Ambient AI Clinical Scribe Vendor BAA Checklist: What to Review

An ambient AI clinical scribe may handle patient conversations, transcripts, generated notes, and other information that identifies a patient and relates to care. Before using one with protected health information (PHI), review the business associate agreement (BAA) alongside the vendor’s service terms and technical documentation. A signed BAA is a contractual safeguard; it does not, by itself, establish that your organization or the vendor complies with every HIPAA requirement.

Which parties and services does the BAA cover?

Confirm that the BAA names the correct covered entity and vendor legal entities, identifies the service being provided, and describes each party’s role. A vendor that creates, receives, maintains, or transmits PHI on your behalf may be a HIPAA business associate and generally needs a BAA before your organization allows that access. The analysis depends on what the vendor actually does, not just the product’s label.

For an ambient scribe, check whether the agreement covers the complete data flow: live audio, recordings, transcripts, prompts, generated clinical notes, identifiers, metadata, support logs, backups, and any other information the vendor handles. Confirm whether the BAA covers all product components and deployment methods you intend to use, including integrations, mobile apps, and customer support.

Ask whether the vendor’s underlying speech-recognition, AI, hosting, or analytics services are included, and which separate providers may receive or maintain PHI. HHS explains that a cloud service provider handling ePHI on behalf of a covered entity or business associate is generally a business associate, even if it stores only encrypted information and cannot view it. See HHS guidance on HIPAA and cloud computing and its FAQ on when a software vendor is a business associate.

How does the BAA define protected health information and permitted uses?

Check that the BAA’s definition of PHI is broad enough to cover individually identifiable health information in any form the service handles. Patient speech, audio, transcripts, and notes may contain PHI when they relate to a person’s health or care and identify, or could reasonably identify, that person. HHS describes the types of information HIPAA treats as PHI.

The BAA should clearly limit permitted uses and disclosures to providing the contracted service and any other specific purposes allowed by HIPAA and the agreement. Look closely at terms allowing the vendor to use information for “service improvement,” product development, analytics, or AI training. Ask what information those terms cover, whether it remains identifiable, and whether the use is permitted under the BAA and applicable HIPAA rules. Do not assume that calling data “de-identified” makes it so; HIPAA provides specific methods for de-identification.

Review whether the BAA restricts uses and disclosures beyond the agreed purposes, prohibits unauthorized onward sharing, and addresses disclosures required by law. Any allowance for the vendor’s proper management or administration should be limited and handled in accordance with HIPAA. The BAA requirements in 45 CFR § 164.504 require the contract to establish permitted and required uses and disclosures and limit other uses.

What safeguards and access controls must the vendor maintain?

Look for a clear commitment to use appropriate safeguards and comply with applicable Security Rule requirements for electronic PHI. The agreement and supporting security materials should let you assess how the vendor protects confidentiality, integrity, and availability across recording, transcription, note generation, storage, support, and deletion.

Ask the vendor to explain relevant administrative safeguards, technical safeguards, and physical protections. Depending on the service and your risk assessment, review access permissions, authentication, encryption, audit logging, workforce training, incident response, backups, vulnerability management, and data separation. Confirm who can access audio and transcripts, why access is allowed, and how the vendor limits and records that access.

Do not treat a general promise to “maintain security” as a complete description of the service. Review the vendor’s security documentation and clarify which safeguards your organization must configure or operate. HIPAA requires appropriate safeguards but does not make a BAA a substitute for evaluating the parties’ responsibilities. See 45 CFR § 164.308 on administrative safeguards and business associate arrangements and the HHS sample business associate agreement provisions.

How does the BAA address subcontractors and downstream obligations?

Identify subcontractors that may create, receive, maintain, or transmit PHI for the scribe service, including cloud hosts, speech-to-text providers, AI model providers, and support vendors. HIPAA requires a business associate to ensure that relevant subcontractors agree to the same restrictions and conditions that apply to the business associate for the PHI they handle.

Check how the vendor identifies and manages those relationships. You can negotiate for a current list of relevant subcontractors, advance notice of material changes, and a process for raising concerns or ending the service if a change creates unacceptable risk. These are useful contract-review points, but the BAA requirement to impose downstream obligations does not itself mean every BAA must include a specific subcontractor-list format or notice period.

Make sure the vendor remains responsible for its own contractual obligations and has a process to address subcontractor violations. HHS explains that subcontractors handling PHI on behalf of a business associate are themselves business associates and require appropriate downstream agreements. See HHS guidance on business associates and subcontractors and 45 CFR § 164.504.

What are the breach and security incident notification requirements?

Review how the agreement distinguishes a security incident from a breach of unsecured PHI. Ask the vendor to report security incidents it becomes aware of, as required by the BAA framework, and to notify your organization of a breach in time for you to investigate and meet your own obligations. The agreement should identify a reporting channel and a contact available for urgent incidents.

HIPAA sets an outside deadline: a business associate must notify the covered entity of a breach of unsecured PHI without unreasonable delay and no later than 60 calendar days after discovery. That is a maximum, not necessarily a workable response target for your organization. Consider negotiating a shorter initial notice period and requiring the vendor to provide available details, including affected individuals, information involved, investigation updates, and mitigation steps.

Specify who will coordinate any required notifications to individuals, HHS, or the media, and who will provide the information needed to make them. The covered entity remains responsible for its own applicable notification duties, although the parties may allocate tasks by agreement. Consult the HHS Breach Notification Rule guidance and 45 CFR § 164.410 on business associate notification.

How are patient rights, records, and audit requests handled?

Determine whether the vendor holds audio, transcripts, or generated notes that your organization may need to locate and provide in response to a patient request. The BAA should require the vendor to make PHI available as needed for access requests, amendments, and accountings when applicable. Establish how requests will be routed, how quickly the vendor must respond to your organization, and what support it will provide.

Also clarify how the vendor will preserve, retrieve, correct, export, or delete records, and whether the service allows your organization to retrieve its PHI in a usable format. HIPAA requires business associate contracts to address access and amendment support; HHS also explains that individuals’ access rights can extend to health information maintained by a business associate on a covered entity’s behalf. See HHS sample BAA provisions and HHS guidance on individuals’ access rights.

Check the contract’s provision for making relevant internal practices, books, and records available to HHS for compliance review. If your organization wants its own audit or assessment rights, negotiate those separately: a contractual right for your organization to audit the vendor is not the same as the BAA requirement to make records available to HHS.

What happens to PHI when the agreement ends?

Confirm that the BAA requires the vendor, when the contract ends, to return or destroy PHI if feasible. Define how that applies to audio, transcripts, notes, backups, support records, and information held by subcontractors. Ask what evidence of return or destruction the vendor will provide and how long the process takes.

If return or destruction is not feasible, the BAA should require the vendor to continue protecting the PHI and limit further uses and disclosures to the reasons that make return or destruction infeasible. Clarify any retention exception, its scope, and when it ends. The termination terms should also explain how your organization can retrieve its information before access to the service is shut off. These end-of-agreement terms are part of the HHS sample BAA provisions.

In short, review the BAA against the scribe’s real data flows: define permitted uses, verify safeguards and downstream obligations, set workable incident-notification terms, preserve patient-rights support, and plan for PHI return or destruction. Then confirm that the BAA, product terms, and technical configuration are consistent with one another.

FAQs.

Does an ambient AI scribe vendor need a BAA?

Generally, yes, if the vendor creates, receives, maintains, or transmits PHI on behalf of a covered entity. An ambient scribe that processes identifiable patient conversations or stores resulting transcripts or notes will commonly handle PHI. Whether a specific vendor is a business associate depends on its actual role and access to PHI; merely providing software without access to PHI does not, by itself, create a business associate relationship. See HHS guidance on software vendors.

What uses of PHI should a BAA permit?

Permit uses necessary to provide the contracted scribe service and any specifically agreed uses that are allowed by HIPAA. Define any support, administration, or other permitted purpose narrowly. Review any clause allowing analytics, product improvement, or AI training, and do not assume it is authorized merely because it appears in the vendor’s general terms.

Does the BAA cover the vendor’s subcontractors?

The BAA should require the vendor to ensure that subcontractors handling PHI agree to the same applicable restrictions and conditions. Ask how the vendor identifies those subcontractors, verifies that the required agreements are in place, and responds if a subcontractor violates its obligations.

What should the BAA require when PHI is exposed?

Require prompt notice of security incidents and breach reporting that gives your organization time to investigate and carry out its obligations. Specify a practical initial reporting deadline, the information the vendor must provide, ongoing cooperation, mitigation steps, and who will coordinate required notifications. HIPAA’s 60-calendar-day deadline is the outside limit for a business associate’s breach notice to the covered entity, not a recommended target for the vendor’s first notice.