The physician who adopted an AI medical scribe last year probably asked one question before signing up: Is it HIPAA compliant? That is the right instinct. It is also an incomplete one.
HIPAA compliance means a vendor has agreed to handle protected health information (PHI) in accordance with the rules. It does not tell them whether the vendor’s security controls actually work, have been independently tested, or have held up over time. A vendor can sign a Business Associate Agreement (BAA) and still have a security program that would not survive a serious audit. SOC 2 Type II is the standard that closes that gap. It is what separates a vendor that says it takes security seriously from one that has proved it, over months, under third-party scrutiny, with documented evidence.
Healthcare data breaches cost organizations an average of $7.42 million per incident in 2025, the highest average of any industry for 14 consecutive years. That is not a figure the solo practice or small group can absorb. When the AI scribe tool is sitting in an exam room, the question of whether it holds SOC 2 Type II certification is not bureaucratic. It is financial and clinical survival.
SOC 2 Type I vs. Type II: The Difference That Matters in a Clinical Context
SOC 2 is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). It evaluates how an organization manages data across five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Security is the only required category. The others are included based on what the vendor’s operations warrant.
SOC 2 Type I examines whether internal controls are appropriately designed at a specific point in time. SOC 2 Type II assesses the ongoing performance and effectiveness of those controls over a defined period, typically six to twelve months. The audit is conducted by an independent CPA firm, not by the vendor itself.
The gap between Type I and Type II is not cosmetic. A vendor can achieve SOC 2 Type I in the weeks before a sales cycle closes. It proves controls were designed correctly on that day. It does not prove that those controls ran consistently for the next six months, that access was managed properly when someone left the company, or that the incident response functioned when a real anomaly appeared. Type II requires all of that. It is the difference between a vendor presenting a plan and a vendor demonstrating a track record.
Vendors managing electronic health records or medical device data almost always need Type II reports. The extended observation period reassures clients that controls can handle the complexities of managing sensitive healthcare data over time. For a practice trusting a scribe tool with audio of every patient consultation, that observation period is not a detail. It is the only evidence that security is operational, not theoretical.
Why HIPAA Alone Does Not Cover This
HIPAA governs the handling of PHI. It requires covered entities and their business associates to implement administrative, physical, and technical safeguards. It mandates breach notification, patient access rights, and minimum necessary standards for data use. A signed BAA creates legal accountability.
SOC 2 and HIPAA serve different purposes. SOC 2 focuses on the Trust Services Criteria and evaluates how an organization safeguards customer data through its internal controls and processes. HIPAA specifically regulates the handling of Protected Health Information with detailed mandates covering patient rights, breach notifications, and business associate agreements. Healthcare organizations often require vendors to meet both standards to fully address legal and operational risk.
A BAA creates a contractual obligation. SOC 2 Type II creates verified evidence that the technical systems behind that obligation can actually protect data. Both are necessary. Neither replaces the other.
An AI scribe processes audio of a physician-patient consultation. It captures diagnosis discussions, medication plans, patient history, and billing information in real time. Every piece of that data is PHI. The question of whether the system encrypts it properly, restricts access correctly, logs events for review, and responds to incidents in a defined timeframe is exactly what SOC 2 Type II audits.
Heidi Health and Nabla: What the Compliance Landscape Looks Like for Well-Funded Competitors
Heidi Health and Nabla are two of the most visible competitors in the AI scribe category. Both have significant institutional investment: Heidi Health raised $96.6M at a $703M valuation, and Nabla closed a $120M Series C. Both serve large physician populations. Neither is a security risk by definition. But funding does not equal compliance depth, and scale does not equal verification.
Heidi Health markets itself as covering the full clinical day. It has HIPAA-compliant documentation and operates across 116 countries, delivering 2 million-plus consultations per week. At that scale, the compliance infrastructure has to be substantial. The question for a physician evaluating Heidi Health is not whether they have security. It is whether they can produce a current SOC 2 Type II report for the specific plan tier the practice is on, and whether that report covers the specific services handling PHI in that setup.
Nabla holds NEJM peer-reviewed validation, the most credible clinical proof point in the category. Nabla’s positioning shifted post-Series C toward “agentic AI” and enterprise health systems. With 85,000-plus clinicians on the platform and 150-plus health organizations, Nabla’s compliance posture is enterprise-grade by necessity. The same verification question applies: ask for the current SOC 2 Type II report, ask when it was last renewed, and confirm it covers the product components the practice will actually use.
The pattern that matters is not whether a vendor has a compliance badge on their marketing page. Not every SOC 2 badge carries equal weight. A platform with SOC 2 Type I passed a point-in-time audit, while Type II demonstrates sustained compliance over a monitoring period. For regulated industries, the distinction matters. A physician evaluating an AI scribe needs to specifically request the Type II report, check the audit period, and confirm that the audit firm is independent. A marketing page that says “SOC 2 compliant” without specifying Type II is describing Type I at best, or a self-attestation at worst.
How to Actually Check an AI Scribe’s SOC 2 Type II Status
The practical process is shorter than most physicians expect, but it requires explicitly asking the right questions. The vendor’s sales team will not volunteer the distinction between Type I and Type II unless asked.
Ask for the SOC 2 Type II report directly: A prepared vendor will have an executive summary available for prospective customers. Some require an NDA first, which is standard. If the vendor cannot produce a report or offers a Type I report while calling it Type II, that is a material signal.
Check the audit period: SOC 2 reports are generally valid for 12 months. A report from 18 months ago is not current evidence. Ask when the next audit is scheduled and whether the vendor has continuous monitoring in place between annual audits.
Confirm the audit firm is independent: The audit must be conducted by a licensed CPA firm, not an internal team. Ask who performed the audit. An independent external auditor is the only source of a valid SOC 2 Type II report.
Identify which Trust Services Criteria are covered: Security is mandatory. For a scribe tool handling PHI, Confidentiality and Privacy should also be included. If the audit only covers Security and Availability, ask why.
Pair the SOC 2 check with the BAA: Healthcare AI vendors need SOC 2 Type II for the security controls and a signed BAA covering the actual deployment. A BAA without SOC 2 Type II is a legal document without technical verification. SOC 2 Type II without a BAA is a technical verification without legal coverage. Both must be in place.
Ask about subprocessors: An AI scribe tool likely uses third-party infrastructure, including cloud providers, transcription services, and data storage vendors. Ask whether those subprocessors are also SOC 2 Type II certified and whether they are covered under the vendor’s compliance program.
The Health Sector Coordinating Council advises healthcare organizations to confirm that vendors provide certifications or audit reports, specifically SOC 2 Type II, HITRUST CSF, or ISO 27001, and ensure they align with healthcare security norms. HITRUST, which incorporates HIPAA and NIST controls, is often preferred for healthcare-specific deployments. A vendor holding both SOC 2 Type II and HITRUST has a layered compliance posture, and that combination is the strongest available signal.
The Security Floor Every AI Scribe Must Clear
The AI medical scribe category is growing fast. More than 40% of US physicians reported using AI documentation tools in 2025, according to the AMA’s AI survey. The tools vary. The compliance posture behind them varies more.
The minimum security floor for any HIPAA compliant AI scribe processing physician-patient audio in a real clinical setting is: a signed BAA, current SOC 2 Type II certification from an independent auditor, AES-256 encryption for data at rest and in transit, documented access controls, and a published incident response procedure. That is not a high bar. It is the baseline that any practice would demand from a vendor handling physical patient records. Digital patient records deserve the same standard.
Notiro is HIPAA compliant and provides a BAA with every practice. SOC 2 Type II status should be confirmed directly with the Notiro product team before deploying in a practice environment, and the same verification process described above applies. Any vendor worth using in a clinical setting will welcome that conversation, not deflect it.
The physician who asks these questions before signing a vendor agreement is not adding friction to the buying process. They are closing the gap between a policy that says patient data is protected and actual evidence that it is.
The Compliance Check That Protects Every Patient Conversation
Healthcare data security conversations tend to stop at HIPAA. That is where regulators draw the minimum line. SOC 2 Type II is where verification begins. For a tool that sits inside every patient encounter, capturing what the physician says, what the patient discloses, and the diagnosis, the distinction between a vendor that has agreed to protect data and one that has proved they can is not academic. It is the difference between a compliant documentation workflow and a regulatory exposure waiting to surface.
The category has matured enough that a well-funded competitor and a newer entrant can both have HIPAA compliance pages. The compliance page is not the check. The current Type II report, the audit firm, the observation period, the subprocessor list, and the BAA together form the check. That is what a physician should request. That is what a trustworthy vendor can produce.
Start Your Free Trial at Notiro
Physician documentation burden is already high, and the compliance check on an AI scribe tool should not add to it. Notiro covers the full clinical day: patient intake AI before the visit, ambient scribing during it, and ICD-10 and CPT coding automation after it, with HIPAA compliance and a BAA in place from day one. Start your free trial at notiro, no IT setup, no enterprise contract.
