Skip to main content
Scribe-X

Trust Center

Scribe-X Clinical Intelligence Platform

The Scribe-X Trust Center describes the security, privacy, and AI governance posture of the Clinical Intelligence Platform. Scribe-X provides clinical documentation solutions to community health centers, FQHCs, and outpatient practices, combining artificial intelligence with trained personnel under human oversight. This page summarizes Scribe-X’s security posture and states how security documentation may be requested.

privacy@scribe-x.com CIP Privacy Policy Legal DocumentsLast updated September 25, 2026

Compliance

  • HIPAA

    Business associate under an executed Business Associate Agreement with every customer

  • SOC 2 Type IIIn progress

    Examination in progress. Report expected October 2026 and available to customers upon completion.

Status as stated in the Trust Center document, effective September 25, 2026.

Controls

Updated September 25, 2026

Product Security

  • (a)Encryption. Data is encrypted in transit and at rest, including AES 256-bit at rest and DTLS/SRTP for real-time media streams.
  • (b)Access control. Role-based and least-privilege. Administrative access requires multi-factor authentication. Unique credentials, cryptographically hashed passwords.
  • (c)Tenant separation. Customer data is logically separated by tenant, and access is role-scoped to a single organization’s environment.
  • (d)Audit logging. Access and system activity are logged and monitored. Access audit logs are available to customer administrators.
  • (e)Authentication. Administrative controls for user and role management, provisioning, and deprovisioning.

Infrastructure and Monitoring

  • (a)Cloud-hosted on Amazon Web Services in the United States. Customer data is not stored outside the United States.
  • (b)Intrusion detection, file integrity monitoring, and log monitoring on production systems.
  • (c)Regular third-party risk assessments, penetration testing, and vulnerability scanning.

AI

  • (a)Training data. Customer data is not used to train, fine-tune, or otherwise develop the weights or parameters of any artificial intelligence or machine learning model, and Scribe-X maintains no evaluation or test datasets composed of customer encounter content. The Responsible AI Use Policy is the governing statement on model training.
  • (b)Validation and monitoring. Output is validated before release against clinical documentation quality rubrics, monitored in production through structured sampled quality review, and updated on a managed release cycle with regression evaluation.
  • (c)Human oversight. Under the Assist Solution, each note is completed and checked by a trained person before delivery to the chart. Under the Live Solution, a trained person documents the encounter directly in the chart. The Solo Solution includes no independent review by Scribe-X personnel. All documentation is draft until a provider signs it.
  • (d)Traceability. Traceability windows follow the retention periods in the Data Handling and Security Schedule.
  • Additional detail is stated in the Responsible AI Use Policy at scribe-x.com/legal/responsible-ai.

Data Privacy and Retention

  • (a)Data types, retention periods, deletion practices, and subprocessors are described in the Data Handling and Security Schedule at scribe-x.com/legal/data-handling.
  • (b)Retention periods apply uniformly and are stated by data type in the Data Handling and Security Schedule. Data is retained for the duration of the applicable agreement, followed by a portability window during which the customer may export its data before deletion.
  • (c)The customer’s EHR remains the system of record. Under the Live Services, documentation is written directly into the customer’s EHR and no encounter audio, video, or transcript is recorded or stored. Encounter video is not recorded or stored under any solution. Session messaging between the provider and the scribe is the one artifact retained, for up to twenty-four (24) hours, and is then purged.

Workforce

  • (a)Staffing is entirely onshore in the United States. Documentation is produced by Remote Medical Scribes and Remote Healthcare Assistants engaged by Scribe-X.
  • (b)Background checks and HIPAA training for all personnel with access to protected health information.
  • (c)Workforce confidentiality obligations backed by Business Associate Agreement requirements.

Incident Response

  • Scribe-X’s incident response commitments, including notification timelines, are stated in the Data Handling and Security Schedule at scribe-x.com/legal/data-handling. A suspected vulnerability or incident may be reported to privacy@scribe-x.com; Scribe-X acknowledges receipt within one business day.

Resources

View All

Documentation Available on Request

  • (a)SOC 2 Type II report, upon completion.
  • (b)Business Associate Agreement template.
  • (c)Subprocessor list.

Requests may be directed to privacy@scribe-x.com.

Subprocessors

A limited set of subprocessors supports the Platform. Scribe-X requires each subprocessor with access to Customer data to enter into a written agreement imposing obligations consistent with this Schedule and, where the subprocessor handles Protected Health Information, with business associate obligations. Scribe-X will provide the current subprocessor list to Customer on request and will not engage a new subprocessor with access to Protected Health Information without imposing those obligations.

From the Data Handling and Security Schedule, version 1.0, section 9. Read the Schedule

Updates

View All

  1. 5 legal documents published

    Effective September 25, 2026

    Legal

  2. Trust Center updated

    Effective September 25, 2026

    Trust

Scribe-X hopes this Trust Center helps clarify the safeguards applied to customer data and welcomes questions about any of them.

The Full Legal Document LibraryProduct terms, data handling, privacy, responsible AI use, and acceptable use, each versioned and archived.