Q&A: HIPAA regulations for medical scribes

Q: My doctor’s office recently hired medical scribes. I was not informed before my visit that another person would be in the exam room taking notes, and the scribe’s presence was not explained until I asked. Does HIPAA require my doctor to get my authorization before bringing a scribe into the room?

A. While it may not be a good practice to invite another person into the exam room without explaining the situation to you first and potentially offering you an opportunity to object, it is not a violation of HIPAA. The scribes would be considered BAs of your doctor’s practice. That means your doctor must require the vendor to sign a BAA. The BAA includes all of the HIPAA requirements that the vendor agrees to comply with. BAs are required to adhere to the HIPAA Privacy Rule use and disclosure provisions, the full HIPAA Security Rule, and the HIPAA Breach Notification Rule. HIPAA does not require CEs such as your doctor’s practice to obtain a signed authorization from patients before BAs are permitted access to your PHI.

Editor’s note: Apgar is president of Apgar & Associates, LLC, in Portland, Oregon. He is also a BOH editorial advisory board member. This information does not constitute legal advice. Consult legal counsel for answers to specific privacy and security questions. Opinions expressed are those of the author and do not represent HCPro or ACDIS. Email your HIPAA questions to Editor Nicole Votta at nvotta@hcpro.com.