Hold subcontractors to the same restrictions | The same terms reach the companies the vendor sends data to |
| Require the vendor to return or destroy patient information when the contract ends, if feasible | Your patients' data does not stay behind after you leave |
| Let the practice end the contract if the vendor violates a material term | You can leave if the vendor breaks the agreement |
Six Questions to Ask Any AI Scribe Vendor
- Will you sign a BAA, and does it cover the free trial?
- How long do you keep the recording, and is deletion automatic?
- Are my recordings or notes used to train AI, by you or by the companies you send them to?
- Which other companies process my patients' information?
- Does each clinician sign in with their own login?
- Does patient information reach your analytics or advertising tools?
How VoiceboxMD Answers Them
| Question | VoiceboxMD's answer |
|---|---|
| BAA | Yes, on every plan at no extra cost, including the trial. Write to support@voiceboxmd.com and we send it for signature. Sign it before you record a real patient. |
| Recording retention | Visit audio is deleted within 7 days. A scheduled job checks every 15 minutes and records each deletion. Notes stay in your account. |
| AI training | VoiceboxMD does not train AI on your recordings. That statement covers VoiceboxMD. Ask us where each of our vendors stands. |
| Other companies | A cloud provider stores the database and files. A speech recognition service transcribes the audio. A language model service drafts the note from the transcript. We name them on request. |
| Sign-in | Each clinician signs in with their own email and a password of at least 12 characters. |
| Analytics | Patient information is not sent to analytics. Events carry identifiers and fixed labels only, and a guard blocks anything else. |
Clinical data is also separated by practice in the database itself, not only in the app. Our security page covers this in more depth.
What Stays Your Job
No vendor can take these four over. The note stays yours as well: the AI drafts, and you review, correct and sign it in your EHR.
Sign the BAA first
Ask for the BAA when you start the trial and sign it before the first real patient. Until then, test with a made-up visit.
Add the scribe to your risk analysis
The Security Rule requires "an accurate and thorough assessment of the potential risks and vulnerabilities" to electronic patient information (45 CFR 164.308). A tool that records visits belongs in that assessment.
Tell your patients
Recording a conversation is also covered by state law, and the rules differ. Some states require everyone in the conversation to agree. Follow your state's rule and your organization's policy, and document consent the way your practice already does.
Give each clinician their own login
The Security Rule requires a unique name or number for each user (45 CFR 164.312). VoiceboxMD is priced per clinician, so nobody needs to share an account.
How We Wrote This Page
Every statement about the HIPAA rules is quoted from the regulation or from HHS, and each one is linked where it appears. We read the regulation text in the Electronic Code of Federal Regulations as it stood on November 1, 2026, and the two HHS pages on November 11, 2026. HHS marks its certification FAQ as last reviewed on July 26, 2013 and its Business Associates page as last reviewed on October 21, 2026.
Every statement about VoiceboxMD was checked against the product on November 11, 2026. VoiceboxMD publishes this page and sells an AI scribe, so read our answers the way you would read any vendor's: ask for the BAA and check them. See the AI medical scribe page for what the product does and pricing for what it costs.
Frequently Asked Questions About HIPAA and AI Scribes
Is there a HIPAA certified AI scribe?
No. There is no official HIPAA certification for any product. HHS says it does not endorse or otherwise recognize private organizations' certifications regarding the Security Rule. A vendor can only tell you what it does, sign a business associate agreement and show you evidence.
Does HIPAA require a BAA with an AI scribe vendor?
A vendor that records or transcribes visits for a practice handles patient information on its behalf, which makes it a business associate. The Privacy Rule requires the practice to have written assurances from a business associate, in the form of a contract, before the vendor handles that information. This is general information, not legal advice.
Does VoiceboxMD sign a BAA?
Yes. A business associate agreement is included on every plan at no extra cost, including the free trial. Write to support@voiceboxmd.com and we send it for signature. Sign it before you record a real patient.
How long does VoiceboxMD keep recordings?
Visit audio is deleted within 7 days. A scheduled job checks every 15 minutes, removes any recording past its deadline and records the deletion. The note stays in your account.
Does VoiceboxMD use my recordings to train AI?
VoiceboxMD does not train AI on your recordings. That statement covers VoiceboxMD itself. Ask us where each of our vendors stands and we will tell you.
Do I need patient consent to use an AI scribe?
HIPAA is not the only rule that applies. State laws on recording conversations differ, and some require everyone in the conversation to agree. Follow your state's rule and your organization's policy, and document consent the way your practice already does.
Is a free AI scribe HIPAA compliant?
Price does not decide it. Ask the vendor the same questions as any other: whether it signs a business associate agreement on the free plan, how long it keeps recordings and whether they are used to train AI.
Try VoiceboxMD on Your Own Visits
VoiceboxMD includes the ambient AI scribe, live dictation and your own templates on every plan, with a BAA. Monthly plans start with a 7-day free trial and annual plans with 14 days, on the plan you choose. A card is collected at checkout and is not charged during the trial. No setup fees.
Last updated November 11, 2026. This page is general information about HIPAA and about VoiceboxMD as of that date. It is not legal advice.
Try it on your own charts
No demo, no sales call required. Set up your free trial in minutes.
Start free trial