Doximity Scribe

The artifact is wholly model generated, but the competitive asset is not the model. Doximity's moat is a professional network reaching more than 80 percent of United States physicians, built over fifteen years, and Scribe is given away free inside it. Nothing is being sold on model quality: adoption is likely to follow distribution and price rather than performance. Scribe is still a product a clinician actively chooses to open rather than a module inside a system they were already required to use.

No review gate, sign off step, confidence threshold, acceptance rate or edit burden figure is described.

No record system write back is documented, so the clinician necessarily handles the note before it reaches the chart. That functions as a human gate, as it does for any transfer based product. It is a consequence of the integration gap rather than a designed oversight mechanism, and it will weaken rather than strengthen if write back is added later.

One statement of position matters. The vendor says notes are private to the individual clinician and frames this as keeping them in control of their own documentation, citing the sanctity of the clinician patient relationship. That is a meaningful architectural choice rather than a slogan: notes belonging to the clinician rather than to an organization means no administrator, employer or the vendor itself is positioned between the draft and the chart.

It cuts two ways. It preserves clinician autonomy and it also means there is no institutional review layer, no quality assurance pass and no organizational visibility of edit burden or error patterns. Where a health system deploys a scribe it usually wants those. Here the product is adopted by individual clinicians rather than procured by institutions, so the oversight that exists is whatever each clinician performs.

The workflow is described in stages, live transcription then transcript processing then note generation, but nothing is measured. No accuracy figure, model card, named models or evaluation methodology is published, a notable omission for a product distributed this widely. The beta produced millions of notes across more than 10,000 clinicians, so the data to publish an accuracy or edit burden figure plainly exists.

One half of the supply chain question is answered plainly and the other is untouched. On whether content reaches third parties, the audio commitment is clear and stated without hedging: no audio is stored or retained, recordings are processed securely in real time and immediately discarded once the note is generated.

A commitment that raw capture never persists limits what any party in the chain could hold, and it is verifiable in the sense that it is a definite claim rather than a use limitation open to interpretation. The gap in that commitment is specific, because it is drawn around one content type: it covers audio, and no equivalent statement is published on whether generated notes or transcripts are used to train or improve models.

Transcripts and notes are the derived content, they persist by definition since the clinician keeps the note, and they carry the clinical substance. On enumeration there is nothing. No foundation model provider, model class or version is named, no hosting arrangement is published, and there is no subprocessor list. The workflow is described in stages, live transcription then transcript processing then note generation, which tells a buyer the shape of the pipeline without naming anything that runs it.

Adoption at scale is documented, with more than 10,000 clinicians generating millions of notes during a beta that ran over a year, but that measures usage rather than benefit. No study, controlled evaluation, accuracy benchmark, third party rating or outcome data is published. Scale of use does not substitute for evidence of benefit.

The data commitment is stated plainly and without hedging: no audio is stored or retained, recordings are processed securely in real time and immediately discarded once the note is generated, and notes are private to the individual user rather than visible to an employer or organization.

The first of those is an architectural commitment rather than a policy one. A vendor that does not retain audio has removed the question of what happens to it, which is a stronger protection than a retention schedule because it does not depend on the schedule being followed.

Privacy to the clinician matters here in a way it does not for enterprise products, and it cuts both ways. A free tool adopted individually sits outside institutional oversight, so notes being private to the user protects the clinician from employer surveillance of their documentation drafts. The same property means an organization cannot audit what the tool produced in its own charts.

There is one gap. The commitment covers audio. No equivalent statement is published on whether generated notes or transcripts are used to train models, and those are the artifacts that persist. A vendor that discards audio immediately may still hold the transcript and the note, and the published commitment does not reach them.

A second class of question is not answered either. Nothing published describes safety engineering: no guardrails, no hallucination mitigation, and nothing on how a safety event is identified, escalated and closed.

The coverage model is strong, and the instrument behind it is not published.

Doximity states that all users are covered by a business associate agreement. Not available on request, not offered to organizations, not gated behind a paid tier: coverage is automatic and universal. Where a clinician can begin generating notes from real consultations on a free tier before any agreement is in place, the gap between first use and executed agreement is where the exposure sits. Here there is no separate step, and for a product adopted by individual clinicians with no procurement involvement that is the safeguard that matters most.

What is not established is the instrument. The agreement text is not published for inspection, so coverage is stated but the terms cannot be read before relying on them. And nothing published states whether the agreement extends its obligations to subcontractors, which matters for any product processing consultation audio through infrastructure the vendor does not own. The question is unanswered in either direction rather than answered badly. Nothing names which legal entity is the business associate.

A listed company would be expected to run a certification program, and this one does. The vendor states that its platforms and data are SOC 2 Type 2 certified, with data encrypted in transit and at rest, and maintains a security page.

SOC 2 Type 2 is the stronger of the two report types, testing whether controls operated effectively across a period rather than whether they were suitably designed at a point in time. Naming Type 2 specifically tells a reader which report to expect.

One formulation in the same sentence is inaccurate, and it matters because this vendor's material reaches a very large clinical audience. The claim is phrased as being SOC 2 Type 2 and health privacy and health technology statute certified. There is no certification for either statute. They are laws, compliance with them is a self assessment or a contractual position, and no body awards a certificate. The attestation is real; the phrasing attaches the word certified to two things that cannot carry it. A reader could reasonably come away believing three certifications exist where one does.

Two weaknesses remain. The claim sits in a support article rather than a trust center carrying a dated report, an audit period and a scope statement. And scope is a live question here because the company operates a broad platform of which the scribe is one product, so which systems the report covers is not something a buyer can infer.

Ambient documentation needs no clearance, and none is claimed. No United States device pathway attaches to a note the clinician reviews and moves into the chart themselves.

The scribe itself is narrow, and that counts in its favor. Its published description includes no coding engine, no risk adjustment scoring, no order generation, no patient facing component and no revenue cycle module. It transcribes, summarizes and produces a note in the clinician's chosen template. The product has stayed within documentation rather than expanding into adjacent workflows.

One scoping point belongs alongside it. The same company publishes separate tools on the same platform, including one that answers clinical questions and surfaces drug monograph information. That is clinical reference rather than documentation, and it sits in the territory occupied by dedicated reference products. It is a separate product from the scribe, though a clinician using both experiences them as one environment.

The distribution model has one more consequence, and it is not a criticism. Because the tool is adopted directly by individual clinicians rather than procured by institutions, the usual organizational assessment that would sit between a clinical AI product and its use does not occur. No device pathway attaches, so nothing is being circumvented. But the ordinary checkpoint at which a health system would ask about accuracy, oversight and data handling is simply absent from the adoption path, and the responsibility sits wholly with the individual clinician who signs the note.

Markets are United States only, with eligibility limited to verified clinicians.

The absence here carries weight for two reasons.

No fairness statement, no subgroup analysis, no accuracy breakdown by accent, dialect or speaker population, and no evaluation methodology is published.

Reach is the first reason. This is a documentation tool distributed free to verified United States clinicians on a platform the company states reaches the large majority of American physicians, following a beta in which thousands of members generated millions of notes. Any performance variation across accent or dialect therefore propagates at national scale rather than within one practice, and it does so without a procurement process anywhere in the path that might have asked the question.

The second reason is where the vendor has chosen to concentrate adoption, and it points directly at the populations the evidence would concern. The company is offering the tool together with free onboarding assistance to free and charitable clinics across the country. Those clinics serve the uninsured and underinsured, and their patient populations include a disproportionate share of people whose first language is not English and whose speech is least likely to be well represented in the data these systems are trained on.

So the deployment most likely to encounter degraded performance is the one being actively promoted, at no cost, to organizations with no capacity to evaluate it. That is a good thing to do with a useful product and it raises the evidentiary obligation rather than lowering it.

No terms governing the documentation capability, no accuracy or error figure, no published limitations, and no warranty, indemnity or remediation commitment is published.

The absence of a measurement is conspicuous rather than ordinary here, because the data plainly exists. The product reached millions of generated notes across more than ten thousand clinicians in beta, so edit burden and correction rates are things this vendor can compute. It has chosen not to publish them, and at that volume the choice is a decision rather than an oversight.

The distribution model creates a recourse problem that enterprise products do not have, and it inverts who is exposed. The tool is adopted by individual clinicians at no cost, and notes are private to the user rather than visible to an employer or organization. That is a real privacy benefit for the clinician. It also means a health system may not know the tool is in use, will have no contract governing it, may have no business associate agreement of its own covering the encounters it processes, and has no way to audit the documentation it produces.

The institution still carries the medicolegal and record integrity consequences of notes that end up in its own charts. So the party carrying the exposure has no relationship with the vendor, no route to raise a defect, and frequently no knowledge that the system exists. Here the harmed party is the institution rather than the patient.

The vendor's own coverage statement does not close it. All users being covered by a business associate agreement governs how information is handled between the clinician and the vendor. It says nothing about what happens when a note is wrong, and it does not give the institution whose chart holds that note any standing.

Nothing published tells an organization whether its clinicians use the tool, on what agreement, what governs the encounters it captures, or how a defective note would be identified and corrected.

The clearest limitation of the product. No integration with any electronic health record is published: the documented ecosystem connections are to Doximity's own products, Dialer for calls and telehealth and Ask for evidence queries, not to record systems. That means the note is generated outside the chart and the clinician moves it, so a free scribe still carries a manual transfer cost per encounter. For an individual clinician that may be an acceptable trade against a competitor charging hundreds a month; for a practice wanting structured data in the record it is disqualifying.

The vendor names the third party that processes the encounter. Its support material states plainly that a named commercial model provider supplies the transcription and summarization technologies powering the scribe, and that a business associate agreement is in place with that provider.

Alongside it the vendor states that no audio is stored or retained, that recordings are processed in real time and discarded once the note is generated, and that data is encrypted in transit and at rest. The no retention position materially reduces what residency would protect, because the audio does not come to rest anywhere.

Three gaps remain. No hosting region is stated and no residency option is offered. No full subprocessor list is published, so the named model provider is the one link disclosed rather than the chain. And a business associate agreement constrains a processor's permitted uses without publishing its retention terms, so what that provider holds during and after processing, and for how long, is still unanswered.

There is nothing to disclose because there is nothing to pay, and the eligibility is stated precisely rather than buried: free to all verified United States physicians, nurse practitioners, physician assistants and medical students, with no tiers, no published usage caps, no upsell path and no procurement conversation. Against competing scribes quoting hundreds of dollars per provider per month, that is a structural price position rather than a discount.

Doximity also provides Scribe, free onboarding assistance and Dialer Pro telemedicine at no cost to free and charitable clinics across the United States, which extends access to settings that generally cannot fund documentation technology at all.

Broad by eligibility rather than by tuning. Available to physicians, nurse practitioners, physician assistants and medical students across all specialties and practice areas, usable at in person visits and through Doximity Dialer for telehealth calls and video. Custom templates and freeform notes are supported. No specialty specific models, specialty count or language coverage is published, and availability is United States only.