A Business Associate Agreement (BAA) is the contract HIPAA requires between your practice and any vendor that handles Protected Health Information for you. An AI medical scribe processes the visit conversation, which is PHI, so the vendor is a business associate and a signed BAA is required before you use it with patients. If a scribe will not sign one, it is not a compliant option, no matter how good the notes are.
What is a Business Associate Agreement?
Under HIPAA, a covered entity (your practice) may only share PHI with a vendor once that vendor has agreed, in writing, to protect it. That written agreement is the BAA. It makes the vendor legally accountable for the data, restricts what they may do with it, and obliges them to report a breach. The agreement is not a formality: using a vendor that touches patient data without a BAA in place is itself a HIPAA violation, separate from anything that happens to the data.
Do you need a BAA for an AI medical scribe?
Yes. The moment a scribe listens to or transcribes a patient visit, it is handling PHI on your behalf, which makes its vendor a business associate. That is true whether the tool is ambient, dictation-based, or a note taker for telehealth calls. So the first question for any AI scribe is not how accurate the note is; it is whether the vendor will sign a BAA, and on which plan.
What should the BAA cover?
| The BAA should address | Why it matters for an AI scribe |
|---|---|
| Permitted use of PHI | Limits the vendor to providing the service, not repurposing your data |
| Safeguards in transit and at rest | Encryption and access controls around the audio and transcript |
| Audio retention and deletion | Whether visit audio is stored at all, and for how long; the strongest answer is that it never is |
| Training on patient data | An explicit prohibition on using your PHI to train AI models |
| Breach notification | What the vendor must tell you, and when, if something goes wrong |
Retention and model training are where AI scribes differ most, so ask about them directly. See how ClinicFrame handles audio, transcripts, and PHI.
Why "BAA available on enterprise" is a red flag
Some vendors advertise a low entry price, then make the signed BAA available only on a higher or enterprise tier. If that is the case, the entry price is not the real price of compliant use, because you cannot lawfully use the tool with patients until the BAA is in place. When you compare AI scribes, treat the plan the BAA lives on as part of the price. See how to choose an AI medical scribe.
Getting a BAA with ClinicFrame
ClinicFrame includes a signed BAA with every account, on every plan, not gated to an enterprise tier. Alongside it, the visit audio is never stored, and patient content is never used to train AI models, which are the two BAA terms that matter most for a scribe. For the full picture of what makes a scribe compliant, see is an AI medical scribe HIPAA compliant?