AI Medical Scribe Security Checklist: 25 Questions Before Patient Audio Goes Live
AI medical scribe security comes down to four copies of each visit: the audio, the transcript, the draft note and the EHR write-back. Before go-live, get written answers on where each is processed and kept, which subcontractors touch it under a BAA, what the integration can write, and how patients are told. Here are the 25 questions to ask, with good answers and red flags for the ten that matter most.
S
Sofia Reyes
Head of Compliance
Nov 7, 2026
On this page
AI medical scribe security comes down to four places patient data lives: the visit audio, the transcript, the draft note and the EHR write-back. Before go-live, get written answers on where each one is processed, how long it is kept, which subcontractors touch it under a BAA, what the integration can write, and how patients are told.
Last verified: 7 November 2026, against the eCFR text of 45 CFR Parts 160 and 164 (current to 5 November 2026, via the official eCFR API), FDA's January 2026 CDS guidance and FAQ page, 18 U.S.C. 2511, Washington RCW 9.73.030, Florida Statutes 934.03 and HL7's SMART scopes page. California's statute site blocked our requests, so no California rule is described; no HHS guidance is quoted.
Figure 1. Each copy of the visit has its own location, retention setting and contract question.
How does an ambient AI scribe work, and where does PHI sit?
Most products follow four steps. In our fictional example, Dr. Emily Carter asks Adam Bailey if he is comfortable being recorded, opens an app on a clinic phone and talks with him for fifteen minutes. The draft is in the EHR before her next patient sits down.
Capture. A phone, tablet or exam-room device records or streams the conversation. The raw audio sits on the device until it uploads.
Transcription. Speech-to-text produces a transcript with speaker labels, in the vendor's cloud or on a subcontractor's speech engine.
Note generation. A language model drafts the note. When a vendor calls a third-party model provider, the transcript leaves the vendor too.
EHR write-back. The draft lands in the chart through an API, and the clinician edits and signs it. Both sides keep access tokens and logs.
Each copy is PHI on its own. Under 45 CFR 160.103, health information is information "whether oral or recorded in any form or medium" that a provider creates or receives about a person's health or care, so a recorded visit is squarely inside it. The audio also carries a voice, and Safe Harbor's list in 164.514(b)(2) includes "Biometric identifiers, including finger and voice prints." Remember that when a vendor says the data is de-identified.
Where do the HIPAA rules apply?
Briefly, since our HIPAA and AI guide covers the rules in full. A scribe vendor that receives visit audio on your behalf fits the business associate definition in 160.103, so it needs a BAA. The sibling BAA checklist for AI vendors goes clause by clause.
Three terms in 45 CFR 164.504(e)(2)(ii) matter most for scribes. Paragraph (D) requires the vendor to ensure subcontractors "agree to the same restrictions and conditions," which reaches the speech engine and model provider. Paragraph (C) requires reporting, including breaches under 164.410, which sets the business associate's deadline at "without unreasonable delay and in no case later than 60 calendar days after discovery." Paragraph (J) requires the vendor, at termination and if feasible, to "return or destroy" the PHI it still holds "in any form."
The Security Rule treats the scribe like any system. The risk analysis in 164.308(a)(1)(ii)(A) must be "an accurate and thorough assessment," so the scribe needs its own entry. Access control in 164.312(a)(1) covers "persons or software programs," including the integration writing to your EHR. Device and media controls in 164.310(d)(1) govern hardware with ePHI moving "into and out of a facility," which describes a clinic phone with cached audio.
One question belongs with your privacy officer and counsel. Under 164.501, a designated record set includes medical records "maintained by or for a covered health care provider" and records used "to make decisions about individuals." Whether a retained recording falls in that set affects what a patient can request, so settle it before go-live. For PHI detection and why redaction is not de-identification, see PHI in AI prompts.
Figure 2. Ask for the model provider by name, because a BAA with the vendor alone does not tell you who it is.
What are the 25 questions to ask an AI scribe vendor?
Send them before the demo and ask for written answers.
Data handling (questions 1 to 6)
Where is audio processed and stored, and in which regions?
Is audio deleted after transcription? If not, how long is it kept, and who can change that?
How long are transcripts and draft notes kept after signing?
Is our data used to train models, yours or your model provider's, and does the contract forbid it?
If you call data de-identified, which HIPAA method applies, and does it cover the audio?
Is data encrypted in transit and at rest, including the device cache?
Contract (questions 7 to 11)
Does your BAA cover this product, this plan and every feature we will use?
Which subcontractors touch PHI, including the speech engine and model provider, and are they under BAAs?
How fast will you report a breach, and is that sooner than the 60-day outer limit?
Which independent security reports can we read under NDA?
Will you notify us before adding or changing a subcontractor that handles PHI?
Access and identity (questions 12 to 15)
Do you support SSO with our identity provider, MFA and automatic deprovisioning?
Which of your staff can open audio or transcripts, why, and is each access logged?
What does the app store on the device, and can our device management wipe it?
Can the app run on personal phones, and can we switch that off?
EHR integration (questions 16 to 19)
Which scopes or API permissions does the integration request, and can it write anything besides a draft note?
Does it act as the signed-in clinician or a system account, and whose name is on the write?
Do your audit logs record every read and write, and can they stream to our SIEM?
When a note reaches the wrong patient, how is it found and corrected?
Accuracy and clinical safety (questions 20 to 22)
Must a clinician review and sign before anything enters the chart?
How do clinicians report omissions or invented findings, and how are fixes tracked?
What is your FDA regulatory position for each feature, in writing?
Patient consent and notice (questions 23 and 24)
How are patients told, and can they decline or pause recording mid-visit?
How does the workflow handle all-party consent states and telehealth across state lines?
Exit (question 25)
At termination, how do you return or destroy every copy, including backups and subcontractor copies, and will you certify it?
What does a good answer look like for the ten that matter most?
The answers are our assessment; tune them with your privacy officer.
Question
Why it matters
Good answer
Red flags
2. Audio retention
The richest copy, and the hardest to redact
Deleted after transcription, or a short window you set
"Kept to improve quality," no fixed period
4. Training use
Visit content could end up in a model
No training, in the contract
Opt-out buried in settings
5. De-identification
164.514(b) allows two methods only
Names Safe Harbor or Expert Determination and shows the work
"Anonymized" with no method; audio called de-identified
7. BAA scope
Coverage can stop at one plan or feature
Product, plan and features named in the BAA
A BAA offered for a different tier
8. Subcontractors
164.504(e)(2)(ii)(D) flows the terms down
A named list, each under a BAA with the vendor
"We use leading AI providers"
9. Breach timing
164.410 sets 60 calendar days as the outer limit
A shorter commitment and a named contact
Only "as required by law"
14. Device storage
Phones leave the building
Encrypted cache, purged after upload, remote wipe
Audio saved to the phone's own files
16. Write scopes
Integrations can change more than notes
Narrow scopes, draft notes only, tested in a sandbox
Wildcard access "for future features"
20. Human sign-off
The clinician owns the record
Nothing final without review and signature
Auto-filed notes
25. Exit
164.504(e)(2)(ii)(J) requires return or destruction if feasible
A dated plan covering backups and subcontractors, certified
"Deleted per our standard policy"
On scopes, HL7's SMART App Launch specification says clients "are encouraged to request only the scopes and permissions they need to function and avoid the use of wildcard scopes purely for the sake of convenience." In its syntax, patient/Observation.rs means patient-level read and search on observations, so the scope list shows what the integration asked for.
Is an AI scribe an FDA-regulated medical device?
We can't tell you, and neither can a blog post. Section 520(o) of the Federal Food, Drug, and Cosmetic Act excludes some software functions from the device definition. FDA's Clinical Decision Support Software guidance, issued 29 January 2026, explains four criteria that decision support must meet, all of them, to fall outside it. In that guidance and FDA's CDS FAQ page, current as of 29 June 2026, we found no mention of ambient scribes or note-generation tools.
Writing down what was said is a different question from suggesting a diagnosis or an order, because the CDS criteria turn on recommendations to a clinician. Get the vendor's position per feature, in writing, and have regulatory counsel read it.
Do patients have to consent to being recorded?
That depends on the state. A BAA can't settle it, since it binds the vendor, not the patient. Federal law, 18 U.S.C. 2511(2)(d), generally permits interception by a party to the conversation, or where "one of the parties to the communication has given prior consent," unless the purpose is criminal or tortious.
Some states require everyone's consent. Washington's RCW 9.73.030(1)(b) bars recording a private conversation "without first obtaining the consent of all the persons engaged in the conversation," and subsection (3) treats a recorded announcement to all parties as consent. Florida's 934.03(2)(d) makes interception lawful "when all of the parties to the communication have given prior consent." Both have definitions and exceptions we have not summarized. For every other state, and for telehealth across state lines, ask counsel.
A short script helps either way. Dr. Carter explains the tool, says she reviews every note, and tells Adam he can say no or pause it. She charts his answer.
What should you do now?
Inventory what is already in use. A department may be trialing a scribe app already, and clinicians may tidy notes in free tools.
Send the 25 questions before any demo, and score the answers.
Check BAA scope and subcontractors against the exact product and plan.
Add the scribe to your risk analysis, one entry per copy: device, vendor cloud, model provider, EHR.
Test the integration in a sandbox and record the scopes it holds.
Pilot in one clinic with a consent script agreed with counsel.
Review errors and retention monthly for the first quarter.
Figure 3. Step one finds the scribe apps nobody bought centrally.
What can software check, and what can't it?
No tool answers the vendor review for you. Retention, training, BAA scope and consent are contract and policy work, and the vendor must prove the scribe's security. Our limits: AccuroAI does not process audio, does not capture or inspect ambient recordings, and does not review the notes a scribe writes.
Software can watch the AI around the scribe. Dr. Carter pastes a long draft note into a personal chatbot to shorten it, and a resident screenshots the EHR to ask a free tool about a lab trend. Neither path goes through the scribe you vetted, and neither has a BAA.
How does AccuroAI help around the scribe?
AccuroAI recognizes 1,400+ AI tools in the browser and on managed devices, each with the signed-in account, personal or business, and the plan, so a scribe web app adopted by one department shows up next to the chat tools. Inline redaction runs 40+ classifiers in under 38 ms p99 before a paste is sent, and OCR reads text in screenshots so the same policies apply to images of the EHR. Policies can block uploads to personal accounts while the licensed tool keeps working.
Healthcare teams usually run AccuroAI on-prem or in their own cloud, so patient data stays inside their environment; for customers who choose AccuroAI-hosted deployment, AccuroAI signs a BAA. Whether a self-hosted deployment needs an agreement is a question for counsel. The healthcare page shows how it fits.
FAQ
Does an AI scribe vendor need a BAA?
Generally yes. A vendor that receives or stores visit audio, transcripts or notes for a covered entity fits the business associate definition in 45 CFR 160.103. Its BAA must flow down to subcontractors, such as a speech engine or model provider, and should name the product and plan you use.
How long should an AI scribe keep the audio?
Set it in the contract rather than accepting a default. A cautious answer is deletion right after transcription, or a short window you control. Make sure the period covers backups and subcontractors, and ask counsel whether retained audio belongs in your designated record set and which state retention laws apply.
Is an ambient AI scribe an FDA-regulated medical device?
It depends on what each feature does. FDA's January 2026 clinical decision support guidance explains which software functions fall outside the device definition, but we found no mention of ambient scribes in it or in FDA's CDS FAQ page. Ask the vendor for its regulatory position per feature, in writing, and have counsel review it.
Do patients have to consent to an AI scribe recording?
State law decides, and it varies. Federal law generally allows recording with one party's consent, while Washington and Florida statutes require the consent of all parties, with defined exceptions. Check every state where you see patients, including telehealth, with counsel, and give patients a plain way to decline or pause recording.
Can AccuroAI secure the scribe itself?
No. AccuroAI does not process audio or ambient recordings, and it does not inspect the notes a scribe produces. It covers the AI around the scribe: which AI tools are in use, pastes and screenshots headed to other AI tools, and uploads to personal accounts.
This checklist is security guidance, not legal advice; confirm with counsel how HIPAA, FDA rules and state recording laws apply to you.
To find the scribe apps and AI tools clinicians already use, see it on your own devices: a 72-hour pilot maps the AI already in use before any policy is enforced. Start a free pilot
