Scribble by IKS Health

IKS Health is a care enablement services business and Scribble spans both sides of the line: Scribble Now is AI first, while Transcribe and Live are majority human labor with technology supporting them. Strip the generative layer out and a substantial virtual scribing and transcription business remains, so the moat is not the model, which puts it alongside human scribe services such as Speke, ScribeRyte and iScribeHealth. The human workforce is also an asset to the AI rather than only a legacy: the vendor states that having scribes on staff enables expert review of the AI output, improving it.

The oversight design is the strongest thing here, and it rests on a structural property rather than on a policy.

Rather than fixing the level of human oversight at contract, Scribble builds an escalation path into the workflow, so a clinician selects the level of support per encounter based on complexity, routing a simple visit to full automation and a complex or high risk one up the chain without leaving the product. That matches oversight intensity to clinical risk, and it puts the judgment with the person who has just seen the patient.

The upper tiers are substantive rather than cosmetic. One puts a trained scribe on hallucination detection. The next escalates to review by clinicians employed by the vendor, with medications, problem lists, orders and other clinical data reconciled explicitly against the record.

Two things are open. No error rate or acceptance figure is published for the automated tier, which is precisely the number a clinician would need to decide when to escalate. The escalation path is only as good as the information behind the choice, and at present that choice rests on the clinician's own read of complexity with nothing published about how often the automated tier gets it wrong.

The second is what escalation costs. Nothing published says whether moving an encounter up a tier changes the price, or whether a practice can be constrained by contract to a maximum escalation rate, and that decides whether the design works in practice or only on paper.

Technology is described only as automated speech recognition plus generative AI, with no accuracy figure, model card, named models or evaluation methodology published. What the vendor does specify precisely is turnaround, with distinct service levels of roughly two minutes, one to two hours and four hours by tier, which is unusual operational disclosure and lets a buyer plan around it. But turnaround measures speed, not correctness, and the accuracy claim rests on the human layers rather than on any published model performance.

The chain here includes people as well as software, and the human half is described.

Trained staff read draft documentation containing patient information as a standard part of the tiered service, and at the upper tiers clinicians employed by the vendor reconcile medications, problem lists and orders. Who sits between a patient record and a finished note is therefore partly a workforce question, and the vendor's own certification material answers where that workforce and its infrastructure sit: the platform and data centers are stated to be in the United States and India, audited by an authorized external assessor, and the published examination history covers divisions in the United States, India, Canada, Australia and the United Kingdom.

That is a real disclosure. Offshore review is disclosed rather than discovered, and it is the single most consequential fact about this chain for a customer with data residency obligations.

One engineered control bounds part of the access surface concretely: in the virtual scribing tier, scribes never access video during telehealth encounters. A restriction implemented in the system rather than promised in a policy is worth more, and no comparable control is described for the other content types the reviewers can reach.

The automated tier is where the disclosure stops entirely. No model or model family, no foundation model provider, no version or update policy and no subprocessor list is published for the path that produces a note in two minutes with no person reading it. That tier is sold as the default for simple encounters, so it is the one most content will pass through.

Real third party recognition, with one precision that matters. IKS Health was named a 2026 Best in KLAS virtual scribe provider, which is buyer survey based rather than vendor asserted, but the award covers virtual scribing rather than ambient AI, so it validates the services business and the organization rather than the generative product specifically. Three 2026 Black Book awards and a named customer executive at a regional physician group add to the picture. For the AI tiers there is no study, controlled evaluation or published accuracy benchmark.

The human review layers create an exposure: trained staff read draft documentation containing PHI, and nothing is published about where that workforce sits or how it is vetted. One specific engineered control works against that: in the virtual scribing tier, scribes never access video during telehealth encounters, which is a designed restriction on what a human reviewer can see rather than a policy promise. The company publishes no retention schedule, deidentification practice or statement on whether customer content trains models.

No business associate agreement posture, template or scope statement is published, and the vendor's own contract page shows the gap directly. The vendor publishes a contract templates page carrying three downloadable documents: general terms and conditions, a travel and living policy, and a quality overview. The business associate agreement is not among them.

Two things about those documents matter beyond the gap. All three are branded to the clinical documentation company this organization acquired rather than to the organization itself, and all three carry 2024 dates. The published contract documents are the acquired company's paper.

The gap weighs especially heavily here. The suite runs five tiers with materially different human involvement. At one end the software processes the encounter with no person at the vendor reading it. At the other, vendor staff work inside the customer's record system with access to pre-charting and the clinician's inbox. Between them sit tiers where trained scribes validate drafts and where clinicians employed by the vendor reconcile medications, problem lists and orders. The business associate relationship therefore has a different shape at every tier, and an agreement scoped to one does not describe another.

Nothing published says which tier the agreement was written for, whether it names the review workforce as well as the platform, whether workforce members are employees or subcontracted, or whether subcontracting brings further parties into scope. Where staff hold live record access, nothing says what their permissions reach beyond the encounter, and inbox access exposes correspondence about patients who were never recorded at all.

The delivery footprint sharpens it further. The organization's own certification material places its platform and data centers in the United States and India, and its published examination history covers divisions in the United States, India, Canada, Australia and the United Kingdom. Which of those the review workforce for each tier sits in is not stated.

The encounter to reimbursement integration the vendor markets extends the question again, because coding and revenue cycle functions handled by the same organization involve the same protected information moving to a different team for a different purpose.

The vendor publishes a dedicated security page listing HITRUST r2 recertification, HITRUST certification covering the platform and data centers in the United States and India audited by an authorized external assessor, SOC 1 Type II, ISO 27001, ISO 9001, PCI DSS, and a cybersecurity transparency designation from a healthcare research firm working with a risk exchange. A SOC 2 Type 2 examination is separately announced on the vendor's own press pages.

That is a serious estate. HITRUST r2 is the full validated assessment tier rather than the entry level, and it is the certification large provider organizations most often name in contracts.

Three limits apply. Nothing is dated: no certification period, renewal date or certificate reference appears for any of the items listed. Nothing is retrievable: the page presents seals and descriptions rather than reports that can be opened or requested through a portal. And the SOC 2 announcement is an artifact of the acquisition rather than of this organization, published in 2021 under the name of the clinical documentation company later acquired, covering that company's divisions.

Scope is the question that matters most here and it is not answered. This organization's service model puts its own people inside customer record systems, at some tiers with access extending to precharting and clinician inboxes. The HITRUST scope is stated as the platform and data centers. Whether the examination reaches the review workforce, its access provisioning, and what a reviewer can see beyond the record in front of them is not stated, and it is a different question from whether the platform is certified.

No clearance claimed and none required for ambient documentation. No United States device pathway attaches.

What governs is payment integrity, and this product carries a version of the coding boundary that differs in kind from scribes that only suggest codes. At the reconciliation tier the vendor performs evaluation and management coding itself and describes this as removing the burden of coding from the clinician workflow entirely. The clinician then reviews and signs a note carrying a code selected by someone else, at a different organization, working from audio rather than from the encounter itself.

That raises an accountability question the ordinary coding suggestion does not. A suggestion leaves the clinician choosing. Coding performed by the vendor leaves the clinician attesting to a choice made elsewhere, and the attestation is what a payer relies on. Nothing published says what the clinician is shown about why a code was selected, or whether they can see the alternative the coder rejected.

The framing around it is one directional. The vendor describes the reconciliation tier as reducing the risk of undercoding. Undercoding is named as the risk; overcoding is not mentioned. A service that only ever moves in one direction across a defensible range is not correcting error, it is correcting in one direction, and its accuracy claim is not shown to hold both ways.

The vendor has also integrated the scribe natively across revenue cycle management and coding, describing the result as a connected encounter to reimbursement platform. That is the closed loop from clinical encounter to claim, stated as the product architecture rather than as a consequence.

A published 2025 policy analysis documents ambient scribes producing measurable rises in work relative value units and in documented risk adjusted diagnoses per encounter, and treats whether that reflects better documentation or more intensive coding as unresolved. That question applies here with particular force, because the coding is not merely suggested by software but performed as a service.

The strengths are candor and architecture rather than a disclosure document.

IKS Health publishes an unusually honest assessment of its own product category, writing that ambient scribe adoption outpaced validation and oversight and introduced risks including hallucinations, data inaccuracies and gaps in contextual nuance. A vendor naming the failure mode of its own market stands out, and the escalation architecture is the design response to it, which makes the criticism structural rather than rhetorical.

Two gaps remain. No fairness statement, subgroup analysis or accent and dialect performance disclosure is published. And the E&M coding in the top tier is framed partly as reducing the risk of undercoding, which is a revenue direction, though a mild one, and it is paired with clinician reconciliation and audit ready framing.

Two things stand out. The first is a published service level, with distinct turnaround tiers of roughly two minutes, one to two hours and four hours. That is a real commitment a customer can hold the vendor to, and it is an operational promise about when a note arrives, not a promise about whether it is right. The second is an engineered restriction on the human layer.

In the virtual scribing tier, scribes never access video during telehealth encounters, which is a designed limit on what a human reviewer can see rather than a policy assurance. What is absent is everything about output. No accuracy figure, model card or evaluation methodology is published, and the accuracy case rests on the human review layers rather than on any published model performance, which means the vendor asks customers to trust a process rather than a measurement. No warranty, indemnity or remediation commitment is stated.

Notes are delivered into the record rather than transferred, with direct access to Scribble inside Epic through the Connection Hub, which the vendor positions as reducing IT burden at deployment. The upper tiers go further than text: clinical information is extracted into discrete data fields and mapped to clinician selected diagnoses, and medications, labs, imaging, referrals and follow ups are queued for sign off. Structured extraction rather than narrative delivery is the meaningful distinction. Epic is the only named integration path.

Hosting is undisclosed: no region, residency option or subprocessor list is published, and nothing says where inference runs or whether a third party model service processes the audio.

The more important finding is structural, and it reframes what a buyer is choosing. This is not one product but a suite of tiers, and the tiers are marketed on turnaround time: minutes for the fully automated option, about an hour where human scribes validate the draft, four hours where clinician scribes reconcile medications, problem lists and orders, plus a transcription service with human editing and a dedicated virtual scribe service covering pre charting and inbox management.

Turnaround is the visible difference. The consequential difference is who sees the data. At the fastest tier no person at the vendor reads the encounter. At the middle tiers a scribe does. At the reconciliation tier a clinician employed by the vendor works inside the record. At the virtual scribe tier vendor staff have live access to the record including the clinician's inbox, which reaches far beyond the encounter being documented. Selecting a tier is therefore a data access decision presented as a speed decision, and a buyer evaluating turnaround will not necessarily see that.

Workforce location follows directly and is not published. The vendor's own material refers to the longevity of its domestic resources, a phrase that distinguishes them from something else without saying what. For a service where people rather than only systems read patient records, where those people sit is a residency fact in its own right.

One specific control stands out: for telehealth encounters the vendor states its scribes never access video.

No published rate card for any of the five tiers. That is a larger gap here than for a single product vendor, because the tiers differ from one another by successive layers of human labor, so the price ladder across Now, Swift and Pro would show what each level of verification costs. Enterprise sold to health systems and physician groups.

Coverage extends across the visit rather than sitting inside it: pre visit chart preparation with prior visit and external record summarization, live documentation using the clinician's own templates and macros, visit summaries and discharge instructions ready by check out, and referral letters, clearance documents and care coordination after the visit. Telehealth is supported across platforms. Problem based charting is offered as a distinct note structure, which suits complex multi problem patients better than a standard SOAP note. No specialty count or language coverage published.