Choose the right AI scribe for your practice, without the sales pitch.

Treat an AI scribe that handles PHI as a business associate

Rule: Treat an AI scribe that creates, receives, maintains, or transmits PHI for your practice as a business associate.

HHS says a business associate is a person or organization (other than a workforce member) that performs certain functions or services for a covered entity involving PHI. HHS examples include an independent medical transcriptionist, or the vendor of an app that provides transcription services to a physician, and cloud providers engaged to process or store ePHI. For a practice, expect a BAA before visit audio, transcripts, or notes leave your control, and ask which subcontractors also touch that data.

Source: HHS, Business Associates guidance

Get a written BAA before the vendor handles PHI

Rule: Put a written Business Associate Agreement in place before the vendor handles PHI, and make sure it covers the required terms.

HHS says a covered entity may disclose PHI to a business associate with satisfactory assurances in a BAA. Among other requirements, a BAA must describe permitted uses and disclosures, bar other uses except as permitted or required by law, require appropriate safeguards (including Security Rule protections for ePHI), require reporting of unauthorized uses or disclosures and breaches, require subcontractors to agree to the same restrictions, and require return or destruction of PHI at termination where feasible. Ask for the standard BAA early - including on free tiers and trials.

Source: HHS, Sample Business Associate Agreement Provisions

No ePHI in the cloud without a BAA - encryption is not enough

Rule: Do not store or process ePHI in a cloud or AI scribe service without a HIPAA-compliant BAA. Encryption alone does not remove that duty.

HHS guidance on HIPAA and cloud computing says that when a covered entity engages a cloud service provider to create, receive, maintain, or transmit ePHI, the provider is a business associate - even if it only holds encrypted ePHI and lacks an encryption key. Using such a service without a BAA violates the HIPAA Rules. HHS also says OCR does not endorse, certify, or recommend specific products, so "HIPAA certified" is not an official label.

Source: HHS, Guidance on HIPAA & Cloud Computing

Recording consent is mostly state law, separate from HIPAA

Rule: Some states require consent from all parties to record a confidential communication. Check the law where you and the patient are located.

California Penal Code section 632 makes it unlawful to intentionally record a confidential communication without the consent of all parties. A confidential communication is one carried on in circumstances that may reasonably indicate any party desires it to be confined to the parties. Clinical visits often look like that setting. A cautious practice approach is to ask every patient, document consent, and confirm the scribe tool supports that workflow.

Sources: California Penal Code section 632; Justia, 50-state recording law survey

Freed vs Heidi Health

Low-cost self-serve vs a free plan with native apps.

Heidi Health vs Nabla

Published prices vs the most conservative data defaults.

Nabla vs Freed

Organization-led EHR deployments vs self-serve pricing.

Tali AI vs Freed

Canadian dictation-first scribe vs US ambient scribe.

Abridge vs DAX Copilot (Dragon Copilot)

The two enterprise ambient platforms health systems compare most.

Freed vs Abridge

Private practice self-serve vs enterprise Epic-native.

Heidi Health vs DAX Copilot (Dragon Copilot)

Self-serve plus enterprise vs Microsoft's unified dictation and ambient AI.

Best AI scribe for psychiatry

Shortlist guide with sourced criteria.

Best free AI scribe

Shortlist guide with sourced criteria.