Your urgent care brought on three scribes in November. In January, a payer requests twenty charts for a prepayment review, and your billing lead notices that eleven of them contain a note authored under the scribe's login with no visible provider attestation line. That is not a coding problem. That is a documentation-integrity problem, and it started because nobody wrote down a working scribe definition before the first shift.

This guide is for the administrator, billing manager, or privacy officer who has to make scribes work operationally — scope, login credentials, attestation, records requests, and vendor contracts. It is administrative guidance on how practices structure and document scribe use, not clinical or coding advice for any specific encounter.

Scribe Definition: The Version That Holds Up in an Audit

A medical scribe is an unlicensed person who documents an encounter at the direction and in the presence (physical or virtual) of the treating practitioner, and who does not independently practice, interpret, order, or decide anything. The scribe records what the practitioner says and does. The practitioner owns the note.

That scribe definition matters because everything downstream flows from it: who signs, who attests, whose time counts, who gets a login, who gets HIPAA training, and whether the person is on your payroll or on a vendor's.

The short answer, for the person who searched this at 4pm

Scribe definition: a documentation assistant who enters clinical information into the medical record on behalf of a licensed practitioner, during or immediately after the encounter, under that practitioner's direction. Scribes do not perform clinical care, do not make independent entries, and do not authenticate the note. The billing practitioner reviews, edits as needed, and signs an attestation confirming the documentation reflects the encounter. Scribes may be employed by the practice (workforce members) or supplied by a vendor (typically requiring a business associate agreement), and they may be in-person, remote/virtual, or software-based ambient documentation tools.

What a Scribe Touches, and What Stays With the Practitioner

Write this out as a one-page scope document and have every scribe and supervising practitioner sign it. At minimum, decide and record your position on:

  • Order entry. Most practices prohibit scribes from entering orders entirely, precisely because accreditation and payer scrutiny concentrate there. If you allow any order-related activity, define it narrowly and require practitioner authentication before release.
  • History gathering. A scribe transcribing what the patient reports to the practitioner is different from a scribe independently interviewing the patient. Pick one and say so.
  • Copy-forward. Decide whether scribes may pull prior-note content forward, and require that carried-forward content be visibly flagged for practitioner review.
  • Code selection. Scribes do not select codes. Practitioners and certified coders determine code selection based on the documented encounter and payer rules, and the practice documents that determination process. If your E/M selection relies on time, confirm with current payer guidance whose time counts — scribe time generally does not.
  • Signature. Never delegated. Ever.

The Attestation Workflow That Survives a Records Request

Auditors do not read your policy binder. They read the note. Build the workflow so the note itself proves who did what.

Four elements in every scribed note

  1. Scribe identification — full name, credential-free title ("Scribe"), and date, entered under the scribe's own EHR login.
  2. Practitioner attestation — a statement that the practitioner performed the service, reviewed the documentation, and agrees it is accurate and complete, with any corrections made by the practitioner.
  3. Distinct signatures — the scribe's electronic signature and the practitioner's, timestamped separately.
  4. Audit trail integrity — no shared credentials. A scribe documenting under a practitioner's login is a documentation-integrity failure and an access-control failure at the same time, and it will show up in your EHR audit log exactly the way you do not want it to.

CMS documentation and signature expectations are set out across the agency's Internet-Only Manuals and payer-specific guidance, and Medicare Administrative Contractors publish their own scribe articles. Assign one person to check the CMS manuals and your MAC's site annually and log the review date. Requirements shift, and "we set this up in 2022" is not a defense.

Set a signature deadline and enforce it

Pick a closure window — many practices use 24 to 72 hours — and run a weekly unsigned-note report by practitioner. Assign the report to your billing lead, not to the practitioners themselves. Unsigned scribed notes are the single most common finding when a practice's scribe program gets reviewed, and they are trivially preventable with a recurring calendar task.

Workforce Member or Business Associate? Put This Decision on Paper

This is the fork in the road that most practices get wrong, and it changes your entire compliance posture.

Under the HIPAA definitions at 45 CFR 160.103, workforce means employees, volunteers, trainees, and other persons whose conduct in the performance of work for the covered entity is under the covered entity's direct control, whether or not they are paid by the covered entity. A scribe you hire, schedule, supervise, and train is a workforce member. That means your training log, your sanction policy, your access provisioning and deprovisioning, your unique user ID.

A scribe supplied by a staffing or documentation company sits in murkier territory. If the company retains meaningful control — it hires, trains, assigns, and manages the scribe, and it handles PHI on your behalf — treat the company as a business associate and execute a BAA. HHS guidance on business associate relationships is the starting point. In practice, the defensible position for most practices is: sign the BAA and apply your own access controls, unique logins, and training verification to every individual scribe regardless of who cuts their paycheck. Belt and suspenders costs you nothing.

If you are staring at a scribe vendor's contract and there is no BAA attached, do not let the first shift start. You can produce a signature-ready business associate agreement through a guided six-step wizard and have it in front of the vendor the same afternoon.

Three clauses to negotiate before signing

  • Named individuals and offboarding notice. You need to know who is accessing your EHR and within how many hours you will be told when someone leaves the vendor.
  • Subcontractor disclosure. Ask whether scribes are subcontracted or offshore, and whether the vendor's subcontractors have executed downstream BAAs.
  • Breach notification timing. Your 60-day clock under the Breach Notification Rule does not care that your vendor took 45 days to tell you. Contract for something far shorter — 5 to 10 calendar days from discovery.

AI and Ambient Scribes: The Questions Nobody Asks Until After Signing

Ambient documentation tools have rewritten the practical scribe definition for a lot of practices — the "scribe" is now software listening through a phone or room mic and generating a draft note. The attestation obligation does not change one bit. A practitioner still reviews, edits, and signs. "The AI wrote it" is not a defense in a records dispute.

The vendor questions do change. Before an ambient tool touches a single encounter:

  • Is the audio retained, and for how long? Get a number, in writing, in the contract — not in a marketing FAQ.
  • Is PHI used to train models? If the answer is yes in any form, understand exactly what the de-identification process is and who reviewed it. If the answer is "only aggregated and anonymized," ask which HIPAA de-identification method — expert determination or safe harbor.
  • Where does processing happen? Cloud region, subprocessors, and whether any human reviewers hear the audio for quality assurance. Human-in-the-loop review is common and is not disqualifying — undisclosed human-in-the-loop review is.
  • What happens at termination? Return or destruction of PHI, with certification, within a defined window.

Audio recordings and the designated record set

Decide now, in writing, whether retained encounter audio is part of your designated record set. If the recording is retained and used to make decisions about the patient, a strong argument exists that it belongs in the DRS and is subject to the patient's right of access — with your 30-day response clock attached. If audio is transient and discarded once the draft is produced, document that lifecycle. What you cannot do is leave it undefined and then improvise when a records request lands.

HIPAA permits documentation for treatment purposes. State wiretapping and recording-consent statutes are separate law, and several states require all-party consent. If your ambient tool records audio, your intake workflow needs a consent step and your front desk needs a script for the patient who declines. Build the fallback: the practitioner documents manually for that visit, and nobody argues about it in the hallway.

Remote and Offshore Scribes: Extra Controls, Not a Prohibition

HIPAA does not bar offshore processing. Your payer contracts, state Medicaid rules, and malpractice carrier might. Check those before checking anything else.

For remote scribes generally — domestic or not — the controls that matter are unchanged: unique credentials, multi-factor authentication, session timeouts, no local storage of PHI, prohibition on personal-device screenshots, and a documented workspace requirement (private room, no household members within earshot). Put those in the scribe agreement and audit them at least annually. The NIST SP 800-66r2 implementation guidance for the HIPAA Security Rule is a useful crosswalk when you are mapping these controls to specific safeguards.

Every scribe arrangement you add is a new access path into your EHR, which means your risk analysis is now out of date. If your last one predates the scribe program or the ambient tool, that gap is exactly what OCR asks about first. You can generate an updated risk analysis and the supporting policy set without rebuilding your documentation from scratch — and it gives you something dated and defensible to point at.

A 14-Day Rollout Checklist With Names Attached

  1. Days 1–2 (Privacy Officer): Write the one-page scribe definition and scope document. Circulate to all supervising practitioners for sign-off.
  2. Days 3–4 (Practice Administrator): Confirm employment status for every scribe. Executed BAA on file for any vendor-supplied scribe, no exceptions.
  3. Days 5–6 (IT or EHR lead): Provision unique logins with a scribe-specific role. Verify the role cannot sign notes or release orders. Test it with a dummy chart.
  4. Day 7 (Billing Manager): Build the attestation template into every note type in use. Verify the audit trail shows two distinct signatures.
  5. Days 8–10 (Privacy Officer): Deliver HIPAA training to scribes, log completion, collect confidentiality attestations.
  6. Days 11–12 (Front Desk Lead): Script the patient-facing introduction and the recording-consent step if applicable. Role-play the refusal scenario.
  7. Day 13 (Billing Manager): Schedule the recurring unsigned-note report.
  8. Day 14 (Practice Administrator): Add scribes and scribe vendors to your asset inventory, vendor list, and next risk analysis scope.

What Goes Wrong, and Where It Shows Up

Three failure modes account for most scribe-related trouble. Shared logins, which destroy your audit trail and surface in the first EHR access review anyone runs. Missing attestations, which surface in payer audits and records requests. And unsigned vendor paperwork, which surfaces at the worst possible moment — after an incident, when you are reading the OCR breach portal and recognizing your own vendor's name on it.

None of the three require budget to fix. They require a written scribe definition, a scope document with signatures on it, and one person whose job it is to check the unsigned-note report every Monday.

If you are adding scribes this quarter — human, remote, or ambient — refresh the compliance documentation before the first shift rather than after the first audit. Build the risk analysis, policies, and workforce documentation set in one pass, then attach the scribe scope document to it. That is a two-hour task now and a very expensive one later.