Is an AI scribe HIPAA compliant? What to actually ask

"HIPAA compliant" shows up on almost every scribe tool's homepage. It's also not a certification anyone hands out, so the phrase alone doesn't tell you much. If you're evaluating a tool for your practice, here are the specific questions worth asking instead.

Will they sign a Business Associate Agreement?

A BAA is the legal document that makes a vendor accountable for handling protected health information the way HIPAA requires. If a company won't sign one, or treats it as an enterprise-only add-on, that's worth noticing before anything else.

What happens to the audio?

Ask directly: is the session recording stored, and if so, for how long and where? A tool that processes audio to generate a note and then discards it has a smaller footprint of risk than one that keeps a permanent archive of every session you've ever run.

Does anything join the call?

Some scribe tools work by adding a bot to your Zoom or Meet call, which means a third-party service is a visible or invisible participant in the session. Others run locally on your computer and capture audio from your own device. That distinction matters both for client comfort and for how much you're relying on a third party's infrastructure during the session itself.

Is client data used to train models?

This is worth asking in plain language, not just checking a compliance page for. Some AI products use customer data to improve their models by default unless you opt out. For anything touching client disclosures, that default should be the other way around.

Where AI Scribe for Therapists lands on this

• A signed BAA is available on request.
• Audio is processed to produce the draft and is not retained afterward.
• Nothing joins the call. The app runs on your own device.
• Session content isn't used to train general-purpose models.

None of that replaces reading the agreement yourself. But it's a reasonable checklist to run any tool through before it listens to a session.