A doctor's office calls you on a Tuesday. They need a virtual scribe covering three provider shifts starting Monday. Your team can staff it. But before your first invoice can legally go out, one document has to be signed, and it isn't the service contract — it's a Business Associate Agreement, or BAA.
Skip that step and you're not just risking an awkward compliance conversation. You're running a business that has taken on federal liability for protected health information without a scrap of paper to define what happens if something goes wrong. The Department of Health and Human Services' Office for Civil Rights has settled cases for six and seven figures over missing BAAs alone — no breach required, just the absence of the agreement. North Memorial Health Care paid $1.55 million in 2016 for disclosing patient data to a vendor before a BAA was executed. A missing BAA isn't a paperwork oversight in the eyes of regulators; it's treated as its own violation.
For a virtual medical scribe agency — human scribes, AI-assisted scribes, or a hybrid of both — this single contract is the hinge everything else swings on: your billing calendar, your revenue recognition, your contractor classifications, and your exposure if a client practice ever gets audited.
What a Virtual Scribe Agency Actually Sells
Providers hire scribes to sit in on patient encounters (virtually, via audio or video feed) and produce clinical documentation in real time — chart notes, orders, referral letters — so the physician can look at the patient instead of the screen. The agency's core deliverable is documentation turnaround, but what it's actually selling is access to protected health information under a defined, auditable set of rules.
That distinction matters for how you build your books. You're not just tracking hours and invoices. You're tracking a compliance relationship with a defined start date (BAA execution), a defined scope (what data flows, in which direction, through which subcontractors), and a defined end date (data return or destruction when the contract ends).
Pricing Models and What They Do to Your Ledger
Most virtual scribe agencies price one of three ways, and each has different bookkeeping implications:
Hourly rate per shift. The most common structure — commonly $20 to $35 per hour for US-based scribes, with offshore staffing pools running lower headline rates that often come with managed-services fees layered on top. This model is straightforward to book: revenue recognized as shifts are worked, typically invoiced biweekly or monthly against a timesheet.
Monthly subscription per provider. Audio-only coverage often runs $2,500–$3,000 per provider per month; video-enabled or AI-augmented services push toward $3,500–$4,000. This is a recurring-revenue model, which means you need deferred revenue treatment if a client pre-pays, and a clear cutoff policy for mid-month starts and cancellations.
Per-encounter billing. Some agencies charge $10–$15 per patient visit rather than by the clock, which suits practices with unpredictable daily volume. This is the trickiest to reconcile because your revenue depends on a count of the client's patient encounters, not your own scribe's clocked hours — you need a reliable feed of encounter counts, ideally tied to the practice's EHR, or you're billing on trust.
Whichever model you use, the accounting principle is the same: revenue is earned when the shift is worked or the encounter is documented, not when the invoice is sent or the payment clears. If you book revenue on invoice date instead of service date, your monthly P&L will drift out of sync with your actual staffing costs — a mismatch that gets worse, not better, as you scale to more providers and more shifts.
The BAA Isn't Legal Boilerplate — It's a Line Item in Your Onboarding Cost
Here's the part that trips up scribe agencies moving fast to close new clients: the BAA has to be signed and dated before a single scribe listens to a single patient encounter. Not "in progress." Not "our lawyer is reviewing it." Signed.
That means your new-client onboarding checklist needs a hard gate, and your books need a way to flag revenue that shouldn't exist yet. If a scribe starts working a shift for a practice whose BAA is still in redline, you have two problems: a compliance violation, and an invoice you arguably shouldn't send for work performed outside a valid data-handling agreement. Treat "BAA fully executed" as a prerequisite matching your first billable date — the same way you'd treat a signed service agreement before booking revenue on any other contract.
A compliant BAA for a scribe agency needs to spell out:
- Permitted uses of PHI — documentation only, not secondary uses like model training on transcripts unless the client explicitly agrees
- Security safeguards — encryption in transit and at rest, access controls, audit logging
- Breach notification timelines — how fast you tell the client if something goes wrong
- Subcontractor flow-down — if you use a third-party transcription API, speech-recognition vendor, or cloud host, they need their own BAA with you, and the client practice needs to know who's in that chain
- Data return or destruction — what happens to session recordings and transcripts when the contract ends
That subcontractor chain is where a lot of scribe agencies get exposed without realizing it. If your scribes use an AI transcription tool, and that tool's vendor doesn't have a BAA with you, you've created an unauthorized disclosure the moment audio touches their servers — regardless of what your BAA with the client says.
Human Scribes, AI Scribes, and Why Your Cost Structure Isn't the Same
Agencies increasingly run a hybrid model: an AI layer drafts the note in real time, and a human scribe reviews, edits, and finalizes it before it hits the chart. One common structure runs roughly $300 per provider per month for the AI subscription plus a human reviewer at scribe-hourly rates, landing around $2,500 per provider per month all-in.
If that's your model, your cost of goods sold has two components that behave differently:
- AI/software licensing — usually a fixed monthly cost per provider seat, regardless of how many hours the AI actually processes. Treat this like any SaaS subscription cost, amortized across the billing period.
- Human scribe labor — variable, tied to actual shift hours. This is where worker classification matters most.
On classification: a scribe who works fixed shifts on your client's schedule, uses the client's EHR exclusively, follows your standardized documentation protocol, and can't take other clients during shift hours starts to look like an employee under the IRS's behavioral- and financial-control test, whatever the contract calls them. Misclassifying scribes as 1099 contractors when the actual working relationship has employee-level control is a separate liability from the HIPAA exposure — and it's one that surfaces during a payroll tax audit, not a health-data audit, so it's easy to miss if you're only watching for HIPAA risk.
Building a Chart of Accounts That Matches How the Business Actually Runs
A scribe agency's books should separate at minimum:
- Scribe labor cost (split by W-2 payroll vs. 1099 contractor payments — different tax treatment, different 1099-NEC filing obligations at year-end)
- AI/software subscription cost — separate from labor, since it scales differently
- Compliance and audit costs — BAA legal review, HIPAA training, security audits; these are overhead, not COGS, but worth tracking separately so you can see what compliance actually costs per client onboarded
- Client revenue by pricing model — hourly, subscription, and per-encounter revenue streams, so you can see which pricing model is actually most profitable once labor and AI costs are allocated against it
That last point matters more than it sounds. A per-encounter contract that looked attractive at $12/encounter can turn unprofitable fast if patient volume runs low some weeks and your scribe still has to be staffed for the full shift regardless of how many encounters occur. Tracking revenue by pricing model, against actual labor hours, is how you catch that before it becomes a pattern across your whole client roster.
Keep Your Compliance and Your Books in the Same System of Record
A scribe agency's biggest operational risk isn't a bad month of billing — it's discovering, after a client audit or a breach, that a BAA lapsed, a subcontractor was never covered, or a shift was invoiced before an agreement existed. The businesses that avoid this treat compliance status as data that belongs next to their financial data, not in a separate binder a lawyer keeps.
Beancount.io gives you plain-text accounting you can version-control alongside the rest of your business records — every invoice, every client contract date, every rate change tracked in a format you can audit line by line, with no proprietary format locking your history away. Get started for free and keep your billing as auditable as the compliance obligations it's tied to.