AI scribes in clinics: questions to ask before you start

The short answer

No AI scribe is HIPAA compliant on its own. HHS does not certify software, so a "HIPAA certified" badge on a vendor's website tells you very little.

A clinic can use an AI scribe with patient visits when three things are in place. The vendor signs a Business Associate Agreement (BAA) that covers the exact plan you will use, including any trial. The tool goes into your HIPAA risk analysis like any other system that handles patient data. And the clinic runs the human side well: patients agree before recording starts, and a clinician reads and signs every note before it reaches the chart.

In California there is one more rule that matters from the first visit. Penal Code 632 requires the consent of everyone in a confidential conversation before it is recorded. In an exam room, that means the patient and anyone else whose voice will be picked up.

Why AI scribes need more care than most tools

An AI scribe listens to the visit, turns the audio into a transcript and drafts a clinical note. That is useful, and many clinicians like getting their evenings back. It also means the tool handles some of the most sensitive data a clinic has: a recording of a patient describing their health in their own words.

That recording, the transcript, the draft note and the logs are all protected health information. Each one may be stored by the vendor, passed to a speech or language model provider, and kept for longer than you expect. The questions below are about finding out where all of that goes before the first patient visit, not after.

Questions to ask about the contract

1. Will you sign a BAA for the plan we will use, before any patient is recorded? That includes a free trial or pilot. A BAA offered only on a higher tier is a common trap. Our guide to which AI tools sign a BAA, and on which plan explains why the plan matters.
2. Is the BAA a signed agreement, or a clause in your terms of service? Ask for a countersigned copy and keep it on file.
3. Who are your subcontractors, and is each one bound by a BAA? Most scribes rely on a cloud host and an AI model provider. Ask for the list by name, and ask to be told before it changes.
4. How quickly will you tell us about a breach? Look for a set number of days in the agreement, rather than a general promise to follow the law.

Questions to ask about the data

1. What do you store, where, and for how long? Ask separately about audio, transcripts, draft notes, edits and logs. A good answer is specific, such as audio deleted once the note is signed.
2. Is any of our data used to train or improve a model, yours or a partner's? Ask for a written answer covering audio and note text, including any "de-identified" use, and ask whether it can be switched off.
3. Who at your company can listen to recordings or read notes, and is that access logged? You want access limited to named support roles, used only when you ask for help, and recorded in a log you can see.
4. What security evidence can you show? An independent audit report, multi-factor or single sign-on, and encryption in transit and at rest are reasonable things to ask for.

Questions to ask about patients and consent

1. How does the app handle consent? Recording should start only when the clinician presses start, pause should be one tap, and the app should not assume consent by default.
2. What happens to voices you were not meant to record? Companions, interpreters and staff are often in the room. Ask whether a segment can be deleted and whether the tool keeps voiceprints.
3. What do we tell patients? Prepare a short, plain script that explains the tool, says a clinician checks every note, and makes it easy to say no without any effect on care. Record the patient's answer in the chart each time.

Questions to ask about the clinical workflow

1. Can anything reach the chart, an order or a claim without a clinician signing? The answer should be no. Drafts, suggested codes and orders should all wait for a clinician, with the transcript available beside the draft.
2. How will clinicians check the drafts? AI scribes can mishear, miss things or add details that were never said. Agree how notes are reviewed and what to do when a draft is wrong. Human review is the control that protects the record.
3. Which accounts will staff sign in with? The scribe should use clinic accounts with company sign-in, not personal accounts on personal phones. Our post on personal vs business AI accounts covers why that matters.

Questions to ask about leaving

1. Can we export notes, transcripts and logs, and what happens to our data if we cancel? Ask for export in a standard format and written confirmation that patient data is returned or destroyed when the contract ends.

A simple way to start

1. Check what is already in use. Some clinicians may already be trying a scribe app on their own phone. Our guide to finding where your team's AI data is going explains how to look without blame.
2. Send the questions in writing. Keep the vendor's answers. They become part of your risk analysis.
3. Sign the BAA before the pilot. No real patient visit gets recorded until it is in place.
4. Pilot with a small group. Pick a few willing clinicians, use the consent script, and review a sample of notes against the visit.
5. Write the rules down. A short policy covers which scribe is approved, how consent is taken and recorded, and who reviews the notes.
6. Review it regularly. Vendors change features, model providers and terms. A quarterly check keeps the setup current.

An AI Safety Check shows which AI tools are already touching patient data in your clinic and ranks the gaps. A Safe AI Setup puts an approved scribe on clinic accounts with the right settings, consent steps and policy. Managed Safe AI keeps it in good order month by month as vendors change their plans and terms.

FAQs

Is an AI scribe HIPAA compliant?

No product is HIPAA compliant by itself, and HHS does not certify software. A clinic can use an AI scribe with patient data when the vendor signs a BAA covering the plan in use, the tool is in the clinic's risk analysis, and the clinic manages consent, access and clinician review.

Do patients in California have to agree to an AI scribe?

Yes. California Penal Code 632 requires the consent of all parties before a confidential conversation is recorded, and a clinical visit is a confidential conversation. Ask the patient, and anyone else whose voice will be recorded, before starting, and note their answer in the chart.

Is verbal consent enough, or do we need a signed form?

Guidance for California clinics, such as the California Telehealth Resource Center's 2026 consent guide, says clearly documented verbal consent at the start of the visit is generally sufficient for documentation use. Many practices also add a notice to intake paperwork. Confirm the approach with your own legal adviser.

Can an AI scribe be used during a free trial?

Only if the vendor's BAA covers the trial. If it does not, do not record real patient visits until a BAA is signed for the plan you are testing.

Do clinicians still need to review every note?

Yes. AI scribes can mishear, leave things out or add details that were never said. A clinician should read, correct and sign every note before it reaches the chart, and nothing should file automatically.

---

*This post is general information, not legal or compliance advice. HIPAA, California recording law and vendor terms can change, so check current requirements (we checked HHS guidance, California Penal Code 632 and the California Telehealth Resource Center's consent guide on 10 November 2026) and talk to your own legal or compliance adviser about your clinic's situation.*