AutoScribe by Mutuo Health

The company exists to commercialise a research model. AutoScribe originated as a University of Toronto and Saint Michael's Hospital research project applying natural language processing to clinician patient dialogue, and the founding team combines machine learning researchers with a practising family physician. There is no non AI business underneath.

The most conservatively framed oversight position located in this category, though it is a posture rather than a mechanism. The vendor states plainly that an AI scribe produces a draft the physician reviews and signs, that the value is removing the blank page rather than removing the clinician, and that the clinician remains firmly in control of the final record.

More unusually, its published clinician guidance is anchored to College of Physicians and Surgeons of Ontario and Canadian Medical Protective Association positions on AI use and medico legal risk, and it cites independent peer reviewed work evaluating the quality and safety of ambient digital scribe platforms generally. Citing external safety literature about your own product category is not something vendors normally do.

Held at B rather than A because no acceptance rate, edit burden figure or confidence threshold is published, and no structural verification mechanism of the kind that earned Abridge, Speke, Corti and TORTUS an A is described.

Rare among vendors here in having a peer reviewed description of its own technology, and rarer still in what that paper contains. The published case study sets out the benefits and the drawbacks of the approach, which is a vendor volunteering its own limitations in an indexed venue rather than on a marketing page. A separate pilot validation study on the note generating model in primary care is documented through an academic research group.

Held at B because no current accuracy figure, model card or evaluation methodology for the shipping product was located, and the published work predates the generative era, so it describes a lineage rather than today's system.

Nothing is named publicly and there is good reason to believe the material exists, which is what places this above the records that have neither. The vendor states that third party security and privacy assessments have been performed and will be provided to organisations on request. An external privacy assessment covers data flows and the parties that handle content, so the enumeration this axis asks for has been produced and examined, and is simply not published.

That makes this a disclosure choice rather than an absence of governance, and it means the answer is obtainable by asking rather than by inference. A named privacy officer contact rather than a generic form makes the asking practical. What is public is bare: no model or model family, no foundation model provider, no hosting arrangement, no sub processor list, and the privacy language on the site refers to standard measures required by regulation rather than to anything specific. Ask for the assessments, then ask for the sub processor list and residency position they should already describe.

Genuine academic provenance rather than testimonial. The technology was developed through a University of Toronto and Saint Michael's Hospital collaboration, described in a peer reviewed publication, and subjected to a pilot validation study of the note generating model in primary care through an academic research group.

Externally, AutoScribe was pre qualified as a vendor under Canada Health Infoway's National AI Scribe Program, a national body assessment, and in New Brunswick it is identified as the approved scribe underpinning the Nexus AI deployment. Held at B because no outcome study, controlled comparison or published accuracy result for the current product was located; what is evidenced is rigorous origin and external vetting rather than measured clinical benefit.

Operates under PHIPA and Canadian privacy regulation, with a named privacy officer contact rather than a generic form. Notably, the vendor states that third party security and privacy assessments exist and will be provided to organisations on request, which means external assessment has been performed even though the reports are not published.

Held at B because the public privacy language is generic, referring to standard measures required by regulation, and no retention schedule, de identification practice or training use statement was located. Ask for the assessments; they exist.

The earlier assessment treated this axis as not applicable, on the basis that deployment is Canadian under provincial privacy regimes. That reading is superseded, because the vendor claims it. Its security page lists compliance with the United States health privacy rule alongside the Canadian federal and Ontario provincial regimes, and the privacy policy repeats the claim.

Once the claim is made the axis applies, and what a counterparty can verify is thin. No business associate agreement template, no scope statement describing which processing activities the claim reaches, and no United States customer or deployment were located. The verifiable commercial motion is entirely Canadian: a national health infrastructure agency grant programme, an Ontario vendor of record process, and integrations with Canadian record systems.

The structural point a United States buyer most needs is the one the vendor treats as its principal strength. This product's central commitment is that data stays inside Canada. For a Canadian purchaser that is the whole proposition. For a covered entity in the United States it means protected health information is processed offshore. That is permitted, since the health privacy rule imposes no data localisation requirement, but it should be understood rather than discovered: the business associate agreement has to reach a foreign processor, enforcement and breach notification run across a border, and state law may add requirements the federal rule does not.

Two smaller cautions. There is no certification for the health privacy rule, so the claim is a self description rather than an independent examination. And the compliance list mixes categories, naming three statutes and one attestation as though they were the same kind of object, with the Ontario statute misspelled on the vendor's own privacy page. A list assembled loosely carries less than a short one assembled precisely.

Better than nothing and short of published. No named certification such as SOC 2 Type II or ISO 27001 was located and no trust centre exists, but the vendor confirms it holds third party security and privacy assessments and names a privacy officer address to request them. That is positive evidence that external review has happened, which distinguishes this from the vendors here graded Not Rated where no assessment is evidenced at all. Publishing the certification names and dates would move it immediately.

No clearance claimed and no device pathway attaches. This axis does not read as an absence, because a governing framework exists and is named. It is professional regulation rather than device regulation.

The product is deployed in Canada, where the obligations that bite on an ambient scribe come from the medical regulatory colleges rather than from a device authority. Those obligations concern the accuracy and integrity of the medical record, patient consent to being recorded, the physician's responsibility for what they sign, and the conditions under which third party tools handling patient information may be used.

What earns the grade is that the vendor engages with that framework directly rather than ignoring it. It publishes guidance referencing the expectations of the College of Physicians and Surgeons of Ontario. Very little in this category does anything comparable. The common pattern is either silence about the regime that actually applies, or a compliance list naming laws without saying what they require of the user. A vendor telling its clinicians what their own regulator expects of them when using the tool is doing something genuinely useful, and it is the right response to a regime where the duty sits on the clinician rather than on the software.

Two things to establish. Provincial colleges set their own expectations, so guidance written against one province's regulator does not automatically describe another's, and a buyer outside Ontario should confirm the position for their own college. And if the product is sold into the United States, ambient documentation there attracts no device pathway either, but the consent and record integrity analysis runs through entirely different law.

Engages seriously with the professional and medico legal governance of its own category, which is a different and in some ways more useful contribution than a fairness statement. Its published material explains to clinicians what regulators expect of them when using an AI scribe, distinguishes the tool from dictation in the terms the regulator uses, and cites Canadian Medical Protective Association guidance on medico legal exposure and independent literature on ambient scribe quality and safety.

On language it is specific rather than expansive, supporting 21 of the most commonly spoken languages in Canada and disclosing that the note can be produced in a different language from the conversation, which is an honest description of a translation step that most vendors leave implicit. Held at B because no fairness statement, subgroup analysis or performance breakdown by accent or language was located.

Two routes into this band converge on one record. The first is jurisdictional: the vendor operates under Canadian provincial health information legislation, which gives an individual an enforceable right to have inaccurate information corrected with a regulator behind it, so the recorded patient has a mechanism the vendor did not have to grant. The second is what the company has actually published, and it is rare enough to state carefully.

There is a peer reviewed description of its own technology in an indexed venue, and the published work sets out the drawbacks of the approach alongside the benefits. A vendor volunteering its own limitations in a venue it does not control is doing something structurally different from publishing a marketing page, because the account is fixed, citable and available to a reader who is not being sold to.

A separate pilot validation of the note generating model in primary care is documented through an academic research group, so at least part of the performance record has been examined by people outside the company. Held below the top grade for a specific reason a buyer should weigh.

The published work predates the generative era, so it describes a lineage rather than the system shipping today, and no current accuracy figure, error rate or evaluation methodology for the present product was located. No warranty, indemnity or remediation commitment was found. Ask whether an equivalent evaluation exists for the current generative version.

Canadian EMR focused, with reach extended two ways. It is white labelled as the underlying technology for Nexus AI in New Brunswick, giving it distribution under another brand, and Mutuo now sits inside the WELLSTAR group, a majority owned subsidiary of WELL Health, whose ecosystem is described as serving more than 40 percent of Canadian practitioners. That ownership position is a plausible route to deeper native integration than a standalone vendor could negotiate. Held at B because named EMR integrations and their depth were not enumerated or verified in this pass.

A second search overturns the earlier finding substantially. This is now one of the better answered deployment records in the lane.

The residency commitment is explicit, published and repeated: all data stays within Canada. That is a stated architectural position rather than a general assurance, and it is corroborated externally. A third party comparison of Ontario scribe vendors identifies this vendor as one of only two among six evaluated that publish unambiguous Canadian region residency by default. In a market where provincial privacy regimes make residency expectations explicit, publishing it plainly is the difference between a procurement conversation and a negotiation.

Alongside it: SOC 2 Type II, encryption named to the standard rather than gestured at, with transport layer security in transit and AES 256 at rest, and a Quebec health certification covering that province specifically.

Two things hold this short of the top grade, and the first is a question rather than a gap. The vendor states that sensitive medical data is de identified before processing. A note synced back to a named patient's record must be re identified at some point, so that claim describes what the model is shown rather than what the pipeline holds end to end. Both can be true, and a buyer should ask precisely which fields are removed, at what stage, and where the linkage is held. It is the same shape as the encryption versus processing tension this index has raised elsewhere.

The second is conventional. No subprocessor list was located and no model provider is named, so a buyer knows the data stays in Canada without knowing whose systems inside Canada process it.

Corporate note: the company now sits inside a larger Canadian health technology group which separately markets its own ambient scribe, so establish which product a group level agreement actually covers.

No rate card, but a real trial and a public funding route. A one month free trial is offered, and eligible Canadian primary care clinicians may access AutoScribe through Canada Health Infoway's National AI Scribe Program, where funding is offered on a first come first served basis, which makes the effective cost to a clinician a function of a public programme rather than a private negotiation. Held at C because no list price was located for buyers outside that programme.

Primary care centred, consistent with its research origin and with the Canada Health Infoway programme it was pre qualified for, which targets primary care providers. Supports 21 of the most commonly spoken languages in Canada with cross language note generation. An AutoForm capability to prepare standard forms such as insurance documentation from encounter content is described as forthcoming rather than shipped. No specialty count published and no acute or inpatient coverage evidenced.