AI Scribes and HIPAA:Six Questions Before You Sign

Ambient AI scribes listen to a visit and draft the clinical note. Physicians like them because they give back time. They also put patient conversations, recordings and draft medical records into a vendor's hands. Before you sign, make sure you can answer these six questions.

1. Is there a business associate agreement?

A vendor that creates, receives, keeps or transmits protected health information for you is a business associate under HIPAA. You need a signed BAA before any patient data flows, and it should cover subcontractors, including the AI model provider behind the product.

2. Can the vendor train on your patients' data?

Read the data terms, not just the BAA. Find out whether recordings, transcripts or notes can be used to train or improve models, how long they are kept, and how you get them deleted.

3. How accurate is it on your notes?

Ask for testing results, then test it yourself on your own specialties before rollout. Agree who reviews each draft, and make the physician's sign-off the control that matters.

4. Are patients told, and do they consent to recording?

Decide how patients learn an AI scribe is in the room. Several states, including California and Illinois, require everyone's consent to record a conversation, so build consent into the workflow, not just the paperwork. California's AB 489, in effect since January 1, 2026, also targets AI that implies it is a licensed health professional.

5. Does it do more than write notes?

If the tool also suggests diagnoses, orders or codes, it may become a patient care decision support tool. Under the Section 1557 rule, covered providers must make reasonable efforts to find tools that use protected traits as inputs and reduce the risk of discrimination.

6. Is it in your security program?

Treat the scribe like any system holding PHI: include it in your HIPAA risk analysis, your access reviews, your logging and your incident response plan. If the vendor has a breach, you need to know quickly enough to meet your own notification duties.