AI Scribe Security & Data Handling: The Complete Reference

Who this reference is for

Privacy officers, compliance leads, and clinician-owners evaluating an AI scribe against HIPAA, 42 CFR Part 2, and state privacy law. It is written to be objective — every vendor covered on this site is measured against the same bar.

The Business Associate Agreement

Under HIPAA, any vendor that creates, receives, maintains, or transmits PHI on behalf of a covered entity is a Business Associate. A BAA is required — not optional, not implied. If a vendor cannot produce a BAA on the exact plan you intend to purchase, they are not HIPAA-appropriate for that plan.

• The BAA must name your legal entity, not just your practice name.
• It must specify permitted uses and disclosures of PHI in plain language.
• It must obligate the vendor to report breaches without unreasonable delay (60 days is the outer limit).
• It must flow the same obligations down to any subprocessor that touches PHI.
• A 'sample BAA' on the vendor site is not a signed BAA on your account.

Encryption in transit and at rest

TLS 1.2 or 1.3 in transit and AES-256 at rest are the modern baseline. Any vendor operating below this in 2026 is out of step with industry practice. Ask specifically where keys are managed — customer-managed keys are a nice-to-have; vendor-managed keys via a reputable KMS are acceptable.

Subprocessors — including the LLM

The LLM provider (OpenAI, Anthropic, Google, or a self-hosted model host) is a subprocessor. Under HIPAA, subprocessors that touch PHI must be under BAA. Ask the vendor to list every subprocessor that receives PHI or transcripts derived from PHI, and confirm each is under BAA. If the answer is 'we don't share PHI with the model,' ask how the transcript is generated — because if audio or transcript touches the LLM provider's infrastructure, they are a subprocessor.

• OpenAI offers a HIPAA-eligible API with BAA on the Enterprise tier.
• Anthropic offers HIPAA-eligible access to Claude via AWS Bedrock and GCP Vertex under BAA.
• Google offers HIPAA-eligible Gemini via Vertex AI under BAA.
• Azure OpenAI is HIPAA-eligible under Microsoft's BAA.
• Self-hosted models (Llama, Mistral) run inside the vendor's HIPAA environment — no third-party subprocessor for inference.

Audio and transcript retention

The strongest posture is to delete raw audio immediately after transcription and to give the customer explicit control over transcript retention. Common patterns you will see:

• Audio deleted within 24 hours of transcription (strong).
• Audio retained for 30 days for 'quality assurance' (acceptable with justification).
• Audio retained indefinitely unless the user deletes it (weak).
• Transcripts and notes retained per customer-set retention policy (strong).
• Transcripts retained 'for the life of the account' with no export path (weak).

Model training and PHI

This is where marketing language most often diverges from contractual reality. Read the DPA, not the FAQ.

1. The strongest posture: 'PHI is never used to train, fine-tune, or evaluate any model, whether identified, de-identified, or aggregated.' This is what to demand in your BAA or DPA.
2. The middle posture: 'De-identified data may be used to improve our models.' De-identification under HIPAA Safe Harbor is stronger than the industry-loose meaning; ask which standard applies.
3. The weak posture: 'Aggregated and anonymized data may be used for product improvement.' Anonymization is not defined under HIPAA; treat this as effectively 'we may use it.'

SOC 2 and other attestations

SOC 2 Type II is an audit of controls over a period of time (usually 6–12 months). Type I is a point-in-time snapshot. Type II is meaningfully stronger. Ask for the audit period end date — a Type II report that ended two years ago is stale. HITRUST certification is a plus for enterprise buyers but is not required for HIPAA compliance.

Audit logs and access controls

You should be able to answer three questions from the vendor's audit log: who accessed which client's data, when, and from where. Role-based access controls (RBAC) with an admin/clinician/reviewer separation are the baseline. Session-based access with automatic timeout is a plus.

42 CFR Part 2 — the SUD overlay

If your program is federally-assisted and treats substance-use disorder, 42 CFR Part 2 imposes stricter confidentiality obligations than HIPAA. Client identifying information tied to SUD treatment cannot be disclosed without specific written consent, even to another provider. AI scribes serving Part 2 programs should document how they handle re-disclosure prohibitions, consent tracking, and QSOAs (Qualified Service Organization Agreements). Only Twofold and Eleos publish an explicit Part 2 posture at the time of writing.

Incident response and breach notification

The BAA sets the outer bound (60 days), but the vendor's incident-response commitment should be tighter. Ask for their published incident-response SLA and their most recent public incident. A vendor that has never had an incident either has excellent controls or is not disclosing.

Exit, deletion, and data portability

The BAA must obligate the vendor to return or destroy PHI at contract termination. Confirm the practical mechanics:

• Export path: bulk export of notes as PDF and structured JSON (both) is the modern bar.
• Deletion path: hard delete with certification of destruction, not just 'marked as deleted.'
• Retention after termination: the vendor should hold nothing beyond what regulation requires.

How the top scribes score on security posture

Every vendor covered on this site was measured against the same twelve controls. Full scoring lives on each scribe's review page; the summary below shows the material differences.

• Twofold Health — BAA on every paid tier, SOC 2 Type II, subprocessor list published, PHI excluded from model training, explicit 42 CFR Part 2 posture.
• Blueprint — BAA on every paid tier, SOC 2 Type II, subprocessor list on request, PHI excluded from model training.
• Upheal — BAA on every paid tier, SOC 2 Type II, subprocessor list published, PHI excluded from model training, EU data residency option.
• Mentalyc — BAA on paid tiers, SOC 2 Type II, subprocessor list on request.
• Eleos Health — Enterprise BAA, SOC 2 Type II, HITRUST, deep subprocessor governance.
• Freed / Heidi / Nabla / Suki — HIPAA-appropriate general medical scribes; none publishes a 42 CFR Part 2 posture.

The exact questions to send to a vendor

Copy this list into your RFI. Any 'we'll get back to you' answer is a data point.

1. Do you sign a BAA on the exact plan we intend to purchase? Send the template.
2. List every subprocessor that receives PHI or PHI-derived transcripts. Which are under BAA?
3. What is your raw-audio retention period, and can we shorten it contractually?
4. Is any PHI — identified, de-identified, or aggregated — used to train, fine-tune, or evaluate any model?
5. Provide your most recent SOC 2 Type II report and the audit period end date.
6. Describe your incident-response SLA and your most recent public incident.
7. Describe your export and deletion path at contract termination.
8. If we treat SUD, describe your 42 CFR Part 2 posture in writing.
9. Who can access our data internally, and how is that access logged and reviewed?
10. What is your uptime SLA and your policy for degraded-mode operation during an outage?