Your medical director forwards a one-line email on a Monday morning: "We're starting scribes next month — can you sign this?" Attached is a twelve-page services agreement with no business associate agreement, no retention schedule, and a clause about "product improvement." You have about a week to figure out what you are actually agreeing to. So: what does scribe mean in operational terms, and what does it obligate your practice to do?

This guide is written for the administrator, billing manager, or privacy officer who has to make the scribe program work — credentialing the scribe in the EHR, getting the attestation language right, and closing the vendor gaps before an auditor or a records request finds them. It is administrative guidance on documentation workflow, not clinical or coding advice.

What Does Scribe Mean in Healthcare? The Short Answer

A medical scribe is a person or software system that documents an encounter in the medical record at the direction of, and on behalf of, the treating practitioner. The scribe does not diagnose, does not decide what is medically necessary, and does not select billing codes. The practitioner remains the author of record and must review, correct, and attest to the note before it is final.

Three things follow from that definition, and every one of them lands on your desk:

  • The scribe needs PHI access. Full encounter access, often across the whole schedule.
  • The scribe must be identifiable in the record. Name, role, date, and time of entry, plus the practitioner's separate attestation.
  • Who employs the scribe determines your paperwork. Workforce member means training and sanctions. Outside company means a signed BAA before the first encounter.

The Three Delivery Models, and Why They Are Not Interchangeable

In-person scribes on your payroll

The scribe sits in the room or just outside it, logs into the EHR under their own credentials, and drafts the note in real time. Because they are your workforce, you own their HIPAA training, their access provisioning, their sanction policy, and their termination checklist. No BAA is required — they are inside your covered entity.

Operationally, the friction points are credentialing and role scoping. Front-desk staff frequently get handed a scribe's login because "it's the same clinic." That is an audit finding waiting to happen.

Virtual scribes connecting remotely

A remote human, usually employed by a staffing company, joins by audio or video and documents in your EHR. This is a business associate relationship. The vendor receives PHI to perform a function on your behalf, which is precisely the trigger described in HHS guidance on business associates.

Ask where the scribe physically sits. Offshore delivery is common and is not prohibited, but it changes your breach-notification exposure, your ability to enforce contract terms, and sometimes your state's requirements. Get the answer in writing, not on a sales call.

Ambient AI scribes

Software captures the encounter audio, transcribes it, and generates a draft note. The vendor is a business associate. The audio recording, the transcript, and the draft are all PHI from the moment of capture. This model creates the largest number of new obligations and the smallest amount of visible workflow change, which is exactly why it gets under-governed.

The BAA You Sign Before the Pilot, Not After

Pilots are where compliance goes to die. Someone runs "just a two-week trial with three providers" using live patients, and the executed BAA arrives in March for a program that started in January. Those January encounters are unauthorized disclosures.

Your BAA for a scribe vendor needs specificity beyond the boilerplate:

  • Subcontractors named or disclosed on request. AI scribe vendors routinely route audio through third-party transcription or model-hosting providers. You are entitled to know the chain.
  • Return or destruction of PHI at termination, with a stated deadline and a certificate of destruction — including audio and transcripts, not just the notes already in your EHR.
  • Breach notification within a defined number of days, short enough that you can still meet your own 60-day obligation.
  • An explicit prohibition on secondary use unless you have specifically negotiated it. "Improving our services" is a permitted business associate use in some readings; "training our commercial model" is a different thing and should be addressed by name.
  • Audit rights and evidence of a current security risk analysis on the vendor's side.

If the vendor's paper is thin and you need a clean document to counter with, you can produce a signature-ready business associate agreement in a few minutes rather than waiting on outside counsel for a routine pilot.

The Attestation Line Auditors Look For

The record has to show two things: who typed it, and that the billing practitioner reviewed it. Most payer and accreditor expectations around scribes converge on this pattern, and your EHR templates should enforce it rather than relying on memory.

A scribe entry line identifies the scribe by name and role and is dated and timed. A separate practitioner attestation states that the practitioner performed the services, reviewed the documentation, and adopts it as accurate — signed, dated, and timed by the practitioner under their own credentials.

CMS relaxed re-documentation requirements in the CY2020 Physician Fee Schedule so that a billing practitioner may review and verify documentation entered by other members of the care team rather than re-enter it. That is a workflow relief, not a supervision relief. The manuals your MAC applies are indexed in the CMS Internet-Only Manuals, and MAC-level scribe guidance varies enough that you should pull your own contractor's published position and keep a dated copy in your policy binder.

Where coding fits — and does not

A scribe documents what happened. The billing practitioner determines code selection based on the documented work. Your job as the administrator is to make sure the workflow does not blur that line: scribes should not be pre-populating level-of-service fields, and templates should not auto-select a level based on text volume.

Build a monthly internal review that samples scribe-documented encounters and checks three things: attestation present, attestation timed after the scribe entry, and documentation authored by a human who was actually present or listening. Log the sample size and findings. That log is your evidence if anyone asks.

Minimum Necessary and the Scribe's EHR Role

A scribe supporting one physician does not need chart access for the other eleven. Yet the default configuration most practices deploy is "same as MA," which is often organization-wide.

Scope the role to what the work requires, consistent with the HHS minimum necessary standard. Practical controls that hold up:

  1. Named individual accounts. Never a shared "Scribe1" login, even for a vendor's rotating pool.
  2. Access limited to the assigned provider's schedule where your EHR supports it.
  3. Same-day deprovisioning when a vendor rotates staff — put the notification duty in the contract with a business-day deadline.
  4. Quarterly access review comparing the vendor's current roster to your active account list. Vendors are frequently slower to tell you about departures than arrivals.
  5. Break-the-glass alerts on VIP, employee, and behavioral health charts.

The Audio File Is the Part Everyone Forgets

With ambient AI scribes, the note in your EHR is the visible output. The recording is the liability. Answer these before go-live and document the answers:

  • Is audio retained after the note is generated? If yes, for how long, where, and encrypted with whose keys?
  • Can you delete a specific patient's audio on request? Test it during the pilot with a dummy encounter.
  • Does the recording become part of the designated record set? If it informs treatment decisions and is retained, treat it as in scope for access and amendment requests until counsel tells you otherwise. Deciding this after a records request arrives is the worst time to decide it.
  • What happens on subpoena? A retained recording of a full visit is discoverable in ways a summarized note is not.
  • Recording consent. Federal law is not your only constraint — several states require all-party consent for audio recording. Confirm your state's rule with counsel and build the disclosure into check-in, not into a sign you hope patients read.

Also note what a scribe vendor's "HIPAA certified" badge means: nothing official. HHS does not certify, endorse, or accredit any product or vendor. Ask for a current risk analysis, penetration test summary, and SOC 2 report instead of a logo.

What a Scribe Program Changes on Your Risk Analysis

Adding scribes creates a new information flow: encounter audio or observation moves from an exam room to a remote human or a cloud service and back into your EHR. Your security risk analysis has to reflect that flow, and the sequence expected under the Security Rule is well described in NIST SP 800-66 Rev. 2, which maps Security Rule standards to practical implementation steps.

Concretely, you update: the asset and data-flow inventory, the vendor register, the access-control policy, the sanction policy for documentation integrity, the retention schedule, and the incident response plan's vendor-notification path. If those documents currently live in six unversioned Word files, this is the moment to fix it — automated HIPAA risk analysis and policy generation will produce the updated document set with the new vendor and data flow reflected, so your paperwork matches what the clinic actually does.

A 30-Day Rollout Timeline You Can Actually Follow

Days 1–5. Determine the model (in-house, virtual, ambient AI). Request the vendor's security documentation, subcontractor list, and data-flow diagram. Confirm audio retention defaults.

Days 6–10. Execute the BAA. Negotiate secondary-use and destruction terms. Do not schedule a pilot patient before this is signed.

Days 11–15. Build the EHR role. Create named accounts. Configure scribe-entry and attestation templates. Set the deprovisioning trigger with the vendor in writing.

Days 16–20. Train. Scribes on your privacy policies and incident reporting; providers on the attestation requirement; front desk on the patient-facing disclosure script.

Days 21–25. Pilot with two providers. Test audio deletion, test a mock records request, test account removal.

Days 26–30. Audit twenty pilot notes for attestation compliance. Update the risk analysis and vendor register. Then expand.

For background on how privacy and security expectations attach to health IT generally, HealthIT.gov's privacy and security materials are a reasonable orientation for a new privacy officer or a board member who wants context.

The One-Sentence Version

What does scribe mean for your practice? It means a new person or system with standing access to every encounter, a documentation-integrity obligation your providers must meet on every note, and — in two of the three models — a vendor whose contract, subcontractors, and retention behavior become your responsibility.

Before the pilot starts, get the BAA signed and the risk analysis updated to reflect the new data flow. Generate your updated risk analysis and policy set so the scribe program is documented the day it goes live, not the week an auditor asks.