Is Your AI Scribe HIPAA Compliant? 8 Questions to Ask Before You Sign

An AI scribe sits in the most private part of your day. It hears symptoms, diagnoses, medications, family history, and sometimes things patients have never told anyone else. Then it turns that into a note and stores it somewhere.

Almost every vendor says “HIPAA compliant” on its homepage. That phrase alone doesn’t tell you much. HHS itself notes that it does not endorse or recognize private “certifications” of Security Rule compliance, and that such certifications don’t relieve organizations of their legal obligations.

So as the covered entity, it’s on you to ask better questions. Here are eight to ask any AI scribe vendor before you sign, what a good answer looks like, and how Chartnote answers each one.

This article is general information, not legal advice. Talk to your compliance officer or attorney about your specific obligations.

1. Will you sign a Business Associate Agreement, and does it cover every plan?

An AI scribe vendor creates, receives, and stores PHI on your behalf, which makes it a business associate. HIPAA requires a written business associate contract that, among other things, requires the vendor to safeguard PHI, report breaches, and pass the same obligations to its own subcontractors.

Ask:

• Is a BAA included, or only on certain tiers?
• Does it cover free and trial accounts?
• When does it take effect: at signup, at first use, or only after a signed order form?

Red flag: “We’ll sign a BAA on our enterprise plan” when you’re about to use a free plan with real patients.

How Chartnote answers: every Chartnote account, including free and trial accounts, is covered by our Business Associate Agreement from first use.

2. How is data encrypted, in transit and at rest?

The HIPAA Security Rule requires administrative, physical, and technical safeguards for electronic PHI. Encryption is one of the most important. HHS breach guidance also names encryption as a way to render PHI unusable to unauthorized people.

Ask:

• What encryption is used in transit (for example, TLS 1.2 or higher)?
• What encryption is used at rest (for example, AES-256)?
• Are backups encrypted too?
• Where is data hosted, and in which country?

How Chartnote answers: all data is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256), including backups. Data is hosted and processed in Amazon Web Services data centers in the United States, and we maintain a BAA and a Data Processing Agreement with AWS. Details are in our Privacy and Security overview.

3. Do you keep the audio, and for how long?

Audio recordings are some of the most sensitive data an AI scribe touches. Some vendors delete audio after the note is generated. Others keep it for quality review or reprocessing. Neither approach is automatically wrong, but you should know which one you’re getting and have some control over it.

Ask:

• Are recordings stored at all? Where, and for how long?
• Can I delete recordings and notes myself?
• Can I set automatic deletion?
• For groups, can retention be set centrally?

How Chartnote answers: notes can be deleted manually at any time or set to delete automatically after 1 to 30 days. Recordings can be set to delete automatically after 1 to 30 days. Team and enterprise workspaces can configure retention centrally. Chartnote is a documentation tool, not an EHR, so your EHR remains the system of record.

4. Is our patients’ data used to train AI models?

This is the question many practices forget. An AI scribe may use its own models, third-party large language models, or both. You want to know whether PHI is used to improve any of them, and whether that’s written into contracts with the AI providers.

Ask:

• Is PHI or note content used to train your models?
• Is it used to train your AI providers’ models?
• Do your AI providers operate under BAAs, with zero-retention or similar terms?
• Is this in your contract or policy, not just your marketing?

How Chartnote answers: patient information and clinical content are never used to train AI models, by Chartnote or by our AI providers. Our AI features are powered by providers operating under BAAs, with zero-data-retention or equivalent terms, so clinical content isn’t kept beyond what’s needed to return a result.

5. Who are your subprocessors?

Your vendor probably relies on other vendors: a cloud host, AI model providers, email, support tools. Under HIPAA, a subcontractor that handles PHI is also a business associate and must agree to the same restrictions.

Ask:

• Can I see your current list of subprocessors?
• Which ones touch PHI, and are they under BAAs?
• Will you notify me when the list changes?

How Chartnote answers: every vendor that may process patient information signs a BAA or equivalent data processing terms with Chartnote and is reviewed as part of our vendor risk program. Our current subprocessors are listed at trust.chartnote.com, where you can subscribe to change notifications.

6. Who can access our data, and how is that controlled?

Access controls cover two groups: the vendor’s own staff, and the people in your practice.

Ask about the vendor’s staff:

• Who at the company can access customer data, and under what conditions?
• Is access logged and monitored?
• Are employees background-checked and trained on HIPAA?

Ask about your team:

• Can I control roles and permissions?
• Is single sign-on (SSO) available?
• Can admins add and remove users centrally?

How Chartnote answers: team members with access to production systems undergo background checks, complete annual security awareness training, and access systems only through multi-factor authentication under least-privilege, role-based permissions. Access to systems that store patient information is logged and monitored. For practices, Team plans include admin controls, and Enterprise adds SSO/SAML and centralized access management. With Assistant Seats, assistants can record intake and hand it off, but only clinicians can create clinical notes.

Have a security questionnaire to get through? Book a demo and we’ll walk your compliance lead through our controls, or request access to our reports at trust.chartnote.com.

7. Do you have an independent audit, such as SOC 2 Type II?

HIPAA doesn’t require a SOC 2 report. But a SOC 2 examination, performed by an independent CPA firm under AICPA standards, is one of the best outside signals that a vendor’s security controls exist and work. A Type II report tests whether controls operated effectively over a period of time, not just on one day.

Ask:

• Do you have a current SOC 2 Type II report? Can I see it under NDA?
• When was your last penetration test?
• Do you perform regular risk assessments? (HHS treats risk analysis as foundational to Security Rule compliance.)

How Chartnote answers: Chartnote is SOC 2 Type II audited. That audit covers the whole platform on every plan, including free and trial accounts, and the report is available under NDA through our Trust Center. We also run regular risk assessments, policy reviews, and third-party penetration tests, and our controls are continuously monitored through Vanta. You can read about how we got started in How Chartnote Achieved HIPAA Compliance.

8. What happens if there’s a breach?

No vendor can promise a breach will never happen. What you can evaluate is how they’ll respond. Under the HIPAA Breach Notification Rule, a business associate must notify the covered entity without unreasonable delay and no later than 60 days from discovering a breach. Then you, as the covered entity, may have your own notification duties to patients and HHS.

Ask:

• What’s your notification timeline in the BAA? Is it shorter than the 60-day legal maximum?
• Do you have a documented incident response program?
• What information will you give us so we can meet our own obligations?

How Chartnote answers: we maintain an incident response program. Our BAA commits us to report breaches of unsecured PHI without unreasonable delay and in no case later than 10 business days after discovery.

A quick HIPAA vendor checklist

Copy this into your vendor review notes:

• BAA covers the plan you’ll actually use, including free and trial
• Encryption in transit and at rest, including backups
• Clear audio and note retention, with deletion controls
• Written commitment that PHI isn’t used for AI training
• Published subprocessor list, with BAAs for those touching PHI
• Logged, least-privilege staff access, plus admin controls for your team
• Current SOC 2 Type II report and recent penetration test
• BAA breach notification timeline and an incident response program

Security is one part of the decision. For the rest, see our 12-point checklist for choosing an AI scribe.

Don’t forget your side of the equation

A compliant vendor doesn’t make your practice compliant on its own. A few things stay with you:

• Patient consent and notice. Many practices tell patients when an AI scribe is in use, and some states have recording-consent laws. Check your state’s rules and your own policies.
• Clinician review. AI drafts should be reviewed and signed by the clinician. At Chartnote, AI output is always reviewed and approved by the clinician before use.
• Your own risk analysis. Add the AI scribe to your practice’s HIPAA risk analysis and policies.
• Account hygiene. Strong passwords, no shared logins, and prompt removal of departed staff.

FAQ

Is there an official HIPAA certification for AI scribes?

No. HHS doesn’t certify products as HIPAA compliant and doesn’t recognize private “certifications.” Look instead for a BAA, documented safeguards, and independent audits such as a SOC 2 Type II report.

Do I need a BAA to use a free AI scribe?

If you’ll use it with real patient information, yes. Some vendors exclude free plans from their BAA. Chartnote’s BAA covers every account, including free and trial accounts, from first use.

Does a SOC 2 report mean a vendor is HIPAA compliant?

Not by itself. SOC 2 is an independent audit of security controls, and it’s strong evidence of a mature security program. HIPAA compliance also depends on the BAA, policies, and how PHI is handled day to day.

Should AI scribe vendors store audio recordings?

It depends on the product. What matters is that you know whether audio is kept, for how long, and that you can delete it or set automatic deletion.

Is it safe to use an AI scribe for behavioral health visits?

It can be, with the right safeguards: a BAA, short retention, no AI training on PHI, and clinician review. Psychotherapy notes have extra protections under HIPAA, so check your workflow with your compliance advisor.

See Chartnote’s security for yourself

Read our Privacy and Security overview, review our controls and subprocessors at trust.chartnote.com, then book a demo to talk through your compliance questions.

Ready to try it? Every account is covered by our BAA from first use. Start free at chartnote.com/welcome.

hipaaai scribebaadata securitysoc 2private practice