Is Your AI Scribe HIPAA Compliant? A Home Health Checklist
An AI scribe records the most sensitive part of home health: the conversation in the patient's home. That recording, its transcript and the note drafted from it are all protected health information. Before an agency or a clinician turns one on, it's worth knowing what HIPAA actually asks of the tool and of you.
This checklist is written for home health agencies and home health clinicians evaluating any AI scribe, including ours. It isn't legal advice; your compliance officer and the HIPAA Security Rule itself (45 CFR Part 164, Subpart C) have the final word.
What HIPAA requires of a documentation app
HIPAA's Security Rule sets three kinds of safeguards for electronic protected health information (ePHI):
Administrative safeguards — policies for who can reach patient data, workforce training, and what happens after an incident.
Physical safeguards — protecting the devices and facilities where ePHI is stored. For a phone app that goes into patients' homes, that means the phone itself.
Technical safeguards — encryption, authentication, access control and audit records.
An AI scribe adds two things a typed-note app doesn't have: audio, and a drafting step. Both need the same protections as the note.
The AI scribe checklist
Ask every vendor these questions, and get the answers in writing:
- Will you sign a Business Associate Agreement (BAA)?
- Is the recording, transcript and note encrypted on the phone, and in transit?
- Where do the recording and transcript go, and who can see them?
- How long are recordings kept, and can the agency delete them?
- What is wiped from the phone when the clinician signs out?
- How is the patient's consent to recording captured?
- Does each drafted answer show where it came from, so a wrong one can be caught before signing?
- Can anything be signed without the clinician confirming it?
If the answer to any of these is "no" or "I don't know," keep looking.
Encryption on the phone and in transit
On the phone: a home health app has to assume the phone will one day be lost in a car or left in a patient's living room. VisitNote stores its local data in an encrypted database (SQLCipher), and keeps sign-in credentials in iOS Keychain and Android's secure storage, never in plain text.
In transit: everything between the app and our servers travels over encrypted connections.
With no signal: home health visits often have no coverage. VisitNote keeps the visit encrypted on the device until it can send it. See how the offline nursing app handles that.
Wiping the phone on sign-out
What stays on a phone after a clinician signs out matters as much as what's on it during the visit. When a clinician signs out of VisitNote, or deletes their account, local notes, visit records and audio are removed from the device and the sign-in credentials are cleared.
Consent to record
Recording a visit raises a question a typed note never did. In the VisitNote agency app, the agency chooses how consent works: either the nurse records the patient's consent before each recording, or the agency attests that patients agree as part of their services agreement. Check your state's recording-consent law with counsel before choosing.
Business Associate Agreements
A vendor that creates, receives or stores PHI for a covered entity is a business associate, and needs a BAA. VisitNote signs a BAA with agencies on request. Ask any vendor whether its own subcontractors that touch PHI are covered too.
The safeguard people forget: the draft itself
An AI-drafted note that's wrong and gets signed is a documentation problem, not just a privacy one. A home health scribe should make every suggestion checkable. In VisitNote, each suggested answer shows the sentence it came from, required items the visit didn't cover come back as questions, and the note can't be signed while a suggestion is unconfirmed. More on that in how the home health AI scribe works, and on the office side in home health agency software.
Where to go next
If you're comparing scribes, read ambient AI scribe vs a home health scribe. If you want to see the safeguards above on your own phone, solo clinicians can start with the app, and agencies can book a demo.