Clinicians are exhausted by documentation. Hours that should go to patients disappear into charts, notes, and after-hours typing. So when a vendor demonstrates an AI scribe that listens to a visit and produces a finished note in seconds, the appeal is obvious. Physicians love it. Practice managers see burnout falling. Then someone asks a harder question: where does the recording go, who can hear it, and what happens if something goes wrong?
At CMIT Solutions of Greenville, we work with healthcare practices that want the benefits of new technology without creating a compliance or security problem they cannot undo. AI scribes can be a genuine improvement, but they also introduce a new kind of data flow into the exam room. A conversation between a patient and a clinician, which is some of the most sensitive information that exists, is captured, transmitted, processed, and often stored by a third party.
This guide walks through the privacy and security questions worth asking before you sign anything. It is written for physicians, practice owners, administrators, and IT leaders at small and mid-sized healthcare organizations. It is general information, not legal advice, so involve your counsel and compliance officer in final decisions.
The Short Answer First
If you only have a minute, here is the core of it:
- Get a signed Business Associate Agreement (BAA) before any patient information touches the tool, and make sure it covers the vendor’s subcontractors.
- Find out exactly what happens to the audio and transcripts, including where they are stored, how long they are kept, and whether they are used to train models.
- Confirm your recording consent obligations under state law. HIPAA and state recording laws are different things, and satisfying one does not satisfy the other.
- Verify the security basics, such as encryption, access controls, multi-factor authentication, audit logs, and independent security reports.
- Keep a clinician in the loop. AI-generated notes can contain errors, and the signing provider remains responsible for the record.
- Plan for the exit. Know how your data will be returned and deleted if you leave.
A vendor that answers these questions clearly, in writing, is a good sign. A vendor that gets vague is telling you something too.
What an AI Scribe Actually Does
An AI scribe, sometimes called ambient clinical documentation, uses a microphone on a phone, tablet, or computer to capture a patient visit. Speech recognition turns the audio into text, and a language model summarizes it into a structured note, often formatted for your EHR. Some tools push that note directly into the chart. Others require copy and paste.
That sounds simple, but behind the scenes several things are happening:
- Audio is recorded on a device and uploaded over the internet
- The audio may be processed by the vendor’s own systems or by outside speech and AI providers
- Transcripts and notes may be stored for some period of time
- Metadata about the visit, the clinician, and sometimes the patient is attached
- Notes flow into your EHR through an integration that has its own permissions
Every one of those steps is a place where privacy can be protected or lost. That is why a security review matters as much as a product demo.
Why AI Scribes Raise the Stakes
Healthcare data is already a favorite target. Medical records carry identity details, insurance information, and clinical history that are hard to change once exposed. A recorded conversation adds even more. Patients speak candidly about diagnoses, medications, mental health, substance use, family problems, and finances.
AI scribes also raise questions that traditional software never did:
- Raw audio is more revealing than a typed note. It can contain voices, names, and sensitive asides that never belong in the chart.
- AI processing can involve many parties. A scribe vendor may rely on cloud infrastructure and third-party models, extending your chain of custody.
- Training data is a real concern. Some vendors have historically used customer data to improve their products unless told otherwise.
- Errors can enter the record. Language models can omit details or invent plausible but wrong statements.
- Staff may adopt tools without approval. Clinicians under pressure sometimes try consumer apps that were never vetted.
Understanding the healthcare security mistakes practices commonly make helps put these risks in context, because many AI scribe problems are new versions of old ones.
Question Set 1: HIPAA and Contracts
Will you sign a Business Associate Agreement?
Any vendor that creates, receives, maintains, or transmits protected health information (PHI) on your behalf is a business associate. That includes an AI scribe. No BAA means no patient data. Treat this as a hard stop, not a negotiation point.
Does the BAA cover subcontractors?
Many scribe products rely on third-party transcription engines or large language model providers. The BAA should require the vendor to flow HIPAA obligations down to those subcontractors. Ask for a list of every subprocessor that touches PHI, and ask how you will be notified if that list changes.
What does the BAA say about breach notification?
Look for specific timelines for notifying you after discovering a breach, a description of what information will be provided, and clear cooperation obligations. Vague promises to “notify promptly” leave you exposed when your own legal deadlines are running.
Who is liable if something goes wrong?
Read the indemnification and limitation of liability clauses carefully. Some contracts cap vendor liability at a few months of fees, which may be a tiny fraction of the cost of a real breach. Ask whether the vendor carries cyber liability insurance and what limits it holds.
Does HIPAA require patient consent for an AI scribe?
HIPAA generally does not require a separate signed authorization for use of PHI in treatment, payment, and healthcare operations, and ambient documentation is typically treated as part of treatment. But that is only the HIPAA answer. State recording laws can impose their own requirements, which is covered below. Your notice of privacy practices and internal policies should also reflect how you use the technology.
How does the contract handle the HIPAA rules that are still changing?
Federal regulators have proposed a major update to the HIPAA Security Rule that would make many safeguards more explicit, including encryption, multi-factor authentication, network segmentation, stronger risk analysis, tested incident response plans, and verification that business associates actually have safeguards in place. Based on recent reporting, final action has been pushed back, with the regulatory agenda now pointing to July 2027. Proposals could change before then. A smart contract commits the vendor to meeting evolving requirements, rather than only today’s minimum. Keep an eye on healthcare compliance changes so your agreements do not age badly.
Question Set 2: Data Handling and Retention
This is where most surprises hide. Do not accept a general statement that data is “secure.” Ask for specifics.
What exactly is stored?
- The original audio recording
- The raw transcript
- The AI-generated draft note
- The final edited note
- Metadata such as timestamps, device information, and user identity
How long is each item kept?
Some vendors delete audio within minutes or days. Others keep recordings much longer for quality review. Shorter is generally safer, because data that does not exist cannot be breached. If you need to retain audio for clinical or legal reasons, that should be your decision, not a default setting.
Is our data used to train or improve AI models?
Ask directly, and get the answer in the contract. Some vendors offer a no-training commitment for paying customers. Others reserve broad rights to use data in de-identified or aggregated form. Understand the difference, how de-identification is performed, and whether you can opt out.
Where is data stored and processed?
Ask which countries and cloud regions hold your data. For most U.S. practices, data staying in the United States simplifies legal exposure. Also ask whether support staff or contractors outside the country can access PHI.
Who can access recordings and notes inside the vendor?
Find out whether employees can listen to audio for quality review, who approves that access, how it is logged, and whether human reviewers are subject to background checks and confidentiality training.
What happens to data when we leave?
Your contract should spell out data return, export formats, and certified deletion of all copies, including backups and subcontractor copies, within a defined period. Ask for written confirmation of deletion at termination.
Question Set 3: Recording Consent and Patient Trust
What do state recording laws require?
This is the question that surprises many practices. Federal HIPAA rules and state wiretapping laws are separate. Some states require every party to a conversation to consent before it is recorded. Commonly cited all-party consent states include California, Illinois, Florida, Pennsylvania, and Washington, among others. In those states, affirmative patient consent should be obtained and documented before an ambient scribe begins recording. Other states are one-party consent states, where the clinician’s awareness is generally enough legally, although documented patient notice is still wise.
South Carolina is generally viewed as a one-party consent state, but do not rely on that general assumption. Confirm the current statute and any related requirements with your attorney. Telehealth adds complexity, because patients may be in different states than your practice. Many advisors suggest defaulting to the stricter standard for telehealth visits.
How will consent be captured?
- A short verbal explanation at the start of the visit
- A line on intake or registration forms
- A visible notice in the exam room
- A clear way for patients to decline without penalty
Document consent in the chart. Train front desk and clinical staff to answer common patient questions confidently.
What do we do when a patient says no?
Your workflow should make it easy to turn the scribe off and document manually, with no pressure on the patient. A tool that is hard to disable creates both legal and trust problems.
Can patients ask what was recorded?
Be ready for access requests. Understand whether audio and transcripts are part of the designated record set in your policies, how they would be produced, and how correction requests are handled.
Question Set 4: Security Controls
A BAA is a legal document. It does not secure anything by itself. Ask what technical protections actually exist.
Encryption
- Is audio encrypted in transit from the device to the vendor?
- Is stored data encrypted at rest?
- Who controls the encryption keys?
- Is encryption applied to backups and logs?
Access control
- Does the platform support single sign-on with your identity provider?
- Is multi-factor authentication required for all users, including vendor administrators?
- Can access be limited by role, so only the treating clinician sees a given note?
- How quickly can you deactivate a departing employee?
Identity is where many breaches begin. Applying a zero trust security mindset, where no user or device is trusted automatically, fits AI tools well.
Logging and monitoring
- Are all access and changes recorded in audit logs you can review?
- How long are logs retained?
- Does the vendor monitor for suspicious activity around the clock?
- Can you export logs to your own monitoring tools?
Independent assurance
Ask for evidence rather than assurances. Common documents include a SOC 2 Type II report, HITRUST certification, penetration test summaries, and a recent third-party security assessment. Review the scope carefully, because a report covering only part of the product does not prove the whole product is secure.
Vulnerability management and incident response
- How are vulnerabilities found and patched, and how quickly?
- Does the vendor have a documented incident response plan that is tested?
- What are the response and notification commitments in the contract?
Mobile and device security
Most scribes run on phones and tablets. Ask whether the app stores audio locally before upload, whether it is protected if a device is lost, and whether you can wipe it remotely. Your own device management policies matter just as much as the vendor’s controls.
Question Set 5: Accuracy, Safety, and Clinical Oversight
Privacy and accuracy are linked. An AI scribe that records a visit perfectly but writes the wrong medication into the note has still harmed the patient.
How accurate is the tool in real conditions?
Ask for independent performance data rather than marketing claims. Accents, background noise, overlapping voices, and specialty terminology can degrade results. Run a pilot with real visits in your own environment.
How does the clinician review the note?
Every note should be reviewed and approved by the provider before it enters the record. Establish a clear expectation that a signature means the provider verified the content. Train clinicians to look for omissions, wrong laterality, medication errors, and statements that were never actually said.
What happens when the AI makes a mistake?
Understand how errors are reported, how quickly the vendor responds, and whether corrections feed back into improvements. Also ask whether the system shows its source, such as linking sentences back to the transcript, so reviews are faster and more reliable.
Does the AI do more than summarize?
Some products suggest diagnoses, orders, or billing codes. Features that influence clinical or financial decisions raise additional regulatory, liability, and compliance questions. Be deliberate about which features you turn on.
For a broader look at where the technology helps and where it gets risky, these healthcare AI use cases offer helpful context.
Question Set 6: Your Own Environment
Even the best vendor cannot protect you from weaknesses in your own setup. Before deploying a scribe, look inward.
Is your network ready?
Exam rooms often rely on wireless connections shared with guests and medical devices. A recording tool that sends sensitive audio over a poorly segmented network is a risk. The concerns around a practice wireless security gap are especially relevant here.
Are your devices managed?
Know which phones, tablets, and laptops will run the scribe. Require screen locks, encryption, current operating systems, and the ability to wipe lost devices.
Are staff trained?
Employees need to know which tools are approved, how to handle patient consent, and what to do if something looks wrong. Email mistakes remain a major source of exposure, as explained in this look at HIPAA inbox violations.
Do you have an AI governance policy?
Write down which AI tools are permitted, who approves new ones, what data may be entered, and how incidents are reported. A short, clear policy beats a long one nobody reads. Guidance on securing AI tools is a useful starting point for building one.
Watch for shadow tools
If an approved scribe is slow or hard to use, clinicians may turn to free consumer apps that offer no BAA and unknown data handling. That is one of the most common ways PHI escapes. Understanding shadow AI risks helps you address demand with a safe, approved option instead of a ban that people quietly ignore. The same applies to general-purpose assistants, since AI chatbot risks increase when staff paste patient details into tools that were never vetted.
Vendor Due Diligence: A Practical Checklist
Use this list during evaluation. Ask for written answers, and keep them with your compliance records.
Contract and legal
- Signed BAA covering subcontractors
- Clear breach notification timelines
- Reasonable liability and indemnification terms
- Evidence of cyber insurance
- Defined data return and deletion at termination
Data handling
- Documented retention periods for audio, transcripts, and notes
- Written no-training commitment, or a clear opt-out
- U.S. data residency, if that matters to you
- Controlled and logged internal access
Security
- Encryption in transit and at rest
- Single sign-on and mandatory multi-factor authentication
- Role-based access and audit logs
- Current SOC 2 Type II or equivalent independent report
- Documented incident response and vulnerability management
Consent and workflow
- Built-in support for consent capture and easy opt-out
- Clear off switch for each visit
- Support for your state’s consent rules
Clinical quality
- Independent accuracy evidence and a pilot period
- Mandatory clinician review before notes enter the chart
- Transparent handling of errors
A systematic vendor risk assessment process turns this checklist into a repeatable habit instead of a one-time scramble.
Red Flags to Watch For
- The vendor will not sign a BAA, or offers one that excludes key services
- Answers about subcontractors or data location are evasive
- Audio is retained indefinitely by default
- Customer data is used for training with no opt-out
- No independent security report is available
- Multi-factor authentication is optional
- The sales team cannot explain how consent should work in your state
- The contract allows unilateral changes to data practices
- There is no clear process to export and delete your data
Any one of these deserves a pause. Several together are a reason to walk away.
Planning for the Worst Day
Even careful organizations can face incidents. Having a plan ahead of time shortens the damage.
- Know who at the vendor to call, and how quickly they must respond
- Define internal roles for investigation, legal review, and patient communication
- Practice the plan at least annually
- Keep isolated, tested backups of your own records
If a problem occurs, the first hours matter. The steps in this guide to ransomware recovery steps and the guidance on data breach response apply directly to healthcare settings. Reliable data backup also protects your ability to keep treating patients if systems are disrupted.
Building the Right Foundation
An AI scribe is only one layer of a healthcare security program. The stronger your foundation, the less any single new tool can hurt you.
Technology and infrastructure
- Well-governed cloud services reduce misconfigurations that expose PHI
- Disciplined network management separates clinical systems, guest traffic, and medical devices
- Secure productivity applications protect the email and documents that surround patient care
- Protected unified communications safeguard voice and video, including telehealth
- Careful IT procurement ensures new devices arrive configured securely
Monitoring and compliance
- Dedicated cybersecurity services provide round-the-clock detection and response
- Ongoing compliance services help document safeguards and prepare for audits
- The practice of continuous compliance monitoring keeps evidence current instead of scrambling each year
- Rising cyber insurance expectations mean insurers may ask how you vet AI tools and handle patient data
Strategy and support
Adopting AI is a strategic choice as much as a technical one. A practice should decide what problems it wants to solve, how it will measure success, and how it will manage risk. Reviewing an AI readiness checklist before buying helps expose gaps in your environment. Leaders also benefit from understanding AI workplace oversight responsibilities, since decisions about these tools cannot be delegated entirely to vendors.
Ongoing IT guidance can help you weigh options, and consistent managed IT services keep devices patched and standardized. A responsive IT support team helps clinicians who hit problems get back to patients quickly, which reduces the temptation to use unapproved workarounds. Predictable service packages make it easier to budget for all of it.
A Sensible Rollout Plan
Rushing a full deployment is the fastest way to create problems. A phased approach works better.
Step 1: Define the goal
Decide what you want, such as less after-hours charting, faster note completion, or improved patient engagement. Specific goals make vendor comparisons easier.
Step 2: Review and shortlist vendors
Use the checklist above. Eliminate vendors that fail on contract basics.
Step 3: Involve compliance and legal early
Have counsel review the BAA, the consent approach, and your state’s recording rules before a pilot starts.
Step 4: Pilot with a small group
Choose a few willing clinicians, set clear success measures, and watch for accuracy issues, workflow friction, and patient reactions.
Step 5: Train and communicate
Teach staff how to use the tool, how to obtain consent, and how to review notes. Update your privacy notice and patient-facing materials.
Step 6: Expand carefully
Add users gradually, review audit logs regularly, and revisit the vendor’s security evidence at least once a year.
Step 7: Keep reassessing
Tools change quickly. Vendors update models, change subprocessors, and revise terms. Schedule periodic reviews so your protections keep pace.
Conclusion: Say Yes to the Technology, Not to the Unknowns
AI scribes can give clinicians back time and give patients more attention during visits. That is a real benefit worth pursuing. But a recording of a medical visit is some of the most sensitive data your practice will ever handle, and the decision to send it to a third party should never rest on a polished demo.
Ask about the BAA and subcontractors. Pin down what is stored and for how long. Confirm your state’s consent rules. Verify the security controls with evidence. Keep clinicians responsible for the final note. And strengthen your own environment so a new tool lands on solid ground. A vendor worth trusting will welcome these questions.
If you want a second set of eyes before you sign, the team at CMIT Solutions of Greenville can review your environment, help you evaluate vendors, and build a practical plan for adopting AI safely. You can also explore the full range of support on the Greenville IT provider homepage, or schedule a consultation to get started.
Frequently Asked Questions
