Chloe Pugh
Key Takeaways
- Get a signed BAA first: A virtual scribe company handling PHI is a business associate — get a signed BAA before any access is granted.
- Require unique logins and minimum necessary access: Require unique logins (never shared or borrowed), minimum necessary permissions, no PHI downloads, and work inside your EHR or a VDI.
- Review logs and remove access same-day: Logs only help if someone reviews them — and access must be removed the same day the engagement ends.
- Tell patients and let them decline: Tell patients a remote scribe is present and let them decline; recording and consent laws vary by state.
- Offshore risk and "HIPAA certified" claims: HIPAA does not ban offshore scribes, but location risk belongs in your risk analysis — and "HIPAA certified" is not an HHS program, so test the claim, don't trust it.
A virtual scribe company that handles your patients' PHI is a business associate, so you need a signed BAA before access. Beyond the contract, require a unique login per scribe, minimum necessary permissions, no PHI downloads, access logging, an offshore risk review if relevant, and patient notice of the remote listener.
Virtual Mojoe sells virtual medical scribe services. This guide is written so you can use the checklist on any vendor, including us. It is general information, not legal advice. Ask your compliance counsel about your own setup.
Quick answer: A virtual scribe company that handles your patients' PHI is a business associate, so you need a signed BAA before access. Beyond the contract, require a unique login per scribe, minimum necessary permissions, no PHI downloads, access logging, an offshore risk review if relevant, and patient notice of the remote listener.
Is a virtual scribe a business associate?
If you are asking are virtual medical scribes HIPAA compliant, the honest answer is that compliance is not a trait a scribe has. It is something your practice and the vendor build together. Our general primer on HIPAA rules for virtual assistants in clinics covers the basics. A scribe raises sharper questions, because a remote person hears the visit live and types into your EHR.
Under the Privacy Rule, a business associate is a person or company that creates, receives, maintains or transmits PHI on a covered entity's behalf. A scribe company doing that work fits the definition. That means a business associate agreement medical scribe arrangement is required before any PHI is shared.
There is one nuance. MagMutual notes that whether you need a vendor-level agreement or one with the individual scribe depends on whether PHI ever touches the vendor's own systems. If the scribe logs directly into your EHR and nothing is stored on vendor equipment, the paperwork can look different. Either way, the practice stays accountable for who it lets in, and the HHS Office for Civil Rights enforces against practices that fail to vet and monitor their associates.
What the BAA has to cover
A virtual scribe BAA should be more than a signature page. At minimum, check that it addresses:
- Permitted uses and disclosures of PHI
- Required safeguards, in line with the Security Rule
- A ban on further disclosure beyond what the contract allows
- Breach reporting, including how fast the vendor must tell you
- Return or destruction of PHI when the engagement ends
- Flow-down to any subcontractors who touch PHI
HHS publishes sample business associate provisions that make a useful yardstick. Compare your draft against them, and have counsel review the final version.
Access controls for a remote scribe
The contract sets the rules. Access controls enforce them. These are the remote scribe security requirements worth putting in writing:
- A unique login for every scribe. The Joint Commission flags shared or borrowed physician logins as a risk, since they blur who entered what.
- Minimum necessary permissions. The scribe sees only what the job requires, nothing more.
- No PHI downloads to personal devices. Work should happen inside your EHR or a controlled environment, such as a virtual desktop (VDI).
- Access logs that someone actually reviews. Logging is only useful if it is checked.
- Access removed on the day the engagement ends. Offboarding should be same-day, not a task for next week.
- Provider verification of scribe entries. The Joint Commission expects the provider to review what the scribe documents.
The exam-room question
Access controls cover the screen. The exam room raises a different issue: someone is listening, and the patient may not know it.
Decide first whether sessions are recorded. A live-only scribe who hears the visit and types is different from one who works from a stored recording. Each choice changes your storage, retention and consent obligations.
MagMutual's guidance is to tell patients that a remote scribe is present and let them decline. That is a sensible habit even where the law does not demand it. Recording and consent laws vary by state, and some require every party to agree, so check the rules where you practice before relying on any one-size policy. A short line in your intake forms, plus a verbal mention at the start of the visit, goes a long way.
Offshore scribes: what changes
HIPAA does not ban offshore vendors. What changes is the risk. HHS guidance (FAQ 2083) expects a practice to account for the location of a vendor and its data in its risk analysis. A scribe working from another country can raise questions about legal recourse, data transfer and how quickly you could act after an incident.
On enforcement, MagMutual's view is that OCR is likely to pursue the US practice, not the overseas vendor, when something goes wrong. That is the insurer's opinion, not settled law, but it is a fair signal of where your exposure sits. If you consider offshore medical scribe HIPAA arrangements, document the risk review, confirm the BAA is enforceable in practice, and ask where PHI is stored and who can reach it.
What "HIPAA compliant" claims actually mean
Sales pages love the phrase. Treat it as a claim to test, not a fact.
A training certificate shows a person sat through a course. It does not prove your data is safe. Ask for the evidence instead: the signed BAA, written policies, a summary of the vendor's own risk analysis, and a clear description of how access is provisioned and removed. Be careful with any vendor that leans on "HIPAA certified" as proof. As we understand it, HHS does not run or endorse a private HIPAA certification program, but confirm this on HHS's website before you rely on it.
Vendor due-diligence checklist
Use these questions with any vendor. Our virtual medical scribe services guide explains what a typical engagement includes, which helps you ask sharper questions.
| Question to ask | Good answer | Red flag |
|---|---|---|
| Who signs the BAA, and on whose behalf? | A named, authorized representative of the company, with a clear scope | "We don't need one" or an unclear signer |
| Where do your scribes physically work? | A stated location and policy for remote work | Vague answers, or a refusal to say |
| Do scribes use VDI or log in directly? | A defined method that keeps PHI inside your environment | Data handled on unmanaged personal machines |
| What stops PHI being downloaded or copied? | Technical blocks and written policy | "We trust our people" with nothing behind it |
| Are access logs kept, and who reviews them? | Logs retained, reviewed on a schedule | No logging, or no one reads them |
| How fast will you notify us of a breach? | A specific window written into the BAA | "As soon as practical" with no commitment |
| Do you use subcontractors with PHI access? | Disclosed, with the same obligations flowed down | Unknown or undisclosed subcontractors |
| What happens at offboarding? | Same-day access removal and PHI return or destruction | No documented process |
| Does each scribe have a unique login? | Yes, never shared or borrowed | Shared accounts or physician credentials |
If a vendor stumbles on more than one of these, keep looking.
What may change soon
The Security Rule is under review, but the update is not law yet. HHS proposed a major rewrite, published in the Federal Register on January 6, 2025. The rewrite was moved to HHS's long-term actions list with a target of July 2027, while the existing Security Rule remains fully enforceable. The proposal includes annual written verification of business associates' safeguards, which would put more weight on the questions in the table above. HHS regulatory agenda sets 2026 timeline for HIPAA updates
You do not need to wait. The controls in the proposal reflect what reasonable security already looks like. Status can change, so re-check the Federal Register and reginfo.gov on the day you publish or act on this.
How Virtual Mojoe sets up scribe access
Here is what we state on our own page about scribe access. We work inside approved EHR systems, use authentication and secure communication, apply access controls, and set minimum necessary permissions. Access is reviewed and then removed when it is no longer needed.
Use the same checklist on us that you would use on anyone else. If you want to talk through your setup, ask about our HIPAA-compliant virtual medical scribe service.
Also read
Source: Virtual Mojoe — Virtual Medical Scribe Services
Source: Virtual Mojoe — What Does a Virtual Medical Scribe Do?
Frequently Asked Questions
1. Do I need a BAA with a virtual scribe company?
2. Is an individual freelance scribe a business associate?
3. Can a virtual scribe work from home under HIPAA?
4. Can a scribe use the physician's EHR login?
5. Are offshore medical scribes allowed under HIPAA?
6. Do patients have to agree to a remote scribe?
AI Summarize
