BOLO Health Law, LLC | November 2, 2026 | Healthcare Transactions & Technology
Ambient artificial-intelligence scribes promise a practical benefit: a clinician can focus on the patient while software creates a draft note from the encounter. That promise has obvious appeal to a physician group facing documentation workload, hiring pressure, or after-hours charting. Yet the same tool may record a sensitive conversation, send it to a cloud vendor, call a separate model provider, integrate with an EHR, and produce language that looks more certain than the clinician’s actual assessment.
The legal question is not simply whether a product calls itself “HIPAA compliant.” It is whether the practice understands the data flows, has an appropriate agreement and security program, preserves clinical responsibility, and can still meet its obligations if the vendor is wrong or unavailable. This is a contract, privacy, patient-safety, and operational governance project, not merely a software purchase.
1. Draw the real data path before reading the sales brochure
Start at the examination room. Does a mobile phone capture the conversation? Is audio streamed continuously or stored locally first? Is the audio transmitted to a cloud transcription service, a separate large-language-model provider, or the scribe company’s own systems? Does the vendor keep raw audio after generating text? Can support staff or subcontractors open recordings? Where is the draft sent, and who approves it in the EHR?
A flow diagram should identify each party, application, transfer, storage location, administrative access path, retention period, and deletion mechanism. If a sales representative cannot explain whether the service retains audio for model improvement, the practice is missing material contract information. A vendor that does not retain raw audio may still process identifiable patient content in prompts, summaries, or logs.
The HHS Office for Civil Rights cloud guidance explains that a cloud provider that creates, receives, maintains, or transmits electronic protected health information on behalf of a covered entity generally acts as a business associate, including in situations where the provider stores encrypted information without the key. A contract slogan does not change the statutory analysis.
2. Determine which participants are business associates
A HIPAA-covered practice needs a business associate agreement (BAA) when the vendor performs covered functions involving protected health information on the practice’s behalf. HHS specifically identifies an independent medical transcriptionist and the vendor of a physician transcription app among common business-associate examples. The analysis extends through subcontractors that create, receive, maintain, or transmit PHI for the business associate.
A compliant BAA is not simply a confidentiality promise. Under HHS’s sample BAA guidance, the agreement must define permitted uses, appropriate safeguards, subcontractor restrictions, breach and incident reporting, access and amendment support, return or destruction terms, and other required elements. Review any separate software terms to be certain they do not grant rights inconsistent with the BAA.
A vendor might offer a BAA but also reserve broad rights to use customer “content” for benchmarking, human review, model training, or “service improvement.” Those phrases require scrutiny. Ask whether data are identifiable, whether any purported de-identification meets the applicable standard, and what rights the practice can actually restrict. Do not infer a universal permission to train models merely because a vendor is a business associate.
3. Recording notice and patient trust are separate decisions
HIPAA permits many treatment-related uses and disclosures without the written authorizations required for unrelated purposes. That does not mean every recording of an encounter is appropriate without an explanation. Audio recording may implicate state recording laws, professional obligations, facility rules, the nature of the conversation, and patient expectations. Telephone calls and in-person encounters may also present different facts.
A defensible rollout should decide how clinicians explain ambient documentation, whether a patient may decline the recording, and how staff will document and honor a decline. Patient-facing language should be plain: what is captured, what technology processes it, who can access it, how long raw audio is kept, and what happens if the patient opts out. Promising that “nothing is recorded” while audio is temporarily captured for processing would be misleading.
Special populations warrant additional attention. Behavioral-health information, psychotherapy notes, substance-use-disorder treatment records, minors’ information, and specially protected state-law information may present distinct constraints. A generic workflow designed for routine outpatient visits may not be suitable for every clinical service line.
4. Conduct a security risk analysis that includes the new tool
The HIPAA Security Rule risk-analysis guidance calls for assessment of threats and vulnerabilities affecting electronic PHI. Adding an AI scribe changes a practice’s system inventory, transmission routes, access privileges, and vendors. A security review should therefore cover that tool rather than rely solely on the EHR’s existing assessment.
Ask how the vendor authenticates accounts, protects provider credentials, logs administrative actions, separates tenant data, secures integrations, responds to incidents, backs up critical information, and tests its controls. Verify whether customer data can be downloaded in bulk and whether a stolen API token would give broad access. Document responsibility for security tasks instead of assuming the cloud vendor manages every risk.
Contracts should assign breach cooperation, notification timing, incident investigation, data retrieval, encryption expectations, and subcontractor controls. A vendor’s obligation to notify the practice should be fast enough to permit the practice to assess its own legal notification duties; a contractually stated response time is not necessarily identical to a statutory deadline.
5. Clinical review cannot be replaced by an attractive draft
AI scribes can misattribute a speaker’s words, omit important negatives, place an event in the wrong time frame, or insert a medically plausible but unspoken fact. A clinical note is not accurate simply because it is fluent. The practice needs a process in which the responsible clinician checks the history, examination, assessment, plan, orders, and medication statements before authentication.
Design the workflow so that unsigned drafts cannot silently become finalized notes. Maintain version history and identify material corrections. If an EHR integration automatically creates orders or other consequential clinical content, assess whether additional review and safeguards are needed. Create an escalation pathway for wrong-patient documents, unsafe summaries, systematic errors, and missing encounter content.
Federal health IT safety guidance is helpful here. The ONC SAFER Guides emphasize organizational responsibility, patient identification, system management, and safe use of AI-enabled functions. They are safety resources, not a blanket certification that any particular scribe is fit for clinical use. A practice still must decide what validation is appropriate for its environment.
6. Draft service-level obligations, not a vague performance promise
A master services agreement should describe what the system actually delivers: draft documentation, transcript, coding suggestions, EHR integration, encounter metadata, and support. Define uptime and recovery commitments, implementation milestones, customer acceptance, troubleshooting times, and which errors count as critical. Identify what happens when an integration changes or an EHR vendor updates an interface.
Payment terms deserve equal care. Is the practice paying by clinician seat, monthly active user, recording minute, encounter, or location? Does the vendor charge separately for implementation, data export, API calls, long audio, or training? Can unused seats be reduced? Does an annual agreement auto-renew before the practice can judge results? Include a meaningful right to terminate for unresolved security, safety, or performance issues.
The BAA and commercial agreement should operate together. For example, a standard services clause allowing the vendor to suspend all access over an invoice dispute may create patient-care and data-access problems. HHS cloud guidance discusses the importance of access to ePHI and reasonable continuity arrangements. Negotiate export and transition obligations before there is an emergency.
7. Decide whether and how model training may occur
A product may technically use “AI” in several different ways: a fixed speech-recognition engine, an external general-purpose model, a fine-tuned domain model, or a system that continually learns from customers. Do not assume all have the same data posture. The contract should state whether customer PHI, audio, drafts, or user corrections are retained for training, validation, or model-quality review; whether that use is permitted; who can change settings; and whether any opt-out survives vendor upgrades.
If the vendor proposes to use information outside services to the practice, analyze the separate legal basis for that use and whether the data would be de-identified under applicable requirements. A negotiated prohibition on identifiable training data may be the cleanest operational choice for some practices, but the correct answer depends on product architecture, intended services, and governing law.
Also ask whether the vendor can switch model providers without advance notice. Subprocessor changes can affect access, transfers, performance, and security. A written notification and objection process is more useful than finding out after the new model has processed thousands of encounters.
8. Separate clinical accuracy from billing and compliance claims
A note can be longer after AI processing without supporting a higher billing code. Documentation should describe services actually furnished and should not manufacture medical necessity, review of systems, time spent, or physical examination findings. If the product suggests ICD-10 or CPT codes, require clinical and coding validation. Do not allow marketing claims that the scribe “maximizes reimbursement” to override evidence-based billing practices.
Consider how auditors, peer reviewers, malpractice carriers, and regulators might evaluate the original encounter, clinician-edited note, version history, and vendor records. Define a retention policy consistent with patient-record requirements and legal holds. Document training so staff understand that a proposed AI summary is not a substitute for independent clinical judgment.
9. Pilot in a controlled environment and keep an exit route
An effective pilot has a small set of clinicians, specific encounter types, validated patient-identification controls, and measurable outcomes. Track clinician editing burden, error types, patient refusals, support tickets, retention behavior, and downstream coding effects. Audit a sample of signed notes against the encounter information available. Expand only after the practice can explain what risks it accepted and which controls worked.
The termination plan matters as much as implementation. Determine how to revoke tokens, remove integrations, export remaining drafts or recordings, confirm deletion, satisfy record-retention duties, and obtain cooperation after contract termination. Establish whether the vendor can return data in an intelligible, commonly usable format and whether charges apply. A practice should not lose access to patient information because its scribe subscription ends.
BOLO Health Law works with clinical practices and digital-health businesses on healthcare technology agreements, vendor governance, HIPAA contracting, and operational compliance. A pre-signature review can identify where a promising tool creates legal or clinical exposure that a standard order form does not address. Review related BOLO technology insights and request counsel.
General legal information only; not legal advice, medical advice, or a HIPAA compliance certification. Specific requirements depend on the provider, product architecture, patient information, applicable state law, and current regulations.