Nabla

Every module is a model at work. Ambient speech recognition turns the visit into a structured clinical note, dictation turns speech into text anywhere a clinician types in the EHR, and the coding module reads the finished note to suggest an E/M level and ICD-10 diagnoses. Nabla describes the set as a clinical AI layer that sits inside the EHR, and there is no version of any of it without the models.

A clinician stands between each draft and the chart. The ambient note is reviewed and edited before it is exported, and Nabla keeps it for 14 days by default, a window the company says exists to give physicians enough time to review, edit and export their note. After each encounter the clinician can send structured feedback on the note.

Coding follows the same pattern. The E/M tab shows a suggested level with the medical decision making breakdown behind it, the clinician copies the code into the EHR, and nothing is filed with a payer automatically. When more than one code could be defended, a confidence flag tells the clinician to review the breakdown before choosing. The suggestion does not refresh on its own after the note is edited; the clinician regenerates it. On Epic, suggested problems, visit diagnoses and vitals wait for the clinician to accept them before they reach the chart.

The note itself has no equivalent signal. Nothing marks the passages the system was unsure of, and nothing published says what happens when audio is poor or speakers talk over each other.

One supplier in the model path is named: the subprocessor list in Nabla's trust center gives Microsoft Azure, in US regions, for speech to text, with Google Cloud hosting the service. For closer review the trust center lists a model card in the Coalition for Health AI format, version 2, available on request, and an AI governance whitepaper, and the company publishes research and whitepapers under its own AI section. Coding carries one figure, more than 97 percent agreement with expert coders on E/M level.

The model that turns a transcript into a note is not named, so a customer cannot tell from public material when the system drafting its notes has changed.

Three subprocessors are listed in the trust center. Google Cloud hosts the service, in a central US region and in Belgium for customers outside the US. Microsoft Azure runs speech to text in US regions. Front handles support tickets, which the list marks as carrying no protected health information.

The data terms around them are specific. Audio is not stored by default, notes are deleted after 14 days unless the customer shortens the window, and the company states it holds agreements to opt out of data retention with every service used to process the data. The business associate agreement binds every agent or subcontractor that touches protected health information to the same restrictions.

The list stops at those three parties: whichever model writes the note from the transcript, built in house or licensed, is not named.

The main evidence is an independent randomized trial. In Lukac and colleagues, NEJM AI, published 26 November 2025 (NCT06792890), 238 outpatient physicians across 14 specialties at UCLA Health were randomized in equal thirds to Nabla, Microsoft DAX Copilot or usual care for two months. Nabla cut time in notes by 9.5 percent against control and was the only arm to meet the primary endpoint; the DAX arm reached 1.7 percent and was not statistically significant. Both scribes improved secondary burnout measures by about 7 percent. UCLA and the NIH funded the trial rather than either vendor, and the protocol is registered and published.

The study records its own limits. Use was low, with Nabla used in 29.5 percent of 23,653 visits, and physicians were told to use it only at English language visits because translation had not been tested internally.

Nabla's homepage adds its own figures, 55 percent of users saving an hour or more a day and a 27 percent reduction in burnout, without saying where they come from.

Retention is short and configurable. Audio is not stored by default, notes are kept for 14 days from the moment an encounter is created, and a customer can shorten that window, down to a few hours according to Nabla's French compliance page. On expiry the data leaves the application and remains only in backups, which expire seven days later. Stored transcripts and notes carry two layers of encryption, at system and application level, with AES-256 at rest and TLS 1.2 or later in transit.

On training, the French compliance page states that customer data is not used to train the models. Clinicians can choose to share feedback after an encounter, and that feedback may include de identified data. The terms of service separately let Nabla use patient information freely once it has been fully anonymized and de identified.

Nothing published describes safety engineering on the model itself: no guardrails, no hallucination controls, and no account of how a safety event is found, escalated and closed.

The business associate agreement is published in full as Appendix I to Nabla's terms of service, and it is a condition of access rather than a feature of a plan. Section 8.1 of the terms says a customer subject to HIPAA must agree to it when creating an account and cannot use the service otherwise. No plan or tier is excluded anywhere in the document.

Appendix I names Nabla Technologies Inc. as the business associate, and section 7 requires any agent or subcontractor with access to protected health information to accept the same restrictions in writing. Breaches must be reported within seven calendar days of discovery and security incidents within five business days. Section 8 commits Nabla to provide its latest independent SOC 2 report on request, section 14 says handling the data gives Nabla no ownership of it, and requests for access, amendment or an accounting of disclosures are answered within ten business days.

The agreement creates no rights for third parties, so a patient has no route under it. It also lets Nabla de identify any protected health information it handles, after which that information falls outside the agreement.

Nabla's trust center, run on Secureframe, lists its audits with dates. The SOC 2 Type II report covers November 2024 to October 2025, the ISO/IEC 27001 certification is dated September 2025, TX-RAMP Level 2 certification January 2026, and a penetration test executive summary April 2026. Reports are released on request. The center also lists HIPAA, GDPR, CCPA, PIPEDA, CIS Level 2 and the EU AI Act among the frameworks Nabla follows.

The program behind the list is described in operational terms. A third party runs a network and application penetration test of production at least once a year. There are 25 information security policies, each reviewed at least annually. Every vendor is logged and ranked by criticality, and those rated critical or high are audited every year. A dedicated security and privacy team runs internal audits and works with the external auditors, and the business associate agreement obliges Nabla to hand over its latest SOC 2 report on request.

Nabla claims no FDA clearance and positions the product as documentation support. Section 3.1 of its terms, headed Intended Use, says the services are designed for healthcare providers and telehealth companies as a tool to serve their patients and do not constitute medical advice from Nabla, and section 3.10 repeats that Nabla provides a technology solution, not medical advice. Section 3.7 says Nabla makes no representation that using the service meets the customer's own legal or regulatory obligations.

The product now does more than draft notes. It suggests E/M levels and ICD-10 diagnoses, and on Epic it proposes problems, visit diagnoses and vitals for the chart. Each is a suggestion the clinician accepts, and coding is limited to outpatient primary care specialties. The terms do not address device status for these suggestions.

In Europe, Nabla says it is not considered high risk under the EU AI Act and follows the act's transparency requirements regardless.

A dedicated AI governance team and a documented policy sit behind the product, according to Nabla's trust center, which lists two artifacts written for a customer's own review: a model card in the Coalition for Health AI format, version 2, available on request, and an AI governance whitepaper. The company says it tracks AI regulation at state and federal level in the US, and that although it does not consider itself high risk under the EU AI Act it follows the act's transparency requirements.

Nabla supports more than 35 languages, from Spanish and French to several Arabic dialects, Haitian Creole and Khmer, and the independent UCLA trial restricted use to English language visits because translation had not been tested. Results by language, accent or speaker are not published.

The mechanisms on offer catch an error before it lands. The clinician edits every note before export, the 14 day retention window is sized for that review, coding suggestions show the medical decision making behind them with a confidence flag where the level is ambiguous, and nothing is filed with a payer automatically. Feedback after each encounter gives the clinician a route to report a bad note.

There is no accuracy guarantee, no remediation commitment and no indemnity toward the customer for note content, and the one accuracy figure published, more than 97 percent agreement with expert coders on E/M level, comes without its method. The business associate agreement gives patients no rights, so the person recorded has no route against Nabla.

Notes and data move both ways on the main integrations. Nabla pulls patient history and visit context from the EHR, exports structured notes into EHR templates, and places vital signs, diagnoses and patient instructions into charts, flowsheets and clinical fields. The systems named are Epic, athenahealth, Oracle Health, NextGen, Greenway and Arya.

On Epic, where Nabla is in the Toolbox program and says more than 30 health systems use it, the app mirrors the clinician's schedule in real time, inserts notes and follow up instructions directly, and proposes problems, visit diagnoses and vitals for export. Nabla Dictation works inside Hyperdrive and Hyperspace for messages, referrals and letters. Nabla puts a full Epic integration at around two to three weeks and expects orders and nursing documentation to follow through Epic's ambient APIs. Deployments are named on other systems too: Aultman Health System on Oracle Health, McFarland Clinic on Epic and Knownwell on athenahealth.

For EHR companies, Nabla Connect embeds the assistant in an iFrame inside the vendor's own interface, with three days to go live by Nabla's account. Sign on runs over SAML, with SCIM provisioning.

The service runs on Google Cloud, and a customer chooses the region when its organization is created. The trust center places hosting in a central US region for US customers and in Belgium for everyone else, with speech to text on Microsoft Azure in US regions. Nabla's French compliance page says European users' data is hosted in Europe on infrastructure certified for French health data hosting (HDS) and processed only inside the European Union. Encrypted backups are kept in several Google Cloud regions.

Clinicians use Nabla on the web, in iOS and Android apps or a Chrome extension, inside Epic, or inside another EHR that embeds it through Nabla Connect, and developers can reach it through an API. Retention is set per organization.

Isolation is described only as separation of environments, with nothing on whether customers share infrastructure. The trust center lists speech to text only in US regions and does not say which service handles speech for European customers whose data stays in the EU.

Buying runs two ways. An individual clinician can sign up online, use the product free for 30 days, and then pay $119 a month, the rate Nabla's help center states. Organizations buying for many clinicians go through Nabla's team, and group rates are quoted on request, with no group price, volume tier or enterprise unit listed. The terms of service reserve the right to start charging for services that were previously free.

The scribe is built for clinicians documenting live encounters in person, by telehealth or by phone, on mobile, desktop and browser, and visits can run up to three hours. Customers range from individual practices to large health systems, and emergency and inpatient clinicians can document on mobile inside Epic. Nabla supports more than 35 languages, from English, Spanish and French to several Arabic dialects, Hindi, Mandarin and Haitian Creole.

The independent UCLA trial covered 14 outpatient specialties, in English only. Coding is narrower than the scribe: E/M suggestions are available for outpatient visits in family medicine, general medicine, internal medicine and pediatrics, and not for inpatient visits or time based billing.