You’ve seen the demo. The AI scribe listens to a visit and drafts a note in seconds, and your clinicians are already imagining shorter evenings. Then someone asks, “But what happens to the recording?” and the room goes quiet.
That’s the right question, and it’s one of ten worth asking before you sign anything. Below you’ll find those ten questions, grouped by the part of the practice they matter to, followed by a one-page checklist you can print and take to any vendor meeting. Use it with every company on your shortlist, including us.
First, three terms in plain English
- Covered entity: that’s your practice. HIPAA puts the primary responsibility on you.
- ePHI: electronic protected health information, such as a visit recording, a transcript or a drafted note.
- Business associate: a vendor that creates, receives, maintains or transmits ePHI for you. HHS guidance says this includes cloud providers that handle ePHI for a covered entity, and that they need a business associate agreement (BAA) even if they can’t read the data because it’s encrypted.
Two more things before the list. HIPAA doesn’t certify software, so a “HIPAA compliant” badge on a website is not a BAA and isn’t proof of anything on its own. And you still have your own job to do: HHS expects practices to run their own security risk analysis, which no vendor can do for you. For more on how we describe our own approach, see our HIPAA compliance page and our security and compliance page.
The ten questions below are best-practice suggestions based on public guidance and common vendor-vetting advice. They aren’t legal requirements, and your practice may want to add its own.
Part 1: What happens to the audio and the words?
Start here, because it’s the part clinicians and patients care about most.
- What exactly do you store, where, and for how long? Ask whether it’s the audio, the transcript, the draft note, or all three. Some tools keep recordings and some discard them once the note is drafted. Ask where the data lives and get the retention period in writing.
- Is our data used to train AI models, and can we opt out? You want a straight yes or no that matches the contract, not just the sales call. If the answer is “it depends,” ask what it depends on.
- Who can access our data, and can we see the activity? Look for individual logins, role-based access, and an audit log that shows who opened or changed what, and when. Also ask which vendor employees, if any, can view your recordings or notes, and under what circumstances.
Part 2: Can they back up what they say?
Good security claims should come with something you can check.
- Can we review a SOC 2 Type 2 report? This is an independent audit of how a vendor’s controls actually operated over a period of time. HIPAA doesn’t require it, but it’s a common way to test security claims. If a vendor doesn’t have one, ask what they can show you instead.
- How is data encrypted in transit and at rest? You don’t need a technical deep dive. You do need a direct answer for both situations.
- What is your breach notification timeline? Ask how soon you’ll hear about a suspected incident, and make sure the number is written into the BAA. HIPAA sets outer limits, but a contract can be stricter.
Part 3: What does the paperwork say?
This part is for whoever signs contracts, usually the owner or practice manager. Our article on vendor management for medical practices is a useful companion for keeping these agreements organized.
- Will you sign a BAA before any trial or pilot with real visits? If a vendor says to “just try it” and sort out the agreement later, pause. The BAA should come first.
- Which sub-processors touch our data, and are they covered? AI scribes often rely on cloud hosting and speech or language services from other companies. Ask for the list and confirm that each one handling ePHI is covered by a BAA down the chain.
- What happens to our data if we leave? Ask how you get your data back, in what format, how long it takes, and how and when the vendor deletes its copies. It’s far easier to settle this before you sign than on the way out. Our guide to medical records retention and secure destruction covers the record-keeping side.
Part 4: What happens in the exam room?
- How does the tool handle patient consent and clinician review? This one has four pieces:
- State recording rules. Recording a visit is governed by state law in addition to HIPAA. Commonly cited all-party consent states include California, Florida, Illinois, Maryland, Massachusetts, Pennsylvania and Washington, and some newer state rules address telling patients about AI documentation. Laws change, so check your state with your own counsel.
- Notice of Privacy Practices. Ask whether you should update yours to describe how the scribe is used.
- Opt-out. Can a patient say no, and can staff switch the scribe off for that visit without a fuss?
- Clinician review. Does the workflow have the clinician review and edit the draft before signing? The scribe drafts; the clinician is responsible for the note.
For consent scripts, templates and staff training, see our AI scribe rollout checklist for the first 30 days.
Five answers that should make you keep asking
- “Industry-standard security” with no detail behind it.
- “HIPAA certified” used as a selling point. There’s no official HIPAA certification for software.
- A BAA offered only “after the trial,” or not at all.
- Answers in the demo that don’t appear in the contract.
- No clear way for clinicians to review and edit drafts before they’re signed.
Your one-page printable checklist
Copy this into a document and mark each line “yes,” “no,” or “need it in writing.”
- ☐ Storage: What’s kept (audio, transcript, draft note), where, and for how long?
- ☐ Model training: Is our data used? Can we opt out, in the contract?
- ☐ Access: Individual logins, role limits, audit logs, and clear rules on vendor staff access?
- ☐ SOC 2 Type 2: Report available to review?
- ☐ Encryption: In transit and at rest?
- ☐ Breach notification: Timeline written into the BAA?
- ☐ BAA: Signed before any trial or pilot use?
- ☐ Sub-processors: Listed, and covered by BAAs?
- ☐ Exit: Data return format, timeline and deletion process explained?
- ☐ Patient-facing: State consent rules checked with counsel, Notice of Privacy Practices updated, opt-out available, clinician review before signing?
What to do after you’ve picked a vendor
Once your questions are answered, the next job is making sure the notes the scribe drafts hold up. Our guide to AI scribe notes and E/M coding shows how small practices stay accurate and audit-ready.
Not legal advice: this article is general information only. HIPAA and state laws vary and change, so confirm the details for your practice with your own attorney or compliance advisor. An AI scribe only drafts the note, and clinicians should review every draft before signing it.
Want to put these questions to us? MedTec AI is a cloud EHR for small and medium practices with an AI scribe built into the chart. Book a free 30-minute demo at medtec.ai, bring this checklist, and we’ll go through it together.