Is Doxy.me HIPAA compliant?
Doxy.me signs a Business Associate Agreement with its customers, which HIPAA requires before a vendor handles patient data for you. Once it's signed, you can use Doxy.me with patient data within the BAA's scope; whether your use is compliant still depends on your setup and your own policies. Doxy.me doesn't say whether the BAA covers its AI features.
Does Doxy.me sign a BAA?
Yes, it signs a BAA
Doxy.me gives every user a free BAA generated in account settings, including on the Free plan, with Clinic BAAs generated by the Clinic admin. Its AI Scribe page describes short data retention and no model training but doesn't say whether the BAA covers Scribe.
Not confirmed for the AI features: Doxy.me doesn’t say whether its BAA covers Doxy.me Scribe (AI notes and transcription). Get that in writing before using it with patient data.
- Business associate
- Doxy.me
- Tool
- Doxy.me
- Plans with a BAA
- Free; Professional; Clinic
- Checked
By plan
| Plan | BAA | How to get it | Conditions |
|---|---|---|---|
| Free | Signs a BAA | Accept or sign online | All users can generate a free BAA under Profile > Settings > BAA. Free-plan BAAs are for individual providers only.[1] |
| Professional | Signs a BAA | Accept or sign online | Same self-serve BAA as the Free plan, generated under Profile > Settings > BAA; intended for individual providers.[1] |
| Clinic | Signs a BAA | Accept or sign online | Only Clinic account admins can generate the BAA. Organizations with several providers should contact support about coverage under a Clinic BAA.[1] |
Are the AI features covered?
Vendors often sign a BAA for the core product but leave some AI features out. Here is what Doxy.me says about each one.
| AI feature | Under the BAA | Details |
|---|---|---|
| Doxy.me Scribe (AI notes and transcription)Professional, Clinic | Not stated | Included in paid (Premium) plans in the US during early access. Doxy.me says data is cached up to 15 minutes, notes stay in the browser for 90 minutes then are deleted, and data isn't used to train its models. The page calls it HIPAA-compliant but doesn't mention the BAA or third-party AI providers.[2] |
Sources
A signed BAA is necessary but not sufficient for HIPAA compliance, which also depends on configuration, access controls, and your own policies. Verdicts summarize the vendor's own published terms as of the date checked; confirm with the vendor and your counsel before sending protected health information. Not legal advice.