What to Ask Before an AI Scribe Hears a Session

The pitch for an AI scribe is easy to like: the software listens to the session, and a draft note is waiting before the next client walks in. For a therapist who documents at nine at night, that is not a gimmick — it is hours. But strip away the interface and what you are actually deciding is this: a company you found last month will receive a recording of everything said in your treatment room, by you, by your patients, and by their families, session after session. That makes the decision a vendor due-diligence problem before it is a productivity one. The good news is that the diligence is finite. A handful of questions — most of them answerable from the contract and the business associate agreement — separate vendors who have built for healthcare from vendors who have built a demo. This article walks through those questions and ends with the checklist to run before any real session is recorded.

Under every AI scribe is the same pipeline: audio is captured in the room or on the telehealth call, shipped to servers, transcribed, and run through a model that drafts a note, which then syncs to your documentation system. Each stage is a place where protected health information exists in a new copy — the raw audio, the transcript, the draft, and whatever logs the vendor keeps around them. Vetting the product means vetting that pipeline: who operates each stage, where the copies live, how long each copy survives, and who can listen. A vendor who can walk you through their own pipeline in those terms, unprompted, is telling you something as useful as any feature list.

Notice what this framing does to the sales conversation. Questions like “is it accurate?” and “does it integrate?” matter, but they are the questions every buyer asks and every demo is built to answer. The questions in the rest of this article are the ones the pipeline forces — and they are the ones where vendors genuinely differ.

HIPAA’s rules on this are not subtle. A vendor that creates, receives, maintains, or transmits protected health information on behalf of a covered entity is a business associate, and the Privacy Rule requires a written business associate agreement before that PHI flows. An AI scribe that receives session audio is squarely inside that definition. There is no trial exception, no “we only keep it briefly” exception, and no exception because the vendor markets itself as HIPAA compliant. If a real patient’s voice reaches the vendor’s servers before a BAA covering your account is signed, the practice — not just the vendor — has a problem.

The BAA is also more useful than most buyers treat it. The regulation at 45 CFR 164.504(e) dictates what the contract must contain, and each required provision maps to a question you would want answered anyway: the agreement must establish the permitted and required uses and disclosures of your PHI (so read what the vendor has permitted itself); it must require appropriate safeguards, including Security Rule compliance for electronic PHI; it must obligate the vendor to report non-permitted uses and disclosures, including breaches of unsecured PHI; it must ensure any subcontractor that touches your PHI agrees to the same restrictions; and at termination it must require the vendor to return or destroy the PHI where feasible. A vendor’s standard BAA, read against that list, is the fastest honest signal you will get about how seriously they take the obligation.

Two provisions deserve a slower read than the rest. The permitted-uses clause is where broad language hides: “to provide and improve the services” can mean routine quality assurance, or it can mean your sessions become training material — the next section takes that apart. And the subcontractor clause matters because an AI scribe is rarely one company: cloud hosting, a speech-to-text provider, and a model provider may each touch the audio or the transcript. You are entitled to know that chain exists and that every link in it is bound to the same restrictions the vendor accepted. Ask for the list of subcontractors that process your data, in writing.

This is the question that most cleanly separates vendors, and the one sales calls are least eager to answer plainly. Ask it in three parts, and require the answers in the contract rather than in an email: Is audio, transcript, or note content from our practice used to train, fine-tune, or improve your models or your subcontractors’ models? If yes, is that use something we can decline, and where is the opt-out recorded? And if the answer leans on the word “de-identified,” which de-identification standard do you apply, and where is that stated?

The de-identification follow-up matters because the word has a specific regulatory meaning that marketing copy borrows loosely. Under the Privacy Rule, health information is de-identified only by one of two methods: Safe Harbor, which removes eighteen categories of identifiers and requires that the entity has no actual knowledge the remaining data could identify someone, or Expert Determination, in which a qualified expert applies accepted statistical principles and documents that the re-identification risk is very small. A session transcript is dense with names, places, schools, employers, and family details, so genuinely de-identifying one is real work, not a checkbox. A vendor that says “we only train on de-identified data” should be able to say which method, applied by whom — and should be willing to write the claim into the agreement. If they will not, price the promise accordingly.

Every copy in the pipeline has a lifetime, and you want each one stated: how long raw audio survives after the note is drafted, how long transcripts and drafts are kept, what deletion on request actually removes (including backups, on whatever delay), and what happens to all of it at termination — which the BAA must already address through the return-or-destroy provision. Shorter retention is not automatically better for you; some practices want transcripts retained through an audit window. The point is that the number should be a decision you made, not a default you discovered later.

Then plan for the bad day while you are still choosing. Under the Breach Notification Rule, a business associate that discovers a breach of unsecured PHI must notify the covered entity without unreasonable delay and no later than 60 calendar days after discovery, and the practice must in turn notify affected individuals without unreasonable delay and no later than 60 days after the breach is treated as discovered. The trap is in the word “discovered.” If the vendor operates as your agent under the federal common law of agency, the rule imputes the vendor’s discovery to your practice — your notification clock can be running before any report reaches you, and a vendor report that lands on day 45 may leave you 15 days, not a fresh 60. Whether an AI scribe vendor is an agent or an independent contractor is a legal determination about the relationship, worth making with counsel before the pilot rather than during an incident. It is also why a short contractual reporting window — days, not weeks — is worth negotiating: it cannot move the statutory clock, but it gets you the facts while there is still time to act on them. While you are in that clause, check what the vendor commits to include in the report: whose information, what data types, and what they have done about it.

HIPAA governs what the vendor may do with the information; it does not settle whether you may record the conversation in the first place. That is state law, and it varies in a way that cannot be waved at: some states allow recording with one party’s consent, others require the consent of everyone being recorded, and a therapy session routinely includes voices beyond the patient — a parent in the room, a sibling in the background, a caregiver on a telehealth call. Verify your own state’s recording-consent law before the pilot, and if you treat across state lines by telehealth, verify for where the patient sits too. Your professional liability carrier and your state association are both reasonable places to start; the sales rep is not.

Beyond legality, there is the plainer standard: the people in the room should know what is happening. Pediatric caseloads add the questions that generic consent forms skip — who consents for a minor, how a teenager’s own assent is handled, what happens when the consenting parent is not the one who attends, and how a family revokes consent without it feeling like a confrontation. Get the revocation path into your workflow before anyone needs it: the schedule should show, before the session starts, that this client is not recorded. Consent language for recording is its own topic and deserves its own article; for vendor due diligence, the test is simpler — the vendor’s suggested consent language, if they offer any, should describe what their pipeline actually does, and nothing in their product should make honoring a “no” difficult.

CMS answered the accountability question for human scribes years ago, and the logic transfers cleanly. In its 2017 Program Integrity Manual update on scribe services, CMS said reviewers are only required to look for the signature of the treating clinician — the scribe need not sign — because the treating clinician’s signature affirms that the note adequately documents the care provided. Medicare’s general signature rule points the same way: services must be authenticated by the author, by handwritten or electronic signature. Swap the human scribe for a model and nothing about the responsibility moves. The AI drafted it; you authored it the moment you signed it.

The professional associations have landed in the same place. ASHA’s guidance on AI for communication sciences and disorders professionals treats generative AI as a support tool that is not a substitute for clinical reasoning, used in a way that safeguards client privacy. APTA published a practice advisory in 2025 specifically on AI-enabled ambient scribe technology, covering documentation responsibilities and the legal and regulatory considerations that come with it. For due diligence, this cashes out as a workflow requirement, not a slogan: the product must make the clinician review pass natural — drafts clearly marked as drafts, edits easy, sign-off deliberate rather than bulk — and your documentation policy should say in writing that the signing clinician verifies objective data, skilled-service language, and anything the model could have plausibly invented. What that review pass looks for is its own article; what matters when choosing a vendor is that the product assumes the review happens, rather than quietly encouraging you to skip it.

Every line below is written as a statement you can only make truthfully after doing the work — reading the clause, sending the question, or testing the behavior yourself. Run it per vendor, keep the answers in writing, and treat a line the vendor cannot satisfy as information, not as a negotiation failure. Most practices will finish this in a week of emails and one careful reading of the contract, which is cheap against what it protects.

Once the checklist passes, resist the caseload-wide switch. Run a bounded pilot: two or three clinicians, a defined set of consenting clients, a few weeks. Measure the thing the product promised — total time from session end to signed note, including the review pass, not just the drafting the demo showed. Some clinicians find the review of a machine draft slower than writing their own note for complex sessions and faster for routine ones; that split, mapped to your actual caseload, is the real ROI calculation. The pilot is also where the workflow questions on the checklist stop being hypothetical: you will find out quickly whether the revocation path works and whether sign-off is genuinely deliberate. A vendor confident in the product will welcome the structure; a vendor pushing for the annual all-seats contract before a pilot has told you their forecast of your second month.