Authorship is not the same as typing
The person who types a note is not automatically the author. In clinic documentation, authorship follows the clinician who attests that the record reflects the visit. A scribe, virtual or in-room, is a documentation assistant. An AI tool is a documentation assistant with a different microphone. Neither becomes the treating provider because they chose a better synonym for shortness of breath. If your staff speak as if 'the scribe signed it,' you have a training problem that will eventually become a records problem. The signature is the point of ownership. Everything before it is a draft.
That split is easy to say and easy to blur. A trusted virtual scribe who has worked with you for a year will anticipate your plan language. Gratitude is fine. Letting that person enter a diagnosis you did not discuss is not. The same blur happens with ambient drafts that look polished. Polish is not knowledge. Your name on the note tells a later reader, an auditor, or a court that you stood behind the contents. Typing credit is a workflow detail. Attestation is the legal one. Keep those vocabularies separate in staff meetings so the culture does not drift.
What a scribe or vendor can and cannot sign
A vendor should never sign a clinical note as the treating provider. Scribes should not attest to medical decision making they did not perform. Some organizations allow scribes to enter information under their own user and then require the clinician to attest; others have the clinician's user on the document from the start. Follow your EHR's identity rules and your medical-staff policy. Do not invent a shared login so the draft 'saves time.' Shared logins destroy the audit trail that you will want if anyone asks who changed a medication list at 5:12 p.m.
Business associates still have duties. A transcription company or scribe vendor that handles PHI needs a signed BAA, access controls, and a breach process. That is not the same as clinical authorship. HIPAA's business-associate framework is about safeguarding information, not about who decided the plan. Sunrise executes a BAA before PHI moves and documents who can touch an account. Read that packet next to your HIPAA policy so nobody thinks a vendor signature on a contract is a vendor signature on a progress note. Contracts allocate data risk. They do not examine patients.
Review, attestation, and the audit trail
Review is the moment ownership becomes real. If you attest without reading, you still own the errors. That is an uncomfortable sentence and it is the job. Build a review that is short enough to do every time: identifiers, laterality, meds, assessment list, plan. Teach new clinicians that skipping review is not a productivity hack. It is personal risk. If your organization uses pending co-signatures, know what the co-signature means in your policy. A rubber stamp is not a process. A time-stamped attestation after a real look is.
Keep the trail. You should be able to see who drafted, who edited, and who signed, with times. Vendors should be able to say who transcribed or scribed a given visit. If a correction is needed after sign, use an addendum rather than silently rewriting history. Silent edits after the fact make records look worse, not cleaner, when they are later compared. Ask your EHR administrator how amendments are displayed. Ask your transcription vendor how they handle a recalled file. Ownership includes the ability to explain the document's life after Thursday afternoon.
When an error in the draft becomes your error
A wrong drug in a draft is the scribe's or model's mistake until you sign. After you sign, it is yours in the sense that the official record says you attested to it. You may still have a contract claim against a vendor for shoddy work. That claim does not rewrite the chart. Correct the chart first, through the proper amendment path, then deal with the vendor. Clinics that reverse that order spend energy on a ticket while the wrong medication remains the last word in the EHR. Patients and covering colleagues will read the EHR, not your complaint email.
Some errors are patterns. If a scribe always expands a normal review of systems you did not perform, that is a training failure you now own if you keep signing it. Stop signing it. Send examples. Require a template change. The same is true of ambient drafts that invent social history. Your silence is a standing order to keep doing it. Ownership is not only blame. It is control of the standard. A clinician who refuses to attest to invented exam language is doing the legal job, even if it slows the afternoon once. The next afternoon gets faster.
Contracts, BAAs, and who is on the hook
Your vendor contract should say that the service provides drafts or transcribed documents, that the client clinicians remain responsible for review and signature, and that PHI is handled under a BAA with named subprocessors. It should not claim the vendor practices medicine. It should not hide where processing occurs. Sunrise uses U.S.-based processing and is willing to put that in writing. If a salesperson says you are 'covered' because they have insurance, ask covered for what. Data mishandling and clinical content are different failures. Insurance language is not a note.
Inside the clinic, write a one-page rule for employed scribes and students as well. Who may enter orders. Who may enter diagnoses. What must be spoken by the clinician. How patients are introduced to a remote listener. When a patient declines, what the backup documentation method is. Hang that page where onboarding actually happens. Legal responsibility is not a seminar. It is a habit that survives a busy Tuesday. If the only person who understands ownership is the compliance officer, the note will still get signed in a hurry by someone who was not in the meeting.