HIPAA Compliance

Scribeable is built for HIPAA-covered practices. A Business Associate Agreement is included on every plan, including the trial, and we maintain administrative, physical, and technical safeguards to protect Protected Health Information (PHI). HIPAA compliance is shared: your practice's own safeguards count too.

Our HIPAA Security Officer oversees all compliance activities and can be reached at [email protected].

• Encryption: AES-256-GCM envelope encryption with ECDH P-256 key exchange across 5 layers (API requests, responses, WebSocket, audio, field-level at rest). Enforcement mode active on covered request, response, and WebSocket paths — plaintext PHI is rejected there. Since October 2026, an app that does not encrypt live audio is refused. Two features still send data protected by TLS only, which Cloudflare can read in transit: calculator inputs and practice roster CSV uploads. See our security documentation for details.
• Access Controls: Role-based, with MFA available
• Audit Logging: PHI access through the app is logged
• Data Backup: Encrypted backups with geo-redundancy

A BAA, accepted at sign-up, is included on every plan, including the 14-day trial:

• Standard BAA included with all plans
• Custom BAA terms available on the Practice plan
• BAA covers all Scribeable services and subprocessors

We maintain signed BAAs with all our AI and data processing subprocessors including Anthropic (Claude), OpenAI and Deepgram. View our complete subprocessor list for details.

Download our standard BAA from the Legal Hub or request a custom agreement.

We help you comply with patient rights under HIPAA:

• Access: Export patient data on request
• Amendment: Edit notes as needed
• Accounting: Access audit logs
• Restriction: Limit data sharing