AI Medical Scribe: Build vs Buy (2026 Guide)
A build-vs-buy guide to AI medical scribes: pipeline architecture, accuracy and clinician review, EHR integration, and how to choose.
A physician spends roughly two hours on documentation for every hour of patient contact. That ratio is the whole reason an ai medical scribe (an ambient system that listens to a clinical encounter and drafts the note) has gone from research demo to a budget line item at most health systems in under three years. The market now splits into named products you can sign for next week (DeepScribe, Abridge, Nuance DAX, Freed, Suki, Heidi) and the option a growing number of larger organizations are weighing: building the pipeline in-house on Claude, GPT, and Whisper-class speech models.
This is a build-vs-buy decision aid written for the person who has to own the outcome: a CTO, a VP of clinical informatics, or the engineering lead a hospital pulls in to make the call. We work as an ai healthcare company on exactly these systems, so the framing in this ai medical scribe guide is engineering and operations, not clinical guidance. Nothing below is medical advice. We will walk the reference architecture of an ambient scribe, name the tools on both sides, surface the HIPAA surface area, give you working code for the hard parts, and end with a decision matrix and a five-step pilot you can run in two weeks. If you are building anything that touches protected health information, pair this with our HIPAA-compliant AI deployment checklist.
What an ai medical scribe actually is
Strip away the marketing and an ambient scribe is a four-stage pipeline. Audio comes in from the room. A speech-to-text model turns it into a diarized transcript that knows who spoke. A language model summarizes that transcript into a structured note — usually SOAP (Subjective, Objective, Assessment, Plan) or a specialty template. A clinician reviews and signs, and the signed note posts back to the electronic health record. The accuracy of the whole thing is the product of two error rates stacked on top of each other: the transcription error and the summarization error. That stacking is why a strong transcriber feeding a strong summarizer still produces a weaker note than either component's headline score suggests. The errors compound; they do not average out.
The ai medical scribe architecture, stage by stage
Here is the reference ai medical scribe architecture we deploy. Whether you buy or build, every product on the market is some version of this. The value of drawing it out is that it shows you exactly which seams you own when you build and which the vendor hides when you buy.
Read the diagram left to right and the build decision becomes concrete. Capture is mostly a client app and a consent gate. ASR is a model choice: you can rent it (Deepgram, AWS Transcribe Medical, Google Cloud Speech) or self-host a Whisper variant. Summarization is the prompt, the template library, and the model. It carries the most product surface and the most clinical risk. Review is a UI problem: how fast can a clinician find and fix the one wrong line. EHR post-back is integration plumbing through FHIR or HL7 that, in practice, eats more of a build timeline than the AI does.
Speech-to-text is a clinical-safety surface
Generic word-error-rate benchmarks lie to you in healthcare. A transcriber can post a strong overall number and still mangle the words that matter: drug names, dosages, anatomy, and negations. "No history of seizures" and "history of seizures" differ by one token and invert the meaning. Your ASR choice has to be measured on a medical vocabulary, with diarization, in real room conditions — overlapping speech, background noise, accented English.
Summarization: turning a transcript into a SOAP note
The summarization step is where you turn a messy diarized transcript into the structured note a clinician will sign. The non-negotiable rule is grounding: every line in the note must trace to something actually said in the transcript. A scribe that invents a plausible-but-unsaid finding is worse than useless — it is a liability. We enforce this with a typed schema, a strict system prompt, and a post-generation check that flags any claim the model could not anchor to a transcript span.
import anthropic
client = anthropic.Anthropic() # API key from a secret store, never hard-coded
SYSTEM = """You are a clinical documentation assistant. You draft a SOAP note
from a diarized encounter transcript. You DRAFT only; a licensed clinician
reviews and signs every note. Hard rules:
- Use ONLY information present in the transcript. Never infer a diagnosis,
medication, dose, or finding that was not stated.
- If a required field has no supporting transcript text, write
"NOT DOCUMENTED" rather than guessing.
- For every Assessment and Plan line, you will be asked to cite the
transcript line numbers that support it.
- Output strict JSON matching the provided schema. No prose outside JSON."""
def draft_note(transcript: str, template_schema: dict) -> dict:
msg = client.messages.create(
model="claude-sonnet-4-6",
max_tokens=2000,
temperature=0, # deterministic for a clinical record
system=SYSTEM,
messages=[{
"role": "user",
"content": (
f"SCHEMA:\n{template_schema}\n\n"
f"TRANSCRIPT (line-numbered):\n{transcript}\n\n"
"Return the SOAP note as JSON. Include a 'citations' map from\n"
"each Assessment/Plan item to the transcript line numbers."
),
}],
)
return parse_json(msg.content[0].text) Two design choices in that snippet matter more than the model name. Temperature is zero — a clinical record is not a place for creative variation. And the prompt demands a citations map: every clinical claim points back to the transcript lines that justify it. That citation map is what powers the next stage, the grounding gate, and it is also what makes a clinician trust the draft enough to review it quickly instead of rewriting from scratch.
The grounding gate: catching hallucinated findings
A confidence gate sits between the model and the clinician. Its job is to route each draft note: clean notes go straight to a fast review queue, suspect notes get flagged for closer attention with the specific lines highlighted. The gate is deterministic code, not another model call — it checks the citations map, verifies every cited line exists, and runs cheap rule-based checks for the failure modes that hurt: unsupported medications, dosages with no transcript anchor, and negation mismatches.
import re
NEGATION = re.compile(r"\b(no|denies|without|negative for|absent)\b", re.I)
def grounding_gate(note: dict, transcript_lines: list[str]) -> dict:
"""Deterministic check. Returns the note with a routing decision.
Never edits the clinical content; only flags it for human review."""
flags = []
for item in note["assessment"] + note["plan"]:
cites = note["citations"].get(item["id"], [])
# Rule 1: every cited line must actually exist in the transcript
if not cites or any(c >= len(transcript_lines) for c in cites):
flags.append((item["id"], "uncited-or-bad-citation"))
continue
evidence = " ".join(transcript_lines[c] for c in cites).lower()
# Rule 2: a stated medication must appear in the cited evidence
for med in item.get("medications", []):
if med.lower() not in evidence:
flags.append((item["id"], f"unsupported-med:{med}"))
# Rule 3: negation in the note must match negation in the source
note_neg = bool(NEGATION.search(item["text"]))
src_neg = bool(NEGATION.search(evidence))
if note_neg != src_neg:
flags.append((item["id"], "negation-mismatch"))
note["route"] = "flagged-review" if flags else "fast-review"
note["flags"] = flags
return note The gate does not make the note correct — only a clinician can do that. What it does is concentrate the clinician's attention on the lines most likely to be wrong, which is the difference between a scribe that saves time and one that quietly creates risk. The same grounding pattern shows up across clinical AI; we use a close cousin of it in AI medical billing and revenue cycle automation, where an unanchored code is a compliance problem rather than a safety one.
HIPAA reality: PHI, BAAs, and what changes for build vs buy
Every recording in an ambient scribe is protected health information from the moment the microphone opens. That triggers the full HIPAA surface: a signed Business Associate Agreement (BAA) with every vendor that touches the audio or transcript, the minimum-necessary principle on what data each component sees, audit logging on every access, defined retention and deletion policies, and patient consent appropriate to your state's recording laws. None of this is optional, and none of it is unique to building — it applies whether you buy or build. What differs is who signs the BAA and how many vendors are in the chain.
| Control | When you BUY | When you BUILD |
|---|---|---|
| BAA coverage | One BAA with the scribe vendor; they sub-sign their model + cloud providers | You sign a BAA with each provider: model API, ASR, cloud, storage |
| PHI in model calls | Vendor asserts no-training + data isolation; you verify in the contract | You configure zero-retention API endpoints and a BAA-covered model deployment |
| Audit logging | Vendor's audit trail; you may not control granularity | You own the audit log; log every access, generation, and edit |
| De-identification for eval | Often not available; you cannot easily build a test corpus | You run Safe Harbor de-identification before any non-production use |
| Retention + deletion | Vendor policy; verify it matches your record-retention rules | You set and enforce retention; you own the deletion guarantee |
The buy side: the ai medical scribe platform landscape
The bought market is crowded and maturing fast. Most products land in one of three groups, and the right ai medical scribe platform depends far more on which group fits your constraints than on any single feature checklist. The grouping below is about shape, not ranking — the named products move between groups as they raise money and ship.
For most organizations under a few hundred clinicians, a standalone or EHR-native product is the correct first move. The note quality of the leaders is good, the BAA path is clean, and a clinician-led pilot can be running this week. The build conversation only earns its keep at scale, in an off-template specialty, or where owning the data and the per-encounter cost changes the math.
The build side: an ai medical scribe implementation from parts
A custom ai medical scribe implementation is more achievable than it was even two years ago, because the hard model problems are now API calls. The work that remains is integration, evaluation, and the review experience — the unglamorous 80%. A realistic build stitches together a capture client, an ASR provider under BAA, an LLM summarizer with the grounding gate, a review UI, an audit log, and FHIR write-back. The code we showed for summarization and grounding is the genuinely AI part; here is the orchestration that ties the stages together.
from dataclasses import dataclass
@dataclass
class Encounter:
audio_uri: str
clinician_id: str
template: str
def run(enc: Encounter) -> dict:
transcript = transcribe(enc.audio_uri) # ASR under BAA, diarized
audit("asr.done", enc.clinician_id)
note = draft_note(transcript, schema_for(enc.template))
note = grounding_gate(note, transcript.lines) # deterministic routing
audit("note.drafted", enc.clinician_id, route=note["route"])
# The note is NEVER auto-posted. It waits for clinician sign-off.
return enqueue_for_review(note, enc.clinician_id)// Backend for the clinician review UI. Sign-off is the only path to the EHR.
export async function signOff(noteId: string, clinicianId: string, edits: Edit[]) {
const note = await store.get(noteId);
if (note.signedBy) throw new Error("already signed");
const finalNote = applyEdits(note, edits);
await audit({ event: "note.signed", noteId, clinicianId });
// edits become the training signal for the next model iteration
await store.recordEditDelta(noteId, edits);
return postToEhr(finalNote); // FHIR DocumentReference write-back
}Notice what the orchestration enforces structurally: the note is never auto-posted, sign-off is the only path to the EHR, and clinician edits are recorded as a delta. That edit delta is the asset a bought platform rarely gives you — it is the labeled training data for the next iteration, and owning it is one of the strongest reasons to build. If you want help scoping a build like this, that is the kind of engagement we run as a healthcare AI healthcare partner.
Cost: per-encounter economics, not list price
The number that decides build vs buy is cost per finished, signed note — not the headline subscription or the API token price. On the build side, the AI cost of one encounter is genuinely small: a 20-minute visit produces a transcript of a few thousand tokens, and summarizing it on a mid-tier model is a single-digit-cent operation. ASR adds a similar order of magnitude. The real cost is everywhere else — integration, the review UI, eval, on-call, and the clinician minutes spent reviewing. Buying inverts the shape: a predictable per-clinician monthly fee, near-zero engineering, and you stop owning the marginal cost curve.
Plug your real annual encounter volume into that shape. At a few thousand encounters a year, the engineering amortization on a build never pays back against a per-clinician subscription, and you should buy. At hundreds of thousands of encounters, the marginal-cost ownership and data ownership start to dominate, and build becomes defensible. The crossover is a volume question you can answer with a spreadsheet once you have the per-encounter numbers from a pilot.
Build vs buy: the honest comparison
Wins on speed and risk transfer. A clinician-led pilot runs this week, one BAA covers the chain, and note quality from the leaders is strong out of the box. You give up: the edit-delta training data, control of the per-encounter cost curve, deep customization for off-template specialties, and full control of your audit granularity. Right for most organizations under a few hundred clinicians.
Wins on ownership and unit economics at scale. You keep the data, the model choice, the marginal cost, and the clinician-edit feedback loop. You take on: a multi-month integration, every BAA in the chain, your own eval harness and de-identified corpus, and on-call for a clinical-safety system. Right at high volume, in off-template specialties, or where data ownership is strategic.
| Your situation | Situation | Lean | Why |
|---|---|---|---|
| Small practice | Under ~50 clinicians, standard specialties | Buy | Subscription beats build amortization; leaders' note quality is already strong. |
| Single-EHR health system | Standardized on one EHR, values integration | Buy (EHR-native) | Native write-back and one BAA outweigh a note-quality edge. |
| High-volume system | Hundreds of thousands of encounters/year | Build or hybrid | Marginal cost and data ownership start to dominate the math. |
| Off-template specialty | Workflows the standard templates miss | Build or hybrid | Customization the buy market does not serve; you own the template logic. |
| Data-strategic org | Clinician-edit data is a strategic asset | Build | Only building keeps the edit-delta training signal in-house. |
The hybrid path most teams actually take
The cleanest answer for a lot of organizations is neither pure buy nor pure build. Rent the commoditized parts and own the differentiated ones. Buy ASR as an API under a BAA — speech-to-text is not where you differentiate, and the medical-tuned providers are already strong. Build the summarization prompt library, the grounding gate, the review UI, and the audit and feedback loop, because those are where your specialty knowledge and your data advantage live. This hybrid keeps your integration timeline short while still giving you the edit-delta data and the per-encounter cost control that make building worthwhile.
Rent the speech model. Own the note logic, the grounding gate, and the data your clinicians' edits create.
A two-week pilot to make the decision with data
You do not decide build vs buy in a meeting. You decide it with a small, time-boxed pilot that produces real numbers on your own encounters. This is the engagement shape we run with health systems: a short discovery, a tight bake-off, then a continuous-delivery relationship if the build path wins. The five steps below fit in two weeks and resolve most arguments faster than any vendor demo.
Production pitfalls we keep seeing
AI medical scribe build vs buy: FAQ
Is an ai medical scribe safe to use on real patients?
Only as a drafting tool with a licensed clinician reviewing and signing every note. The system transcribes and summarizes; it does not document autonomously and it does not practice medicine. The grounding gate and the clinician review are the safety controls. This is engineering guidance, not medical or legal advice — validate any deployment with your clinical and compliance leadership.
How accurate are ai medical scribes?
Accuracy is the product of two error rates stacked: transcription and summarization. A strong overall transcription score can still hide the errors that matter — drug names, dosages, negations, laterality. Measure on your own specialty's vocabulary with a hand-labeled set, not the vendor's clean-speech demo number. The honest answer is that the system is good enough to draft and never good enough to skip clinician review.
Should we build or buy an ai medical scribe?
Buy if you are under a few hundred clinicians in standard specialties — the subscription beats the build amortization and a pilot runs this week. Build (or go hybrid) at high encounter volume, in off-template specialties, or where owning the clinician-edit data is strategic. Run a two-week pilot on your own encounters before committing either way.
Does an ai medical scribe need a BAA to be HIPAA compliant?
Yes. Every vendor that touches the audio, transcript, or note is a business associate and needs a signed Business Associate Agreement. When you buy, one BAA with the platform usually covers their sub-processors. When you build, you sign a BAA with each provider in the chain — the model API, the ASR provider, and the cloud and storage layers — and you configure zero-retention endpoints and full audit logging yourself.
What does a custom ai medical scribe implementation involve?
A capture client and consent gate, an ASR provider under BAA, an LLM summarizer with a grounding gate, a clinician review UI, an audit log, and FHIR or HL7 write-back to the EHR. The model calls are the small part now; roughly 80% of the effort is integration, the review experience, the eval harness, and the HIPAA and ops surface. The clinician-edit feedback loop is the asset you build it to own.