What the New HIPAA Guidance on AI Scribes Actually Means for Your Practice
Macy Ober
Marketing, MyMediScribe
Ambient AI scribes are now in the room with patients at thousands of U.S. practices. The federal government has noticed — and the rules are getting sharper.
- Jan. 6, 2025: OCR proposed the biggest HIPAA Security Rule rewrite in 20 years — encryption, MFA and risk analyses become mandatory, not optional.
- OCR is auditing now. Phase 3 audits are live, with “shadow AI” tools (scribes, RCM bots) as the top exposure for practices.
- No signed BAA = no AI scribe. A vendor breach without one becomes your reportable breach.
- Ask six questions before you sign: BAA, encryption, retention, state consent, third-party attestation, breach-notification timeline.
- MyMediScribe meets all six — built for where HIPAA is heading, not where it sat in 2013.
Over the past year, HHS has clarified how HIPAA applies to AI tools that listen to clinical encounters and draft notes. For physicians and practice managers weighing a purchase, the cost of choosing the wrong vendor is rising fast.
The biggest HIPAA update in two decades
On Jan. 6, 2025, the HHS Office for Civil Rights (OCR) published a Notice of Proposed Rulemaking that would overhaul the HIPAA Security Rule for the first time since 2013. The proposal would require:
🛡️ What’s now required under the proposed rule:
- •Mandatory encryption of all ePHI — at rest (AES-256) and in transit (TLS 1.2+). No longer a “best practice” — it’s a requirement.
- •Multi-factor authentication (MFA) on every system that touches patient data. Single-password access will be a compliance violation.
- •Annual technical risk analyses — mandatory, not optional. Practices must document risks and remediation plans every year.
- •Written technology asset inventory — every device, application, and AI tool that processes PHI must be cataloged and tracked.
- •Patch management and vulnerability remediation — systems must be kept current with documented timelines for critical patches.
- •Network segmentation — PHI systems must be logically separated from general IT infrastructure.
- •Incident response and contingency planning — written plans with restore-from-backup testing every 72 hours of a critical failure.
OCR has confirmed the rule is on track for finalization despite industry pushback. Attorneys are calling it the most significant rewrite of HIPAA's technical safeguards in 20 years.
Key takeaway: Your vendor's encryption, MFA and audit logging are about to be regulated, not optional.
Enforcement has shifted to AI
OCR isn't waiting for finalization. The third phase of HIPAA compliance audits is already underway, with risk analysis as the central focus (HIPAA Journal). Privacy attorneys flag “shadow AI” — ambient scribes and revenue-cycle tools ingesting PHI without a properly scoped Business Associate Agreement — as the top exposure for established practices (Docuhealth, 2026).
The rule is simple: if an AI tool processes PHI on your patients' behalf, the vendor is your business associate. Full stop. A signed BAA determines whether a vendor breach becomes your reportable breach.
Key takeaway: No BAA = no AI scribe. Walk away.
Six questions to ask before you buy
1. Get a signed BAA before any audio is recorded.
Not a click-through. A countersigned agreement defining permitted uses of PHI and breach notification timelines.
2. Confirm encryption at rest and in transit.
AES-256 at rest, TLS 1.2 or higher in transit. Ask where the keys live and who can access them.
3. Verify the data-retention policy in writing.
Some vendors retain audio indefinitely to train models; others delete in hours. Know which applies — and whether you can opt out of model training.
4. Confirm patient consent procedures for your state.
Federal HIPAA covers treatment, payment and operations. State recording laws are stricter. Eleven states require all-party consent. Your vendor should supply template language and a capture workflow.
5. Demand a third-party security attestation.
SOC 2 Type II is table stakes. HITRUST is stronger. There is no federal HIPAA certification — be skeptical of “HIPAA-compliant” badges.
6. Walk through the breach notification chain.
HIPAA gives 60 days from discovery to notify patients. A vendor that takes 45 days to tell you has consumed three-quarters of your clock.
Key takeaway: If a vendor deflects on any of these six, the answer is no.
How MyMediScribe handles each one
- BAA signed before first encounter. Every customer. No exceptions.
- Encryption everywhere. TLS 1.3 in transit, AES-256 at rest, keys in AWS KMS.
- MFA available on every account via Amazon Cognito.
- HIPAA-eligible AWS infrastructure under a signed AWS BAA (confirmed via AWS Artifact).
- Configurable audio retention. Recordings are not used to train third-party models without explicit written consent.
- State consent templates included in onboarding for all-party-consent states.
- Breach notification commitments written into the BAA — not assumed.
Key takeaway: MyMediScribe is built to where the regulations are heading, not where they sat in 2013.
The bottom line
The AI scribe market is crowded, and the marketing copy looks identical from booth to booth.
The 2025 Security Rule proposal, active OCR audits and the “shadow AI” enforcement wave all push the same direction: the gap between vendors who treat compliance as a feature and vendors who treat it as a checkbox is about to become a financial one.
Ask the six questions before you sign. The right vendor will welcome them. The wrong one will deflect.
That is the standard MyMediScribe was built to meet — and the standard every practice should hold its tools to before the next OCR audit letter arrives.
Macy Ober
Marketing, MyMediScribe
Macy leads marketing and communications at MyMediScribe, translating complex healthcare compliance topics into actionable guidance for physicians and practice leaders.
References
- HHS Office for Civil Rights. HIPAA Security Rule to Strengthen the Cybersecurity of Electronic Protected Health Information. NPRM, Federal Register, Jan. 6, 2025.
- HHS. HIPAA Security Rule NPRM.
- Alston & Bird. HIPAA Security Rule: Still on Track for Finalization. November 2025.
- HIPAA Journal. OCR Gives Update on Proposed HIPAA Security Rule. 2025.
- Docuhealth. HIPAA Exposure in AI-Integrated Workflows. 2026.
- ITECS. HIPAA Compliance and AI: Healthcare Risk Guide 2026.