Does ScribeMDPro store patient audio?

No. Consultation audio is used to produce the draft note and is not retained afterwards. The clinician-approved note is what persists in the record.

Is a Business Associate Agreement (BAA) available?

BAAs are handled per customer as part of onboarding for clinic and hospital plans. Contact us to start the review and we will share our current agreement and subprocessor list.

Is ScribeMDPro SOC 2 certified?

ScribeMDPro has not published a completed SOC 2 attestation. We describe the controls that are live today on this page and in the Trust Center, and we will publish attestation status when an audit is complete rather than before.

Who can see a clinician's notes?

Notes are scoped to the authoring clinician, and to clinic administrators only where the clinic account model grants it. Access is enforced at the database layer with row-level security, not only in the interface.

Does the AI make clinical decisions?

No. ScribeMDPro drafts documentation. Every note requires clinician review and approval before it is used, and clinical judgement remains entirely with the practitioner.

HIPAA compliance architecture

Exactly how protected health information moves through ScribeMDPro, which safeguards apply at each step, and what we have not yet certified.

Last reviewed: August 2026

Where PHI travels

1. Capture. Consultation audio is captured in the clinician's browser over an encrypted channel. Patients never interact with a device, and recording is started deliberately by the clinician.
2. Transcription. Audio is transmitted over TLS to the speech provider used for that language, transcribed, and discarded. It is not written to long-term storage and is not used to train models.
3. Drafting. The transcript is converted into a structured SOAP draft. Prompts instruct the model to record only what was said — no invented findings, demographics or vitals.
4. Review and sign. The clinician edits and approves. Nothing enters the permanent record without that step.
5. Storage and export. The approved note is stored encrypted, scoped to the authoring clinician, and exported by copy-paste, PDF or a supported integration.

Safeguards mapped to HIPAA

Technical — transmission security

TLS 1.2/1.3 for every client-server and provider call. No PHI is transmitted over unencrypted channels.

Technical — encryption at rest

AES-256-class encryption on the managed database and object storage holding notes and exports. Offline capture on the device is encrypted with AES-GCM before it touches disk.

Technical — access control

Per-user authentication, short-lived rotating session tokens, and row-level security enforced in the database so a request cannot read another clinician's records even if the interface is bypassed.

Technical — audit controls

Server-side event logging for note generation, exports and administrative actions, retained for investigation and adoption reporting.

Administrative — workforce access

Least-privilege internal access, separate production credentials, and role-scoped administrative tooling.

Organizational — BAAs

Business Associate Agreements are executed with covered-entity customers during onboarding, and we maintain agreements with the subprocessors that handle PHI on our behalf.

Minimum necessary, by design

ScribeMDPro applies the minimum-necessary principle at the product level rather than as policy alone: audio is not retained, drafts omit demographic detail that was not clinically stated, patient summaries shared via public link are de-identified before the link is created, and links expire. Clinic administrators see adoption metrics — consultation counts, time saved, note quality trends — not the clinical content of another clinician's notes.

What we have not certified

We do not publish a completed SOC 2 or HITRUST attestation, and we do not claim to be "HIPAA certified" — no such certification exists. What this page describes are the safeguards implemented today. Security questionnaires, our subprocessor list and architecture detail are available on request for clinic and hospital evaluations.

Frequently asked

Does ScribeMDPro store patient audio?: No. Consultation audio is used to produce the draft note and is not retained afterwards. The clinician-approved note is what persists in the record.
Is a Business Associate Agreement (BAA) available?: BAAs are handled per customer as part of onboarding for clinic and hospital plans. Contact us to start the review and we will share our current agreement and subprocessor list.
Is ScribeMDPro SOC 2 certified?: ScribeMDPro has not published a completed SOC 2 attestation. We describe the controls that are live today on this page and in the Trust Center, and we will publish attestation status when an audit is complete rather than before.
Who can see a clinician's notes?: Notes are scoped to the authoring clinician, and to clinic administrators only where the clinic account model grants it. Access is enforced at the database layer with row-level security, not only in the interface.
Does the AI make clinical decisions?: No. ScribeMDPro drafts documentation. Every note requires clinician review and approval before it is used, and clinical judgement remains entirely with the practitioner.

Continue reading

Clinician approval is required on every note. ScribeMDPro never files documentation autonomously.