Is DeepScribe Medical AI HIPAA-Compliant? A Practical Checklist

If you are evaluating DeepScribe Medical AI, use this practical checklist to determine whether the platform aligns with the HIPAA Privacy Rule and HIPAA Security Rule. You will confirm a signed Business Associate Agreement (BAA), review encryption and access controls, assess SOC 2 Type II Audit evidence, and verify data handling, EHR integration, and documentation practices.

Business Associate Agreement Overview

A Business Associate Agreement (BAA) is mandatory when a vendor creates, receives, maintains, or transmits PHI on your behalf. It clarifies permitted uses and disclosures under the HIPAA Privacy Rule and requires safeguards consistent with the HIPAA Security Rule.

What to confirm in the BAA

• Clear definition of PHI, permitted uses/disclosures, and purpose limitation for documentation and ambient clinical intelligence.
• Explicit administrative, physical, and technical safeguards aligned to the HIPAA Security Rule.
• Subprocessor controls: list of subcontractors, flow-down HIPAA obligations, and approval/change-notice requirements.
• Breach and security-incident notification timelines, investigation duties, and cooperation expectations.
• Data return/deletion terms at contract end and verification of destruction on request.

Action steps

• Request DeepScribe’s standard BAA early; ensure it is fully executed before any PHI flows.
• Record the effective date, scope of services, and any security addendum or DPA that supplements the BAA.
• Store the countersigned BAA in your compliance repository and link it to your vendor risk register.

Data Security Measures Implementation

Your review should confirm data protection in transit, at rest, and throughout the application stack, with controls proportionate to PHI risk.

Encryption and key management

• AES-256 Encryption for data at rest (databases, object storage, backups, and logs).
• TLS 1.2+ for data in transit, certificate pinning where feasible, and secure cipher suites.
• Centralized key management (KMS/HSM), key rotation cadence, and separation of duties for key custodians.

Identity, access, and endpoint security

• Role-based access control with least privilege, quarterly access reviews, and immediate offboarding SLAs.
• Multi-Factor Authentication for all privileged accounts and administrative consoles; SSO via SAML/OIDC.
• Device controls for support staff (disk encryption, screen lock, and EDR on managed endpoints).

Application and infrastructure hardening

• Network segmentation, WAF/DDoS protections, vulnerability scanning, patch SLAs, and annual penetration tests.
• Secure development lifecycle with code review, secret scanning, and dependency monitoring.

Logging, monitoring, and resiliency

• Comprehensive audit logs (access, admin actions, data exports) ingested into a SIEM with alerting.
• Encrypted backups, periodic restore tests, RTO/RPO objectives documented, and disaster recovery playbooks.

Data Residency Requirements and retention

• Ability to meet your Data Residency Requirements (for many U.S. providers, U.S-only storage and processing).
• Documented PHI retention windows, deletion workflows, and proof of destruction upon request.

SOC 2 Type II Certification Significance

A SOC 2 Type II report provides independent attestation on the design and operating effectiveness of security controls over a defined period. It complements—but does not replace—your HIPAA Security Rule due diligence.

What to request and review

• The latest SOC 2 Type II Audit report, coverage dates, and any bridge letter to current date.
• System boundaries, in-scope services, subservice organizations, and complementary user entity controls.
• Exceptions/findings, management responses, and remediation status for material items.

How to use SOC 2 evidence

• Map report controls to your HIPAA Security Rule safeguards to confirm fit for purpose.
• Incorporate SOC 2 evidence into your vendor risk rating and ongoing monitoring cadence.

Electronic Health Record Integration

Evaluate how DeepScribe connects with your EHR to minimize PHI exposure while supporting clinical workflows.

Integration patterns and scopes

• Standards-based connectivity (FHIR APIs, HL7 v2, SMART on FHIR) with narrowly scoped permissions.
• Patient-context launches and auditable write-backs limited to necessary data elements.

Security controls for EHR connections

• Short-lived OAuth tokens, mTLS where supported, and IP allowlists for integration services.
• Data minimization at the interface layer and thorough audit logging for each API call.

Operational reliability

• Defined downtime procedures, retry logic, idempotent writes, and clear error-handling paths.
• Reconciliation checks for patient matching and encounter attribution to prevent misfiled notes.

Vendor Security Assessment Procedures

Perform structured due diligence to substantiate security assurances before onboarding.

Questionnaires and evidence collection

• Standardized security questionnaires (SIG/CAIQ/HECVAT) and policy reviews (access control, encryption, IRP, BCP/DR).
• Independent testing artifacts: recent penetration test summary, vulnerability management metrics, and patch cadence.
• Training attestations for workforce HIPAA training and background screening for privileged roles.

Interviews and validation

• Discuss architecture diagrams, data flows, and subprocessor inventories with security leadership.
• Confirm incident escalation paths, RACI assignments, and communication SLAs for security events.

Data Handling and De-Identification Practices

Scrutinize how PHI is collected, transformed, stored, and used for model performance and support functions.

Minimization and purpose limitation

• Collect only the minimum PHI necessary to generate notes and support quality assurance.
• Segregate production PHI from development/test data; prohibit use of raw PHI for non-essential purposes.

De-identification expectations

• Confirm whether HIPAA Safe Harbor (removal of 18 identifiers) or Expert Determination is applied for analytics/training.
• Document re-identification prohibitions, sampling controls, and review of edge cases (e.g., free text containing identifiers).

Lifecycle and controls

• Defined retention schedules, user-requested deletion workflows, and immutable audit records of access.
• Human-in-the-loop processes, if used, with role-based access and confidentiality obligations captured in the BAA.

Compliance Verification and Documentation

Capture durable evidence so your organization can demonstrate reasonable and appropriate safeguards at any time.

Build your evidence file

• Executed Business Associate Agreement (BAA) and any security addenda or data residency commitments.
• Latest SOC 2 Type II Audit report and mapping to HIPAA Security Rule controls.
• Completed security questionnaire, architecture/data-flow diagrams, risk assessment, and vendor risk rating.
• Penetration test summaries, vulnerability metrics, DR/BCP test results, and incident response playbooks.

Ongoing oversight

• Annual re-assessment, access reviews, key rotations, and tabletop exercises covering breach scenarios.
• Contract governance: SLAs, security notification windows, and change-control for new subprocessors.

Summary and next steps

To determine whether DeepScribe Medical AI is HIPAA-compliant for your environment, verify an executed BAA, validate strong encryption and Multi-Factor Authentication, review SOC 2 Type II evidence, confirm secure EHR integration, and assess de-identification and retention practices. Document everything and schedule ongoing reviews to keep compliance current.

FAQs.

Does DeepScribe sign a Business Associate Agreement?

For any deployment involving PHI, you should obtain a fully executed Business Associate Agreement (BAA) from DeepScribe before go-live. Ensure the BAA defines permitted uses, security safeguards, subcontractor obligations, and breach-notification timelines, and store the countersigned copy in your compliance records.

How does DeepScribe ensure data encryption compliance?

Confirm AES-256 Encryption for data at rest, TLS 1.2+ for data in transit, centralized key management (KMS/HSM) with rotation, encrypted backups, and strict secret management. Validate that encryption controls are reflected in policy, implemented in production, and monitored through audit logs.

Is DeepScribe SOC 2 Type II certified?

Request DeepScribe’s most recent SOC 2 Type II Audit report and any bridge letter. Verify the coverage period, in-scope systems and subprocessors, exceptions, and remediation status. Treat the SOC 2 as complementary evidence alongside your HIPAA Security Rule assessment rather than a substitute.

How does DeepScribe handle PHI de-identification?

Ask DeepScribe to document whether it applies HIPAA Safe Harbor or Expert Determination, which identifiers are removed, and how residual re-identification risk is managed. Confirm de-identified data is segregated, access-controlled, and used only for approved purposes with defined retention and deletion SLAs.