Sampson Scribe — Network Access Guide for IT Teams

What Sampson is

Sampson Scribe is a HIPAA-compliant clinical documentation assistant used by emergency physicians. A clinician dictates on their own device; Sampson transcribes the audio and drafts the note for the clinician to review and copy into your EHR. It integrates with nothing on your network — no EHR interface, no local install, no inbound connections. One of your clinicians was likely blocked by a web filter and sent you this page.

Domains to allow

All traffic is outbound HTTPS (TCP 443, TLS 1.2+) from the clinician's device. There are no other ports, no inbound connections, and no VPN requirement.

What does NOT happen from your network

• No direct device connections to AI vendors. Speech-to-text and note drafting run server-side in our cloud environment, with every provider under a signed BAA, data retention disabled, and no training on patient data. The clinician's device never contacts them.
• No PHI in URLs or query strings. Audio uploads use opaque, time-limited presigned URLs; all identifiers are internal random IDs.
• No inbound connections, agents, or software installs on hospital equipment. Clinicians use their personal device or any browser.
• No advertising, analytics trackers, or third-party scripts inside the clinical app.

Security posture (summary)

• HIPAA Security Rule risk analysis on file (45 CFR §164.308(a)(1), NIST SP 800-30 / OCR methodology)
• Business Associate Agreements with every subprocessor that touches PHI; the named list is published in Section 5 of our Privacy Policy
• Our BAA with each clinician is executed at first sign-in and published at sampsonscribe.ai/baa
• TLS 1.2+ in transit; AES-256 at rest; US data residency
• Aggressive data minimization: audio is deleted from our servers within 72 hours of upload. Audio is scheduled for deletion 24 hours after upload; because of how our cloud storage provider processes deletions, it is fully removed within 72 hours. Notes are auto-deleted after 14 days.
• Append-only audit logs retained 6 years; per-user data isolation
• Security-awareness training for everyone with production access and incident-response tabletop exercises, each at least annually (most recently September 2026 and June 2026)
• Internal penetration test (September 2026) against an isolated replica of the production application, run by our own team — not an independent third-party test; see below

What we do NOT have (so you don't have to go looking)

• No SOC 2, HITRUST, or ISO 27001 certification. Our infrastructure providers hold those for the layers they operate; Sampson Scribe does not hold them itself.
• No independent third-party penetration test has been performed. What we have is an internal penetration test: in September 2026 our own team ran live attack campaigns (cross-tenant access, authorization bypass, forged credentials, path traversal, prompt injection, payment and webhook forgery) against a dedicated, isolated replica of the production application — same codebase and cloud architecture, separate account, synthetic data only. The exploitable defects it found were fixed, and regression tests pin those fixes. An internal test is not a substitute for an independent test, and it was run against the replica, not production. Findings are available to your security team under NDA.
• No MFA and no enterprise SSO (SAML / OIDC / SCIM). Sign-in is email and password, Google, or Apple. You cannot centrally provision or deprovision Sampson accounts today — we deprovision on request from the clinician or the organization, and an account holds only that clinician's own note drafts.
• No MDM integration. The app runs on the clinician's personal phone. The OS lock screen is the primary access control, encounter audio lives in the app's private sandbox with a bounded retention window, and local data is cleared on logout. You are free to apply your own BYOD device policy to the phone.

Each of these with its compensating control: sampsonscribe.ai/security.

Need more?

We will gladly complete your vendor security questionnaire (SIG Lite / VSAQ) and provide our full security package — whitepaper, subprocessor list, incident response plan, and data-flow diagram. Email admin@sampsonscribe.ai and we typically respond within one business day. Full details: sampsonscribe.ai/security.