HIPAA and AI Medical Scribes: What Physicians Need to Verify
Some AI medical scribes may handle Protected Health Information (PHI). Before using any vendor with identifiable patient information, understand the applicable HIPAA requirements.
The Core HIPAA Requirement: The BAA
When you use an AI medical scribe, the vendor becomes a Business Associate — a third party that handles PHI on behalf of your practice. HIPAA requires a written Business Associate Agreement (BAA) between your practice and any Business Associate before PHI is shared or processed.
Without a signed BAA, using any AI tool that processes patient conversation data — regardless of how the vendor describes its security — creates direct HIPAA liability for your practice. The BAA is not a technicality. It is the legal foundation that makes the relationship compliant.
What to Verify Before Using Any AI Scribe
1. Does the vendor offer a BAA?
Request the BAA explicitly before any clinical use. If a vendor cannot provide a BAA or says one isn't necessary, do not use the tool with patient data.
2. Where is patient audio stored?
Ask where recordings are stored, for how long, who can access them, and how they are encrypted. The vendor's BAA should cover this — but verify the specifics.
3. Is data used for AI training?
Some AI tools use customer data to train models. In a clinical context, this requires careful review. Your BAA should specify whether and how patient data may be used for model development.
4. What is the breach notification protocol?
HIPAA requires Business Associates to notify covered entities of breaches within a specific timeframe. The BAA should specify the vendor's breach notification obligations.
5. Is the tool purpose-built for healthcare?
General-purpose AI tools (consumer transcription services, general LLMs) are not designed for clinical use and typically do not offer healthcare BAAs. Use purpose-built clinical AI tools.
Why Independent Physicians Face More Exposure
Physicians in health systems have compliance teams that vet vendors before deployment. Independent physicians often don't have that backstop — you're making this decision yourself. That makes the BAA verification even more critical.
The good news: requesting a BAA is a standard part of any clinical AI vendor relationship. A vendor that can't provide one is not suitable for clinical use, and knowing that quickly saves you from a serious compliance risk.
NoPajamaTime and HIPAA
The current NoPajamaTime service is restricted to de-identified or fictional data, and no BAA is currently offered. Do not submit identifiable patient information unless NoPajamaTime later gives written confirmation that the full required contract chain is in place.
Ready to evaluate NoPajamaTime?
Start with fictional or de-identified data only. No BAA is currently offered. Create and review one note during the free 24-hour proof.