Checkout. Booking and payment for any clinic, in one flow.Set up CheckoutCould you show an auditor, today, who read each patient's note and when? With wai every read is logged against a named account.
Request a demoUpdated
An AI scribe is fit for a HIPAA-covered practice when the vendor signs a business associate agreement and protects the data with the safeguards the Security Rule asks for, encryption, access control and audit logs. wai is designed for practices covered by HIPAA and signs a business associate agreement with your practice before anything goes live.
HIPAA has no certification, so readiness also depends on your practice's role, the signed agreements and your operating controls. wai holds a SOC 2 Type II report, sent on request.
| What you get | What the rule asks | wai |
|---|---|---|
| Business associate agreement | A vendor that handles protected health information for a practice is a business associate, and works under a written agreement12 | Signed with your practice before anything goes live |
| Risk analysis and access management | Administrative safeguards, including a risk analysis and workforce access management3 | Role-based, least-privilege access enforced in the database. Your risk analysis stays yours |
| Access, audit and transmission | Technical safeguards, including access control, audit controls and transmission security4 | AES-256 at rest, TLS 1.3 in transit, and every read of a record logged against a named account |
| Clinical sign-off | Not a HIPAA rule, and every buyer asks | Every AI draft held until a clinician signs it |
| Independent assurance | HIPAA has no certification | A SOC 2 Type II report, sent on request5 |
A business associate agreement signed with your practice before anything goes live, and before any patient data reaches wai.
AES-256 at rest and TLS 1.3 in transit, on a managed key estate.
Role-based, least-privilege access enforced in the database, so each person sees what their role allows.
Every read of a record logged against a named account, and every message, draft, approval and signature written to an event log your practice can export.
Every AI draft is held until a clinician signs it, so nothing clinical reaches a patient without a named person's decision.
Patient data is processed to do the work your practice asks for, under the agreement, and is not sold.
See it run on one of your own consultations or a day at your front desk. Fifteen minutes on video.
Request a demoYour own risk analysis, policies and workforce training.
Who in your practice holds which role, and reviewing access when people join, move or leave.
Patient notice and consent for recorded or transcribed visits, under your state's rules.
The full status, with sources, is on HIPAA at wai.
The business associate agreement and the controls above come with every plan. The scribe is $550 a clinician a month on Clinician Plus and $350 on Clinician, published on the pricing page. Request a demo and we send the SOC 2 Type II report with the agreement.
wai drafts notes in 11 languages and runs every day at The Wellness, a private clinic in London, where every clinician has 15 hours a week back. Read the customer story.
What a demo shows
An AI scribe can be used by a HIPAA-covered practice when the vendor signs a business associate agreement and protects the data with the Security Rule's safeguards. HIPAA has no certification, so readiness also depends on the practice's own controls.
wai is designed for practices covered by HIPAA and signs a business associate agreement before anything goes live. HIPAA has no certification, so readiness for your practice also depends on your role, the signed agreements and your operating controls.
Yes, with your practice, before go-live and before any patient data reaches wai.
Yes. wai holds a SOC 2 Type II report, sent on request under a mutual non-disclosure agreement. SOC 2 is separate from HIPAA.
Patient data is processed to do the work your practice asks for, under the agreement, and is not sold. Ask us for the detail of the models and subprocessors for your intended use.
Notice and consent for recorded or transcribed visits follow your state's rules, and setting them is your practice's decision.
Further reading
Fifteen minutes on video, with the documents your compliance lead asks for.