No AI scribe is 'HIPAA certified' by HHS

Among dentists not yet using AI for charting and note-taking, 34.8% plan to start, according to the ADA Health Policy Institute's July 2026 survey. That is a higher planned-use figure than imaging (25.4%) or insurance verification (32.6%) in the same survey. If you run a practice, a rep will be in front of you with a scribe demo soon, and the slide will say "HIPAA-compliant". Your hygienist will ask whether she can switch it on Monday.

The myth you will hear, in the vendor's words or your own, is: "It's HIPAA-compliant, so it's safe to use." The claim contains a real point, which is why it survives. A vendor with no security program is a poor starting position, and the badge is a fair first filter. It is a bad last filter. Four separate things decide whether the tool is safe in your chairside workflow, and the badge answers none of them.

Nobody certifies the product

Start with the phrase itself. HHS has said for years that it does not certify products as HIPAA compliant, and the cloud computing guidance repeats the point: "OCR does not endorse, certify, or recommend specific technology or products." The Security Rule FAQ goes the other way round and says there is no standard that requires a covered entity to "certify" its own compliance either.

So "HIPAA-compliant" on a pricing page is the vendor's own description of itself. It may be accurate. It may rest on a SOC 2 report, a third-party audit or a marketing review. You cannot tell which from the badge, and no regulator will treat it as a defence if something goes wrong in your practice.

The wording is common in the category. A vendor-published review of dental AI scribes (Denti.ai, February 2026) calls HIPAA compliance "non-negotiable" and says the tool "must be fully HIPAA-compliant, with encryption, BAAs, and clear data handling policies". In the version we retrieved, the page gave no vendor-by-vendor detail on which of the seven tools it reviewed hold a BAA, what each retains, or whether patient data trains the models. The criterion is stated and the evidence is left to you.

So what for you: treat the badge as a prompt for questions, never as an answer, and do not let it appear in your own staff briefing as a reason a tool is approved.

Compliance lives in a contract, not in the software

What HIPAA actually requires of you is a business associate agreement (BAA) with any vendor that handles protected health information on your behalf. HHS's cloud guidance is blunt that a cloud provider maintaining electronic PHI for a covered entity is a business associate, and that not holding a decryption key does not remove that status. A scribe that records or transcribes a hygiene visit is handling PHI whether or not the vendor says it "can't see" the data.

The contract attaches to a specific product and a specific plan, which is where practices get caught. Our ChatGPT versus AI scribe analysis showed that some consumer-grade chatbot plans carry no BAA at all, so the same company can be usable on one tier and off limits on another. The California Dental Association's guidance (August 2025, published with its endorsed compliance partner Abyde, so read it as partner-sourced) puts the standard plainly: it is "best practice to avoid working with a vendor who refuses to sign a BAA", and BAAs should be signed before implementation.

So what for you: the document that matters is a signed BAA that names the exact product and plan you will use, and it should be in your compliance folder before the first patient is recorded.

A BAA does not answer the consent question

This is the gap that surprises principals most. A BAA addresses how the vendor safeguards PHI. It says nothing about whether you were allowed to record the conversation in the first place. That is state law, and several states require every party to a confidential conversation to agree.

The live example is Washington et al. v. Sutter Health (N.D. Cal., filed April 8, 2026). According to reporting on the complaint by HIPAA Journal and a Northeastern University School of Law summary (checked July 2026), the plaintiffs allege that two health systems used an ambient AI scribe to record patient visits without informed consent, under the California Invasion of Privacy Act, the Confidentiality of Medical Information Act and the federal Wiretap Act. The reporting says the complaint does not allege a HIPAA violation, and that the vendor held a signed BAA with its health-system clients. These are allegations, not findings.

California's statutory damages show why the point has teeth. Penal Code Section 637.2 allows $5,000 per violation without proof of actual harm (a figure we also set out in our consent and wiretap Q&A). One tool recording every appointment in a day is many potential violations, not one. California is the most cited example, and your state may differ, so check yours.

So what for you: a compliant vendor and a lawful recording are two separate tests. Write a short consent script for the front desk and the chair, and have it reviewed against your state's recording law before go-live.

Your existing software and your own signature

Two more checks sit inside your practice rather than the vendor's. The first is your current stack. The CDA guidance advises confirming that existing software BAAs cover AI functionality, because a practice management or imaging vendor can switch on an AI feature, route data to a subprocessor, and leave your original agreement silent on it. If your charting system now has a "voice" or "assistant" feature, it needs the same written confirmation as a new vendor.

The second is clinical accountability. The same guidance says clinicians must verify that AI output meets the standard of care. A scribe drafts; you sign. Our analysis of dental scribe hallucination covers why a fluent, wrong note is a bigger risk than an obviously broken one, and our dental charting pricing review explains why the sticker price you were quoted may not include the charting you want.

For a second chair, third site or a hygienist-led workflow, the risk grows with each location. Each one can drift into a different setup unless one named person owns the approval list.

So what for you: appoint one person to approve every AI tool that touches patient data, and give them a one-page checklist so approval does not depend on who met the rep.

Four documents to ask for instead of a badge

The evidence points toward replacing one vague question with four specific requests. If you are about to approve a dental AI scribe, ask for these in writing:

1. The signed BAA, naming the product and plan. A web page saying a BAA is "available" is not a signed agreement. If the vendor refuses, the CDA guidance is to walk away.

2. A written data map. Where the audio goes, how long audio and transcripts are retained, which subprocessors touch them, and whether your visits are used to train models. You should be able to answer a patient who asks.

3. Your consent script and your state's rule. This is your work, not the vendor's. Draft it, check it against your state's recording law, and decide how you handle a patient who declines.

4. Your review rule. Who reads the draft, how quickly, and what happens when the note says something you did not say or do. Put it in the staff handbook.

Frankly, if a vendor can supply the first two within a week and will not discuss the third and fourth because "the product handles it", that tells you how much of the compliance work they expect you to do alone. Prefer the vendor that answers in writing, and shortlist two rather than trialling five.

So what for you: send those four requests to your shortlist this week, and make approval conditional on a complete set.

What we could not verify

As of October 2026, we did not review any specific dental AI scribe vendor's BAA or security documentation, so nothing here rates a named product. The HHS certification statement comes from guidance pages whose review dates predate 2026, though HHS has not announced a certification program. The Sutter case is at the allegation stage and the details come from secondary reporting. The ADA figures come from its July 2026 survey page, which did not state a sample size in the version we retrieved. The Denti.ai review is vendor-published. None of this is legal advice, and your state dental board, your attorney and your compliance adviser still decide what applies to your practice.

If you would rather have an independent view of which AI tools suit your workflow and what each needs before it is safe to switch on, book a free 20-minute discovery call, or see how the AI Opportunity & Growth Assessment works. We have no vendor relationships behind the advice.