{"id":2032,"date":"2026-11-06T09:12:01","date_gmt":"2026-11-06T15:12:01","guid":{"rendered":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/?p=2032"},"modified":"2026-11-07T09:22:10","modified_gmt":"2026-11-07T15:22:10","slug":"ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/","title":{"rendered":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign"},"content":{"rendered":"<p><span style=\"font-weight: 400\">Clinicians are exhausted by documentation. Hours that should go to patients disappear into charts, notes, and after-hours typing. So when a vendor demonstrates an AI scribe that listens to a visit and produces a finished note in seconds, the appeal is obvious. Physicians love it. Practice managers see burnout falling. Then someone asks a harder question: where does the recording go, who can hear it, and what happens if something goes wrong?<\/span><\/p>\n<p><span style=\"font-weight: 400\">At CMIT Solutions of Greenville, we work with healthcare practices that want the benefits of new technology without creating a compliance or security problem they cannot undo. AI scribes can be a genuine improvement, but they also introduce a new kind of data flow into the exam room. A conversation between a patient and a clinician, which is some of the most sensitive information that exists, is captured, transmitted, processed, and often stored by a third party.<\/span><\/p>\n<p><span style=\"font-weight: 400\">This guide walks through the privacy and security questions worth asking before you sign anything. It is written for physicians, practice owners, administrators, and IT leaders at small and mid-sized healthcare organizations. It is general information, not legal advice, so involve your counsel and compliance officer in final decisions.<\/span><\/p>\n<h2><b>The Short Answer First<\/b><\/h2>\n<p><span style=\"font-weight: 400\">If you only have a minute, here is the core of it:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b>Get a signed Business Associate Agreement (BAA)<\/b><span style=\"font-weight: 400\"> before any patient information touches the tool, and make sure it covers the vendor&#8217;s subcontractors.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Find out exactly what happens to the audio and transcripts<\/b><span style=\"font-weight: 400\">, including where they are stored, how long they are kept, and whether they are used to train models.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Confirm your recording consent obligations under state law.<\/b><span style=\"font-weight: 400\"> HIPAA and state recording laws are different things, and satisfying one does not satisfy the other.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Verify the security basics<\/b><span style=\"font-weight: 400\">, such as encryption, access controls, multi-factor authentication, audit logs, and independent security reports.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Keep a clinician in the loop.<\/b><span style=\"font-weight: 400\"> AI-generated notes can contain errors, and the signing provider remains responsible for the record.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Plan for the exit.<\/b><span style=\"font-weight: 400\"> Know how your data will be returned and deleted if you leave.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">A vendor that answers these questions clearly, in writing, is a good sign. A vendor that gets vague is telling you something too.<\/span><\/p>\n<h2><b>What an AI Scribe Actually Does<\/b><\/h2>\n<p><span style=\"font-weight: 400\">An AI scribe, sometimes called ambient clinical documentation, uses a microphone on a phone, tablet, or computer to capture a patient visit. Speech recognition turns the audio into text, and a language model summarizes it into a structured note, often formatted for your EHR. Some tools push that note directly into the chart. Others require copy and paste.<\/span><\/p>\n<p><span style=\"font-weight: 400\">That sounds simple, but behind the scenes several things are happening:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Audio is recorded on a device and uploaded over the internet<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The audio may be processed by the vendor&#8217;s own systems or by outside speech and AI providers<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Transcripts and notes may be stored for some period of time<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Metadata about the visit, the clinician, and sometimes the patient is attached<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Notes flow into your EHR through an integration that has its own permissions<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Every one of those steps is a place where privacy can be protected or lost. That is why a security review matters as much as a product demo.<\/span><\/p>\n<h2><b>Why AI Scribes Raise the Stakes<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Healthcare data is already a favorite target. Medical records carry identity details, insurance information, and clinical history that are hard to change once exposed. A recorded conversation adds even more. Patients speak candidly about diagnoses, medications, mental health, substance use, family problems, and finances.<\/span><\/p>\n<p><span style=\"font-weight: 400\">AI scribes also raise questions that traditional software never did:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><b>Raw audio is more revealing than a typed note.<\/b><span style=\"font-weight: 400\"> It can contain voices, names, and sensitive asides that never belong in the chart.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>AI processing can involve many parties.<\/b><span style=\"font-weight: 400\"> A scribe vendor may rely on cloud infrastructure and third-party models, extending your chain of custody.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Training data is a real concern.<\/b><span style=\"font-weight: 400\"> Some vendors have historically used customer data to improve their products unless told otherwise.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Errors can enter the record.<\/b><span style=\"font-weight: 400\"> Language models can omit details or invent plausible but wrong statements.<\/span><\/li>\n<li style=\"font-weight: 400\"><b>Staff may adopt tools without approval.<\/b><span style=\"font-weight: 400\"> Clinicians under pressure sometimes try consumer apps that were never vetted.<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Understanding the<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/the-biggest-cybersecurity-mistakes-healthcare-organizations-are-still-making\/\"> <span style=\"font-weight: 400\">healthcare security mistakes<\/span><\/a><span style=\"font-weight: 400\"> practices commonly make helps put these risks in context, because many AI scribe problems are new versions of old ones.<\/span><\/p>\n<h2><b>Question Set 1: HIPAA and Contracts<\/b><\/h2>\n<h3><b>Will you sign a Business Associate Agreement?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Any vendor that creates, receives, maintains, or transmits protected health information (PHI) on your behalf is a business associate. That includes an AI scribe. No BAA means no patient data. Treat this as a hard stop, not a negotiation point.<\/span><\/p>\n<h3><b>Does the BAA cover subcontractors?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Many scribe products rely on third-party transcription engines or large language model providers. The BAA should require the vendor to flow HIPAA obligations down to those subcontractors. Ask for a list of every subprocessor that touches PHI, and ask how you will be notified if that list changes.<\/span><\/p>\n<h3><b>What does the BAA say about breach notification?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Look for specific timelines for notifying you after discovering a breach, a description of what information will be provided, and clear cooperation obligations. Vague promises to &#8220;notify promptly&#8221; leave you exposed when your own legal deadlines are running.<\/span><\/p>\n<h3><b>Who is liable if something goes wrong?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Read the indemnification and limitation of liability clauses carefully. Some contracts cap vendor liability at a few months of fees, which may be a tiny fraction of the cost of a real breach. Ask whether the vendor carries cyber liability insurance and what limits it holds.<\/span><\/p>\n<h3><b>Does HIPAA require patient consent for an AI scribe?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">HIPAA generally does not require a separate signed authorization for use of PHI in treatment, payment, and healthcare operations, and ambient documentation is typically treated as part of treatment. But that is only the HIPAA answer. State recording laws can impose their own requirements, which is covered below. Your notice of privacy practices and internal policies should also reflect how you use the technology.<\/span><\/p>\n<h3><b>How does the contract handle the HIPAA rules that are still changing?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Federal regulators have proposed a major update to the HIPAA Security Rule that would make many safeguards more explicit, including encryption, multi-factor authentication, network segmentation, stronger risk analysis, tested incident response plans, and verification that business associates actually have safeguards in place. Based on recent reporting, final action has been pushed back, with the regulatory agenda now pointing to July 2027. Proposals could change before then. A smart contract commits the vendor to meeting evolving requirements, rather than only today&#8217;s minimum. Keep an eye on<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/navigating-compliance-changes-healthcare-it-must-knows-for-2026\/\"> <span style=\"font-weight: 400\">healthcare compliance changes<\/span><\/a><span style=\"font-weight: 400\"> so your agreements do not age badly.<\/span><\/p>\n<h2><b>Question Set 2: Data Handling and Retention<\/b><\/h2>\n<p><span style=\"font-weight: 400\">This is where most surprises hide. Do not accept a general statement that data is &#8220;secure.&#8221; Ask for specifics.<\/span><\/p>\n<h3><b>What exactly is stored?<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The original audio recording<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The raw transcript<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The AI-generated draft note<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The final edited note<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Metadata such as timestamps, device information, and user identity<\/span><\/li>\n<\/ul>\n<h3><b>How long is each item kept?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Some vendors delete audio within minutes or days. Others keep recordings much longer for quality review. Shorter is generally safer, because data that does not exist cannot be breached. If you need to retain audio for clinical or legal reasons, that should be your decision, not a default setting.<\/span><\/p>\n<h3><b>Is our data used to train or improve AI models?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Ask directly, and get the answer in the contract. Some vendors offer a no-training commitment for paying customers. Others reserve broad rights to use data in de-identified or aggregated form. Understand the difference, how de-identification is performed, and whether you can opt out.<\/span><\/p>\n<h3><b>Where is data stored and processed?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Ask which countries and cloud regions hold your data. For most U.S. practices, data staying in the United States simplifies legal exposure. Also ask whether support staff or contractors outside the country can access PHI.<\/span><\/p>\n<h3><b>Who can access recordings and notes inside the vendor?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Find out whether employees can listen to audio for quality review, who approves that access, how it is logged, and whether human reviewers are subject to background checks and confidentiality training.<\/span><\/p>\n<h3><b>What happens to data when we leave?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Your contract should spell out data return, export formats, and certified deletion of all copies, including backups and subcontractor copies, within a defined period. Ask for written confirmation of deletion at termination.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-2035\" src=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-33-1024x535.png\" alt=\"\" width=\"1024\" height=\"535\" srcset=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-33-1024x535.png 1024w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-33-300x157.png 300w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-33-768x401.png 768w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-33.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<h2><b>Question Set 3: Recording Consent and Patient Trust<\/b><\/h2>\n<h3><b>What do state recording laws require?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">This is the question that surprises many practices. Federal HIPAA rules and state wiretapping laws are separate. Some states require every party to a conversation to consent before it is recorded. Commonly cited all-party consent states include California, Illinois, Florida, Pennsylvania, and Washington, among others. In those states, affirmative patient consent should be obtained and documented before an ambient scribe begins recording. Other states are one-party consent states, where the clinician&#8217;s awareness is generally enough legally, although documented patient notice is still wise.<\/span><\/p>\n<p><span style=\"font-weight: 400\">South Carolina is generally viewed as a one-party consent state, but do not rely on that general assumption. Confirm the current statute and any related requirements with your attorney. Telehealth adds complexity, because patients may be in different states than your practice. Many advisors suggest defaulting to the stricter standard for telehealth visits.<\/span><\/p>\n<h3><b>How will consent be captured?<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">A short verbal explanation at the start of the visit<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">A line on intake or registration forms<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">A visible notice in the exam room<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">A clear way for patients to decline without penalty<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Document consent in the chart. Train front desk and clinical staff to answer common patient questions confidently.<\/span><\/p>\n<h3><b>What do we do when a patient says no?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Your workflow should make it easy to turn the scribe off and document manually, with no pressure on the patient. A tool that is hard to disable creates both legal and trust problems.<\/span><\/p>\n<h3><b>Can patients ask what was recorded?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Be ready for access requests. Understand whether audio and transcripts are part of the designated record set in your policies, how they would be produced, and how correction requests are handled.<\/span><\/p>\n<h2><b>Question Set 4: Security Controls<\/b><\/h2>\n<p><span style=\"font-weight: 400\">A BAA is a legal document. It does not secure anything by itself. Ask what technical protections actually exist.<\/span><\/p>\n<h3><b>Encryption<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Is audio encrypted in transit from the device to the vendor?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Is stored data encrypted at rest?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Who controls the encryption keys?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Is encryption applied to backups and logs?<\/span><\/li>\n<\/ul>\n<h3><b>Access control<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Does the platform support single sign-on with your identity provider?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Is multi-factor authentication required for all users, including vendor administrators?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Can access be limited by role, so only the treating clinician sees a given note?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">How quickly can you deactivate a departing employee?<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Identity is where many breaches begin. Applying a<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/zero-trust-isnt-optional-anymore-heres-why-it-leaders-are-switching-fast\/\"> <span style=\"font-weight: 400\">zero trust security<\/span><\/a><span style=\"font-weight: 400\"> mindset, where no user or device is trusted automatically, fits AI tools well.<\/span><\/p>\n<h3><b>Logging and monitoring<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Are all access and changes recorded in audit logs you can review?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">How long are logs retained?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Does the vendor monitor for suspicious activity around the clock?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Can you export logs to your own monitoring tools?<\/span><\/li>\n<\/ul>\n<h3><b>Independent assurance<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Ask for evidence rather than assurances. Common documents include a SOC 2 Type II report, HITRUST certification, penetration test summaries, and a recent third-party security assessment. Review the scope carefully, because a report covering only part of the product does not prove the whole product is secure.<\/span><\/p>\n<h3><b>Vulnerability management and incident response<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">How are vulnerabilities found and patched, and how quickly?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Does the vendor have a documented incident response plan that is tested?<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">What are the response and notification commitments in the contract?<\/span><\/li>\n<\/ul>\n<h3><b>Mobile and device security<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Most scribes run on phones and tablets. Ask whether the app stores audio locally before upload, whether it is protected if a device is lost, and whether you can wipe it remotely. Your own device management policies matter just as much as the vendor&#8217;s controls.<\/span><\/p>\n<h2><b>Question Set 5: Accuracy, Safety, and Clinical Oversight<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Privacy and accuracy are linked. An AI scribe that records a visit perfectly but writes the wrong medication into the note has still harmed the patient.<\/span><\/p>\n<h3><b>How accurate is the tool in real conditions?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Ask for independent performance data rather than marketing claims. Accents, background noise, overlapping voices, and specialty terminology can degrade results. Run a pilot with real visits in your own environment.<\/span><\/p>\n<h3><b>How does the clinician review the note?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Every note should be reviewed and approved by the provider before it enters the record. Establish a clear expectation that a signature means the provider verified the content. Train clinicians to look for omissions, wrong laterality, medication errors, and statements that were never actually said.<\/span><\/p>\n<h3><b>What happens when the AI makes a mistake?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Understand how errors are reported, how quickly the vendor responds, and whether corrections feed back into improvements. Also ask whether the system shows its source, such as linking sentences back to the transcript, so reviews are faster and more reliable.<\/span><\/p>\n<h3><b>Does the AI do more than summarize?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Some products suggest diagnoses, orders, or billing codes. Features that influence clinical or financial decisions raise additional regulatory, liability, and compliance questions. Be deliberate about which features you turn on.<\/span><\/p>\n<p><span style=\"font-weight: 400\">For a broader look at where the technology helps and where it gets risky, these<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-use-cases-in-finance-healthcare-and-retail-that-are-delivering-real-business-impact\/\"> <span style=\"font-weight: 400\">healthcare AI use cases<\/span><\/a><span style=\"font-weight: 400\"> offer helpful context.<\/span><\/p>\n<h2><b>Question Set 6: Your Own Environment<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Even the best vendor cannot protect you from weaknesses in your own setup. Before deploying a scribe, look inward.<\/span><\/p>\n<h3><b>Is your network ready?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Exam rooms often rely on wireless connections shared with guests and medical devices. A recording tool that sends sensitive audio over a poorly segmented network is a risk. The concerns around a<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/the-patient-chart-is-digital-the-waiting-room-is-wireless-is-your-greenville-practice-actually-secure\/\"> <span style=\"font-weight: 400\">practice wireless security<\/span><\/a><span style=\"font-weight: 400\"> gap are especially relevant here.<\/span><\/p>\n<h3><b>Are your devices managed?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Know which phones, tablets, and laptops will run the scribe. Require screen locks, encryption, current operating systems, and the ability to wipe lost devices.<\/span><\/p>\n<h3><b>Are staff trained?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Employees need to know which tools are approved, how to handle patient consent, and what to do if something looks wrong. Email mistakes remain a major source of exposure, as explained in this look at<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/hipaa-violations-dont-always-come-from-hackers-sometimes-they-come-from-your-own-teams-inbox\/\"> <span style=\"font-weight: 400\">HIPAA inbox violations<\/span><\/a><span style=\"font-weight: 400\">.<\/span><\/p>\n<h3><b>Do you have an AI governance policy?<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Write down which AI tools are permitted, who approves new ones, what data may be entered, and how incidents are reported. A short, clear policy beats a long one nobody reads. Guidance on<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/how-to-secure-ai-for-your-business\/\"> <span style=\"font-weight: 400\">securing AI tools<\/span><\/a><span style=\"font-weight: 400\"> is a useful starting point for building one.<\/span><\/p>\n<h3><b>Watch for shadow tools<\/b><\/h3>\n<p><span style=\"font-weight: 400\">If an approved scribe is slow or hard to use, clinicians may turn to free consumer apps that offer no BAA and unknown data handling. That is one of the most common ways PHI escapes. Understanding<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/the-hidden-dangers-of-shadow-ai-tools-in-the-workplace-and-how-to-manage-them\/\"> <span style=\"font-weight: 400\">shadow AI risks<\/span><\/a><span style=\"font-weight: 400\"> helps you address demand with a safe, approved option instead of a ban that people quietly ignore. The same applies to general-purpose assistants, since<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-chatbots-at-work-where-the-line-between-helpful-and-risky-really-is\/\"> <span style=\"font-weight: 400\">AI chatbot risks<\/span><\/a><span style=\"font-weight: 400\"> increase when staff paste patient details into tools that were never vetted.<\/span><\/p>\n<h2><b>Vendor Due Diligence: A Practical Checklist<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Use this list during evaluation. Ask for written answers, and keep them with your compliance records.<\/span><\/p>\n<h3><b>Contract and legal<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Signed BAA covering subcontractors<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Clear breach notification timelines<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Reasonable liability and indemnification terms<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Evidence of cyber insurance<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Defined data return and deletion at termination<\/span><\/li>\n<\/ul>\n<h3><b>Data handling<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Documented retention periods for audio, transcripts, and notes<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Written no-training commitment, or a clear opt-out<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">U.S. data residency, if that matters to you<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Controlled and logged internal access<\/span><\/li>\n<\/ul>\n<h3><b>Security<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Encryption in transit and at rest<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Single sign-on and mandatory multi-factor authentication<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Role-based access and audit logs<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Current SOC 2 Type II or equivalent independent report<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Documented incident response and vulnerability management<\/span><\/li>\n<\/ul>\n<h3><b>Consent and workflow<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Built-in support for consent capture and easy opt-out<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Clear off switch for each visit<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Support for your state&#8217;s consent rules<\/span><\/li>\n<\/ul>\n<h3><b>Clinical quality<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Independent accuracy evidence and a pilot period<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Mandatory clinician review before notes enter the chart<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Transparent handling of errors<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">A systematic<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/what-vendor-risk-assessment-actually-looks-like-in-practice\/\"> <span style=\"font-weight: 400\">vendor risk assessment<\/span><\/a><span style=\"font-weight: 400\"> process turns this checklist into a repeatable habit instead of a one-time scramble.<\/span><\/p>\n<h2><b>Red Flags to Watch For<\/b><\/h2>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The vendor will not sign a BAA, or offers one that excludes key services<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Answers about subcontractors or data location are evasive<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Audio is retained indefinitely by default<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Customer data is used for training with no opt-out<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">No independent security report is available<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Multi-factor authentication is optional<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The sales team cannot explain how consent should work in your state<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The contract allows unilateral changes to data practices<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">There is no clear process to export and delete your data<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">Any one of these deserves a pause. Several together are a reason to walk away.<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-large wp-image-2038\" src=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-21-1024x535.png\" alt=\"\" width=\"1024\" height=\"535\" srcset=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-21-1024x535.png 1024w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-21-300x157.png 300w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-21-768x401.png 768w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/Copy-of-Copy-of-Copy-of-cmit-boise-featured-image-21.png 1200w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/p>\n<h2><b>Planning for the Worst Day<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Even careful organizations can face incidents. Having a plan ahead of time shortens the damage.<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Know who at the vendor to call, and how quickly they must respond<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Define internal roles for investigation, legal review, and patient communication<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Practice the plan at least annually<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Keep isolated, tested backups of your own records<\/span><\/li>\n<\/ul>\n<p><span style=\"font-weight: 400\">If a problem occurs, the first hours matter. The steps in this guide to<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ransomware-recovery-what-should-happen-in-the-first-hours-after-an-attack\/\"> <span style=\"font-weight: 400\">ransomware recovery steps<\/span><\/a><span style=\"font-weight: 400\"> and the guidance on<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/the-first-24-hours-after-a-data-breach-what-greenville-businesses-should-do\/\"> <span style=\"font-weight: 400\">data breach response<\/span><\/a><span style=\"font-weight: 400\"> apply directly to healthcare settings. Reliable<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/data-backup\/\"> <span style=\"font-weight: 400\">data backup<\/span><\/a><span style=\"font-weight: 400\"> also protects your ability to keep treating patients if systems are disrupted.<\/span><\/p>\n<h2><b>Building the Right Foundation<\/b><\/h2>\n<p><span style=\"font-weight: 400\">An AI scribe is only one layer of a healthcare security program. The stronger your foundation, the less any single new tool can hurt you.<\/span><\/p>\n<h3><b>Technology and infrastructure<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Well-governed<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/cloud-services\/\"> <span style=\"font-weight: 400\">cloud services<\/span><\/a><span style=\"font-weight: 400\"> reduce misconfigurations that expose PHI<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Disciplined<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/network-management\/\"> <span style=\"font-weight: 400\">network management<\/span><\/a><span style=\"font-weight: 400\"> separates clinical systems, guest traffic, and medical devices<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Secure<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/productivity-applications\/\"> <span style=\"font-weight: 400\">productivity applications<\/span><\/a><span style=\"font-weight: 400\"> protect the email and documents that surround patient care<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Protected<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/unified-communications\/\"> <span style=\"font-weight: 400\">unified communications<\/span><\/a><span style=\"font-weight: 400\"> safeguard voice and video, including telehealth<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Careful<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/it-procurement\/\"> <span style=\"font-weight: 400\">IT procurement<\/span><\/a><span style=\"font-weight: 400\"> ensures new devices arrive configured securely<\/span><\/li>\n<\/ul>\n<h3><b>Monitoring and compliance<\/b><\/h3>\n<ul>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Dedicated<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/it-service-cybersecurity\/\"> <span style=\"font-weight: 400\">cybersecurity services<\/span><\/a><span style=\"font-weight: 400\"> provide round-the-clock detection and response<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Ongoing<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/compliance\/\"> <span style=\"font-weight: 400\">compliance services<\/span><\/a><span style=\"font-weight: 400\"> help document safeguards and prepare for audits<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">The practice of<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/why-continuous-compliance-monitoring-is-becoming-critical-for-modern-businesses\/\"> <span style=\"font-weight: 400\">continuous compliance monitoring<\/span><\/a><span style=\"font-weight: 400\"> keeps evidence current instead of scrambling each year<\/span><\/li>\n<li style=\"font-weight: 400\"><span style=\"font-weight: 400\">Rising<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/why-cyber-insurance-providers-now-expect-stronger-it-security-before-approval\/\"> <span style=\"font-weight: 400\">cyber insurance expectations<\/span><\/a><span style=\"font-weight: 400\"> mean insurers may ask how you vet AI tools and handle patient data<\/span><\/li>\n<\/ul>\n<h3><b>Strategy and support<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Adopting AI is a strategic choice as much as a technical one. A practice should decide what problems it wants to solve, how it will measure success, and how it will manage risk. Reviewing an<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-readiness-for-business-is-your-it-environment-prepared-for-enterprise-ai\/\"> <span style=\"font-weight: 400\">AI readiness checklist<\/span><\/a><span style=\"font-weight: 400\"> before buying helps expose gaps in your environment. Leaders also benefit from understanding<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-in-the-workplace-what-business-owners-need-to-understand-right-now\/\"> <span style=\"font-weight: 400\">AI workplace oversight<\/span><\/a><span style=\"font-weight: 400\"> responsibilities, since decisions about these tools cannot be delegated entirely to vendors.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Ongoing<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/it-guidance\/\"> <span style=\"font-weight: 400\">IT guidance<\/span><\/a><span style=\"font-weight: 400\"> can help you weigh options, and consistent<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/managed-it-services\/\"> <span style=\"font-weight: 400\">managed IT services<\/span><\/a><span style=\"font-weight: 400\"> keep devices patched and standardized. A responsive<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/it-support\/\"> <span style=\"font-weight: 400\">IT support team<\/span><\/a><span style=\"font-weight: 400\"> helps clinicians who hit problems get back to patients quickly, which reduces the temptation to use unapproved workarounds. Predictable<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/packages\/\"> <span style=\"font-weight: 400\">service packages<\/span><\/a><span style=\"font-weight: 400\"> make it easier to budget for all of it.<\/span><\/p>\n<h2><b>A Sensible Rollout Plan<\/b><\/h2>\n<p><span style=\"font-weight: 400\">Rushing a full deployment is the fastest way to create problems. A phased approach works better.<\/span><\/p>\n<h3><b>Step 1: Define the goal<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Decide what you want, such as less after-hours charting, faster note completion, or improved patient engagement. Specific goals make vendor comparisons easier.<\/span><\/p>\n<h3><b>Step 2: Review and shortlist vendors<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Use the checklist above. Eliminate vendors that fail on contract basics.<\/span><\/p>\n<h3><b>Step 3: Involve compliance and legal early<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Have counsel review the BAA, the consent approach, and your state&#8217;s recording rules before a pilot starts.<\/span><\/p>\n<h3><b>Step 4: Pilot with a small group<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Choose a few willing clinicians, set clear success measures, and watch for accuracy issues, workflow friction, and patient reactions.<\/span><\/p>\n<h3><b>Step 5: Train and communicate<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Teach staff how to use the tool, how to obtain consent, and how to review notes. Update your privacy notice and patient-facing materials.<\/span><\/p>\n<h3><b>Step 6: Expand carefully<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Add users gradually, review audit logs regularly, and revisit the vendor&#8217;s security evidence at least once a year.<\/span><\/p>\n<h3><b>Step 7: Keep reassessing<\/b><\/h3>\n<p><span style=\"font-weight: 400\">Tools change quickly. Vendors update models, change subprocessors, and revise terms. Schedule periodic reviews so your protections keep pace.<\/span><\/p>\n<h2><b>Conclusion: Say Yes to the Technology, Not to the Unknowns<\/b><\/h2>\n<p><span style=\"font-weight: 400\">AI scribes can give clinicians back time and give patients more attention during visits. That is a real benefit worth pursuing. But a recording of a medical visit is some of the most sensitive data your practice will ever handle, and the decision to send it to a third party should never rest on a polished demo.<\/span><\/p>\n<p><span style=\"font-weight: 400\">Ask about the BAA and subcontractors. Pin down what is stored and for how long. Confirm your state&#8217;s consent rules. Verify the security controls with evidence. Keep clinicians responsible for the final note. And strengthen your own environment so a new tool lands on solid ground. A vendor worth trusting will welcome these questions.<\/span><\/p>\n<p><span style=\"font-weight: 400\">If you want a second set of eyes before you sign, the team at CMIT Solutions of Greenville can review your environment, help you evaluate vendors, and build a practical plan for adopting AI safely. You can also explore the full range of support on the<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/\"> <span style=\"font-weight: 400\">Greenville IT provider<\/span><\/a><span style=\"font-weight: 400\"> homepage, or<\/span><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/contact-us\/\"> <span style=\"font-weight: 400\">schedule a consultation<\/span><\/a><span style=\"font-weight: 400\"> to get started.<\/span><\/p>\n<div style=\"width: 100%;background: #f4f8fa;padding: 60px 20px;font-family: Segoe UI,Arial,sans-serif\">\n<h2 style=\"text-align: center;color: #000;font-size: 40px;line-height: 1.2;font-weight: 800;margin: 0 0 45px\">Frequently Asked Questions<\/h2>\n<div style=\"width: 100%;max-width: 1100px;margin: 0 auto\">\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">1. Do AI scribes violate HIPAA?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Not inherently. A scribe can be used in a HIPAA-compliant way when the vendor signs a BAA, safeguards PHI appropriately, and your practice follows its own policies. Compliance depends on how the tool is configured, contracted, and used.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">2. Do I need a BAA with an AI scribe vendor?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Yes. A vendor that handles PHI on your behalf is a business associate, and a BAA is required before any patient information is shared. Make sure it addresses subcontractors, too.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">3. Does HIPAA require patient consent for an AI scribe?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">HIPAA generally does not require a separate signed consent for use in treatment and operations, but state recording laws may require patient consent. Check your state\u2019s rules and your own privacy notice with counsel.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">4. Which states require all-party consent to record?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Several states, including California, Illinois, Florida, Pennsylvania, and Washington, are commonly cited as all-party consent jurisdictions. The list and its nuances change, so verify current law for every state where you see patients.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">5. What about South Carolina?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">South Carolina is generally treated as a one-party consent state, but confirm the current statute with your attorney, especially for telehealth visits where the patient may be located elsewhere.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">6. Is the audio recording stored?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">It depends on the vendor. Some delete audio quickly after producing a note. Others keep it for weeks or longer. Ask for specific retention periods and request the shortest period that meets your needs.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">7. Can the vendor use patient data to train its AI?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Some can unless the contract says otherwise. Ask for a written commitment that your data will not be used for training, or understand exactly how de-identified data may be used.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">8. What security certifications should I look for?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">A current SOC 2 Type II report is a common baseline. HITRUST certification and recent penetration test summaries add confidence. Always review the scope, since a certification may not cover every part of the product.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">9. Are AI-generated notes always accurate?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">No. They can omit details, misattribute statements, or include errors. Clinicians must review and approve every note before it is added to the record.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">10. Who is responsible if the AI note is wrong?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">The provider who signs the note remains responsible for its accuracy. That is why review workflows and training are essential, and why liability terms in the vendor contract deserve attention.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">11. What is a subcontractor, and why does it matter?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Many scribe vendors use outside companies for transcription, AI models, or cloud hosting. Those subcontractors may handle PHI, so the BAA should extend HIPAA obligations to them, and you should know who they are.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">12. Should patients be able to opt out?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Yes. A good workflow lets patients decline easily and lets clinicians turn the tool off for any visit without penalty or friction.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">13. How do I handle telehealth visits?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Telehealth can involve patients in different states, which complicates consent. Many practices apply the strictest standard to all virtual visits and document consent at the start of each one.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">14. What happens to my data if I cancel?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">It depends on the contract. Require data return in usable formats and written certification of deletion, including backups and subcontractor copies, within a defined timeframe.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">15. What if clinicians already use free AI tools?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">That is a serious risk, because free tools often lack a BAA and clear data protections. Offer an approved alternative, set a clear policy, train staff, and monitor for unapproved use.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">16. Do I need to update my notice of privacy practices?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Possibly. Review whether your notice accurately reflects how you use AI tools and recordings. Your counsel can advise on whether updates or additional patient communications are appropriate.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">17. Will the proposed HIPAA Security Rule changes affect AI scribes?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">They could, indirectly. The proposed rule would strengthen requirements for encryption, authentication, risk analysis, and business associate verification. Final action was reported delayed toward mid-2027, but choosing vendors that already meet higher standards is wise.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">18. How should I test a scribe before rolling it out?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Run a limited pilot with real visits, a small group of clinicians, and defined measures for accuracy, time saved, and patient reactions. Review audit logs and security documentation during the pilot.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">19. How often should I reassess my AI scribe vendor?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">At least annually, and whenever the vendor changes subprocessors, terms, or major features. Request updated security reports at each renewal.<\/div>\n<\/details>\n<details style=\"width: 100%;background: #fff;border-radius: 14px;margin: 0 0 18px;padding: 0 28px;overflow: hidden\">\n<summary style=\"cursor: pointer;position: relative;padding: 24px 48px 24px 0;font-size: 19px;line-height: 1.5;font-weight: 600;color: #111\">20. Can a managed IT provider help with this?<span style=\"position: absolute;right: 0;color: #f46048;font-size: 28px;line-height: 1;font-weight: bold\">+<\/span><\/summary>\n<div style=\"padding: 0 0 24px;color: #444;font-size: 16px;line-height: 1.7\">Yes. A qualified provider can help evaluate vendors, secure devices and networks, configure access controls, support compliance documentation, and monitor for threats, while your legal counsel handles contract and regulatory interpretation.<\/div>\n<\/details>\n<\/div>\n<\/div>\n<p><a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/contact-us\/\"><img decoding=\"async\" class=\"aligncenter size-large wp-image-1328\" src=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/06\/WhatsApp-Image-2026-06-03-at-5.38.56-PM-1-1024x341.jpeg\" alt=\"Hero banner for CMIT Solutions: bold white text &apos;Secure. Supported. Future-Ready.&apos; on a blue gradient background with a tilted IT scorecard and CMIT logo to the right; subtitle reads &apos;Serving Greenville &amp; the Upstate of South Carolina.&apos;\" width=\"1024\" height=\"341\" srcset=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/06\/WhatsApp-Image-2026-06-03-at-5.38.56-PM-1-1024x341.jpeg 1024w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/06\/WhatsApp-Image-2026-06-03-at-5.38.56-PM-1-300x100.jpeg 300w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/06\/WhatsApp-Image-2026-06-03-at-5.38.56-PM-1-768x256.jpeg 768w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/06\/WhatsApp-Image-2026-06-03-at-5.38.56-PM-1-1536x512.jpeg 1536w, https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/06\/WhatsApp-Image-2026-06-03-at-5.38.56-PM-1.jpeg 1600w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Clinicians are exhausted by documentation. Hours that should go to patients disappear&#8230;<\/p>\n","protected":false},"author":212,"featured_media":2033,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[26,46,90,79,39,19,27,31,75,69],"class_list":["post-2032","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-local-it","tag-24-7-it-support-greenville","tag-ai-cyber-threats-for-smbs","tag-anaged-service-providers-near-me-cmit-solutions-of-greenville","tag-best-managed-it-service-providers-cmit-solution-greenville","tag-cmit-greenville","tag-cybersecurity-services-greenville","tag-cybersecurity-solutions-for-businesses-in-greenville","tag-data-backup-and-disaster-recovery-greenville","tag-it-managed-service-provider-cmit-solution-greenville","tag-managed-network-service-providers-cmit-solution-greenville"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO Pro 5.0.5 - aioseo.com -->\n\t<meta name=\"description\" content=\"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract.\" \/>\n\t<meta name=\"robots\" content=\"max-image-preview:large\" \/>\n\t<meta name=\"author\" content=\"jboyette\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO Pro (AIOSEO) 5.0.5\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"Greenville, SC 1006 | CMIT Solutions\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville\" \/>\n\t\t<meta property=\"og:description\" content=\"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-11-06T15:12:01+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-11-07T15:22:10+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:title\" content=\"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville\" \/>\n\t\t<meta name=\"twitter:description\" content=\"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract.\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#blogposting\",\"name\":\"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville\",\"headline\":\"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign\",\"author\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/author\\\/jboyette\\\/#author\"},\"publisher\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/wp-content\\\/uploads\\\/sites\\\/157\\\/2026\\\/11\\\/01-1-6.png\",\"width\":1200,\"height\":627},\"datePublished\":\"2026-11-06T09:12:01-06:00\",\"dateModified\":\"2026-11-07T09:22:10-06:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#webpage\"},\"articleSection\":\"Local IT, 24\\\/7 IT Support Greenville, AI Cyber Threats for SMBs, anaged service providers near me \\u2013 CMIT Solutions of Greenville, best managed it service providers CMIT Solution Greenville, CMIT Greenville, Cybersecurity Services Greenville, Cybersecurity Solutions for Businesses in Greenville, Data Backup and Disaster Recovery Greenville, it managed service provider CMIT Solution Greenville, managed network service providers CMIT Solution Greenville\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"name\":\"Local IT\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"position\":2,\"name\":\"Local IT\",\"item\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/category\\\/local-it\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#listItem\",\"name\":\"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#listItem\",\"position\":3,\"name\":\"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/category\\\/local-it\\\/#listItem\",\"name\":\"Local IT\"}}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/#organization\",\"name\":\"CMIT Solutions Greenville\",\"description\":\"CMIT Solutions\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"http:\\\/\\\/cmitsolutions.com\\\/template\\\/wp-content\\\/uploads\\\/sites\\\/2\\\/2022\\\/09\\\/CMMIT-Solutions-Logo.png\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#organizationLogo\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/author\\\/jboyette\\\/#author\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/author\\\/jboyette\\\/\",\"name\":\"jboyette\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/65ff7f5686d31868616e4ac560e1f943071005e8e61dd7e9b410bb05798fa34b?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"jboyette\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#webpage\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/\",\"name\":\"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville\",\"description\":\"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/author\\\/jboyette\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/author\\\/jboyette\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/wp-content\\\/uploads\\\/sites\\\/157\\\/2026\\\/11\\\/01-1-6.png\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#mainImage\",\"width\":1200,\"height\":627},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/blog\\\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\\\/#mainImage\"},\"datePublished\":\"2026-11-06T09:12:01-06:00\",\"dateModified\":\"2026-11-07T09:22:10-06:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/#website\",\"url\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/\",\"name\":\"CMIT Solutions Greenville\",\"description\":\"CMIT Solutions\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/cmitsolutions.com\\\/greenville-sc-1006\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO Pro -->\r\n\t\t<title>AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville<\/title>\n\n","aioseo_head_json":{"title":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville","description":"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract.","canonical_url":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#blogposting","name":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville","headline":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign","author":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/author\/jboyette\/#author"},"publisher":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/01-1-6.png","width":1200,"height":627},"datePublished":"2026-11-06T09:12:01-06:00","dateModified":"2026-11-07T09:22:10-06:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#webpage"},"isPartOf":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#webpage"},"articleSection":"Local IT, 24\/7 IT Support Greenville, AI Cyber Threats for SMBs, anaged service providers near me \u2013 CMIT Solutions of Greenville, best managed it service providers CMIT Solution Greenville, CMIT Greenville, Cybersecurity Services Greenville, Cybersecurity Solutions for Businesses in Greenville, Data Backup and Disaster Recovery Greenville, it managed service provider CMIT Solution Greenville, managed network service providers CMIT Solution Greenville"},{"@type":"BreadcrumbList","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/#listItem","position":1,"name":"Home","item":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/","nextItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/category\/local-it\/#listItem","name":"Local IT"}},{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/category\/local-it\/#listItem","position":2,"name":"Local IT","item":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/category\/local-it\/","nextItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#listItem","name":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign"},"previousItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#listItem","position":3,"name":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign","previousItem":{"@type":"ListItem","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/category\/local-it\/#listItem","name":"Local IT"}}]},{"@type":"Organization","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/#organization","name":"CMIT Solutions Greenville","description":"CMIT Solutions","url":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/","logo":{"@type":"ImageObject","url":"http:\/\/cmitsolutions.com\/template\/wp-content\/uploads\/sites\/2\/2022\/09\/CMMIT-Solutions-Logo.png","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#organizationLogo"},"image":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#organizationLogo"}},{"@type":"Person","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/author\/jboyette\/#author","url":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/author\/jboyette\/","name":"jboyette","image":{"@type":"ImageObject","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/65ff7f5686d31868616e4ac560e1f943071005e8e61dd7e9b410bb05798fa34b?s=96&d=mm&r=g","width":96,"height":96,"caption":"jboyette"}},{"@type":"WebPage","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#webpage","url":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/","name":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville","description":"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/#website"},"breadcrumb":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#breadcrumblist"},"author":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/author\/jboyette\/#author"},"creator":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/author\/jboyette\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-content\/uploads\/sites\/157\/2026\/11\/01-1-6.png","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#mainImage","width":1200,"height":627},"primaryImageOfPage":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/#mainImage"},"datePublished":"2026-11-06T09:12:01-06:00","dateModified":"2026-11-07T09:22:10-06:00"},{"@type":"WebSite","@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/#website","url":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/","name":"CMIT Solutions Greenville","description":"CMIT Solutions","inLanguage":"en-US","publisher":{"@id":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/#organization"}}]},"og:locale":"en_US","og:site_name":"Greenville, SC 1006 | CMIT Solutions","og:type":"article","og:title":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville","og:description":"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract.","og:url":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/","article:published_time":"2026-11-06T15:12:01+00:00","article:modified_time":"2026-11-07T15:22:10+00:00","twitter:card":"summary_large_image","twitter:title":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign | AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville","twitter:description":"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract."},"aioseo_meta_data":{"post_id":"2032","title":"#post_title #separator_sa AI Scribes in Healthcare: Privacy and Security Questions Before You Sign | CMIT Solutions of Greenville","description":"#post_excerptThinking about an AI medical scribe? Learn the HIPAA, consent, data retention, and security questions to ask every vendor before you sign a contract.","keywords":null,"keyphrases":{"focus":{"keyphrase":"","score":0,"analysis":{"keyphraseInTitle":{"score":0,"maxScore":9,"error":1}}},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"BlogPosting","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"seo_analyzer_scan_date":"2026-11-07 15:22:53","breadcrumb_settings":null,"limit_modified_date":false,"open_ai":null,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-11-07 15:12:01","updated":"2026-11-07 16:06:41","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/\" title=\"Home\">Home<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t<a href=\"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/category\/local-it\/\" title=\"Local IT\">Local IT<\/a>\n<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\tAI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign\n<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/"},{"label":"Local IT","link":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/category\/local-it\/"},{"label":"AI Scribes in Healthcare: Privacy and Security Questions to Ask Before You Sign","link":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/blog\/ai-scribes-in-healthcare-privacy-and-security-questions-to-ask-before-you-sign\/"}],"_links":{"self":[{"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/posts\/2032","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/users\/212"}],"replies":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/comments?post=2032"}],"version-history":[{"count":0,"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/posts\/2032\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/media\/2033"}],"wp:attachment":[{"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/media?parent=2032"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/categories?post=2032"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cmitsolutions.com\/greenville-sc-1006\/wp-json\/wp\/v2\/tags?post=2032"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}