Healthcare AI & Medical Scribes
Doximity GPT (Doximity Ask)
Medium riskFree AI writing and clinical-answer assistant (renamed from Doximity GPT to Doximity Ask) bundled into the professional network used by a large majority of US physicians.
Is Doximity GPT (Doximity Ask) safe for confidential data?
Doximity's AI assistant is marketed as free and HIPAA compliant for verified US clinicians, with business associate agreement coverage in place and a stated policy of not retaining audio for its scribe features — a materially better posture than pasting patient details into a consumer chatbot. The caveats are scope and governance: the BAA runs between Doximity and the user context it defines, so a hospital's compliance office may never have reviewed or approved it even while its physicians use it daily; the rename from Doximity GPT to Doximity Ask leaves policies and reviews pointing at a product name that no longer matches; and because it ships free inside a network most US physicians already belong to, it enters practices by default rather than by decision.
Risk by plan
The same product often carries very different terms depending on the tier — consumer plans are where the exposure concentrates.
Free to verified clinicians as part of the Doximity network — which means adoption is individual and instant, with BAA coverage that the physician's employer may never have evaluated.
Health systems can engage Doximity directly, which is the route to reviewed terms, defined BAA scope, and organizational oversight.
Data handling
Training on inputs
Doximity positions the assistant as privacy-first for clinical use; a detailed public statement of training rights over prompt content is not prominent. Confirm scope directly before treating it as a no-training environment.
Retention
For scribe functionality Doximity states it does not store or retain audio — recordings are processed in real time and discarded once the note is generated. Retention of typed prompts and outputs within the user's account is not clearly published.
Residency
US-hosted, offered to verified US clinicians. No Canadian residency or PHIPA/PIPEDA positioning is published; Canadian physicians on Doximity should not assume equivalent coverage.
Compliance
- SOC 2Not verified
- GDPR / DPANot verified
- HIPAA BAAYes
Certifications typically apply to specific tiers and contracts — confirm scope in writing before relying on them.
New to these frameworks? See our plain-language guides to SOC 2 and the other AI compliance standards.
Enterprise controls
- BAA coverage for clinician users
- Verified-clinician access (identity-gated network)
- No audio retention for scribe features (vendor-stated)
Frequently asked questions
Is Doximity GPT HIPAA compliant?
Doximity states that its AI assistant (now called Doximity Ask, formerly Doximity GPT) is HIPAA compliant with business associate agreements in place, and it is offered free to verified US clinicians. That is a real distinction from consumer chatbots. The 'yes' comes with conditions: confirm what the BAA actually covers, and note that renamed products are easy to misjudge — a policy that cleared 'Doximity GPT' should be re-checked against what Doximity Ask does today.
Can I put PHI into Doximity GPT?
Doximity's position is that clinician use is BAA-covered, which permits PHI in a way an uncovered tool never could. Whether you should still depends on your organization: many compliance offices have never assessed Doximity's AI because it arrived bundled with a network membership rather than through procurement. Check whether your organization has approved it before routing patient details through it, and prefer de-identified prompts where the answer does not require identifiers.
Why does a free, BAA-covered tool still create a shadow-AI issue?
Because the decision to use it is made by each physician, not by the practice. Roughly 80 percent of US physicians are on Doximity, so a free AI assistant inside that network reaches clinical workflows with zero procurement signal — no contract negotiation, no security review, nothing for a compliance officer to notice. The tool may be fine; the invisible adoption is the problem, and it deserves the same inventory-and-policy treatment as any unsanctioned AI.
Policy changelog
- Initial entry published from Doximity's published materials and cited coverage.
Sources
- Doximity blog: Free medical AI tools and HIPAA compliance
- Fierce Healthcare: Doximity offers free AI scribe tool for doctors
This profile summarizes the vendor's published policies as of the verification date. It is not legal advice.
Doximity GPT (Doximity Ask) is probably already in your organization.
Sanitized AI shows you who is using it and redacts sensitive data from prompts before it leaves your control.
More AI tool profiles
Enterprise ambient clinical documentation platform, deeply integrated with Epic, that records clinician-patient conversations and generates structured notes.
Self-serve ambient AI medical scribe that listens to patient visits and drafts clinical notes, aimed at solo clinicians and small practices.
AI medical scribe with a free tier, built by an Australian company and marketed to clinicians in the US, Canada, the UK, and Australia.
Microsoft's enterprise ambient clinical AI (successor to Nuance DAX Copilot) that records patient encounters and drafts documentation inside major EHRs.