An AI Scribe’s HIPAA Promise Ends Where Its Data Flow Does

Take one ordinary workflow: at 9:10 a.m., a clinician taps Record on a phone before a cardiology visit. The scribe captures the conversation, turns speech into a transcript, generates a draft note and sends that note into the electronic health record, or EHR.

That sequence is the audit target.

The procurement mistake is to inspect only the finished note. Protected health information may also exist in the raw audio, an interim transcript, a prompt assembled for a language model, application logs, support tickets and backups. Each copy can move through a different company under different terms.

A business associate agreement, or BAA, is a contract governing how a service provider handles protected health information for a HIPAA-covered organization. It is necessary for many cloud scribe deployments, but it is not a product certification and does not establish that every optional feature, model endpoint or subprocessor sits inside the contracted environment.

This is a procurement walkthrough, not legal or medical advice. The practical goal is narrower: produce a diagram and a set of written answers that let privacy, security, clinical and legal reviewers see what happens after the clinician taps Record.

Start with the data flow, not the HIPAA badge

Draw the 9:10 visit as a sequence of systems. Begin with the microphone and end only after the provider signs the note and the vendor’s retention period expires. For each handoff, record the legal entity receiving data, the data category it receives, the purpose, the storage region, the retention period and the contract that governs it.

The first transfer may run from a phone or workstation to the scribe vendor’s cloud. The vendor may then send audio to a speech-recognition service, pass the transcript to a separate model provider, store the generated note in its own database and transmit the result through an EHR interface. Monitoring services may receive metadata or content when an error occurs. Human reviewers may see excerpts during customer support or quality review.

Do not accept a diagram labeled only “AI processing.” Ask the vendor to distinguish four artifacts: raw audio, verbatim or normalized transcript, model input and generated clinical note. A normalized transcript may remove filler words or add speaker labels, while the model input may also include patient demographics, note templates, prior chart context or clinician instructions. Those transformations change both the sensitivity of the data and the number of places where it can persist.

For the cardiology visit, the useful document is a table with one row per transfer. “Audio goes to Vendor A under the BAA and is deleted after processing” is reviewable. “Data is handled securely” is not.

Match every recipient to a contract

The HIPAA Privacy Rule states at 45 CFR 164.502(e)(1) that a covered entity may allow a business associate to “create, receive, maintain, or transmit protected health information on the covered entity’s behalf” if it obtains satisfactory assurance that the business associate will appropriately safeguard the information. Those assurances are generally documented in the BAA, with required contract provisions described in 45 CFR 164.504(e).

The important verbs are create, receive, maintain and transmit. A model vendor that briefly receives a transcript for inference, meaning the calculation that produces an output from a trained model, is still in the data flow even if it says it does not retain the request. A storage or logging provider may maintain protected health information without participating in note generation.

Request the BAA before treating a vendor’s HIPAA page as evidence. Then compare its covered services with the order form, product name and deployment configuration. Large technology companies often limit BAAs to listed services or eligible configurations, so a general corporate BAA does not necessarily cover an experimental model endpoint, consumer account or optional analytics feature.

Next, obtain the subprocessor list. A subprocessor is another company hired to process customer data for the primary vendor. Check whether the list names the speech service, model host, cloud provider, monitoring stack and any human-review contractor implicated by the diagram. The primary vendor may manage those relationships as subcontractor arrangements rather than offering the hospital a direct BAA with each company, but procurement still needs written confirmation that downstream obligations apply.

Also inspect change control. A static subprocessor page can change after signing. The contract should say how the hospital is notified, how much notice it receives and what remedy exists if a new recipient creates an unacceptable data path. An email notification with no ability to object is visibility, not control.

Separate processing from product improvement

The most consequential sentence may sit in a privacy notice, data-use addendum or product-specific terms rather than the BAA: whether customer content can improve models.

“Improve the service” is too broad for approval. It can describe debugging a failed upload, evaluating note quality with human reviewers, tuning prompts, training a new speech model or incorporating examples into a general-purpose model. Those uses have different recipients and retention needs. Ask the vendor to map each purpose to each artifact.

For the 9:10 visit, procurement should be able to determine whether the audio trains speech recognition, whether the transcript enters evaluation datasets and whether the generated note is reviewed to adjust future outputs. An opt-out control must identify its scope. It may stop foundation-model training while leaving product analytics, abuse monitoring or manual quality review enabled.

HIPAA de-identification does not settle the entire question. A vendor may say it uses only de-identified data, but the hospital still needs to know which method is used, who performs the transformation, whether identifiable source data is retained and whether contracts allow the resulting material to support other customers. Data described as “anonymized” in marketing copy should not be assumed to meet HIPAA’s de-identification standard.

A workable term is specific: protected health information and customer content are used only to deliver, secure and support the contracted service, unless the provider gives separate written authorization for another defined use. Legal reviewers will decide the exact language. The engineering check is whether product settings and backend routing can honor it.

Test deletion as an operational control

Retention claims need a clock and a starting event. “Audio is not stored” could mean it stays in transient memory during processing, or it could mean a temporary object remains until an automated deletion job runs. “Deleted after note generation” leaves open what happens when generation fails, a user abandons the session or support preserves a copy to investigate an error.

Ask separately about audio, transcripts, prompts, outputs, logs and backups. Record the default period, the configurable minimum, who can change it and whether deletion propagates to subprocessors. Backup deletion may follow a different schedule from deletion in the live application, which is not automatically disqualifying but must be documented.

Then test the control. Use a synthetic visit containing no real patient data, delete it through the administrative interface and request evidence showing what disappeared from the user account, production storage and downstream systems. A deletion button proves that an interface exists. It does not prove that an audio object, model request log and support copy shared one deletion instruction.

The fallback matters too. If the scribe loses connectivity during the cardiology visit, determine whether audio remains encrypted on the phone, uploads later, or is discarded. If transcription fails after upload, determine whether staff can retrieve the recording, whether the system retries through another provider and whether that alternate route is covered by the same contractual controls.

Require receipts that match the workflow

A procurement packet should contain more than a security report. Request the current architecture diagram, BAA, subprocessor list, product-specific privacy terms, retention schedule and documentation for training controls. Add audit evidence for access, deletion and configuration changes.

Logs should show which user started the recording, which service processed it, whether a human accessed it, when the draft reached the EHR and when temporary artifacts were deleted. The log does not need to reproduce protected content to be useful; identifiers, timestamps, action types and system destinations can establish the chain while limiting another copy of the note.

Put these questions into the written review:

1. Which legal entity receives each artifact after Record is tapped, including during errors and support cases?
2. Which named services are covered by the BAA, and does that scope include every model endpoint and subprocessor in our configuration?
3. Can audio, transcripts, prompts or outputs be used for model training, evaluation, human review or product improvement, and which controls disable each use?
4. What starts each retention clock, how does deletion reach logs and backups, and what evidence can administrators export?
5. What data remains on the device during an outage, and does retry logic introduce another processor?
6. How are subprocessor changes announced, and can the provider reject a new data path or terminate without leaving retained copies behind?

If the answers cannot be attached to the data-flow table, the review is not complete. A verbal assurance from a sales call will not explain why a transcript appeared in a model provider’s log six months later.

Questions people ask

Does a

BAA make an AI medical scribe HIPAA compliant?

No single agreement certifies the product. A BAA can document required safeguards and permitted uses, but the provider must still confirm that the purchased service, configuration, model endpoints and downstream processors are covered and operated consistently with those terms.

Can a

HIPAA-covered scribe use patient data to train its models?

That depends on the contract, the role of the parties, the data involved and the stated purpose. Do not infer the answer from a HIPAA claim. Ask whether training, evaluation, prompt tuning and human quality review are separate uses, then require written terms and technical controls for each.

Is deleting the audio enough?

No. The transcript, model input, generated note, logs, support copies and backups may remain after the recording disappears. Procurement should obtain retention and deletion rules for every artifact and test the workflow with synthetic data.

What should a hospital ask for before a pilot?

Ask for a product-specific BAA, a data-flow diagram, the current subprocessor list, training and human-review terms, retention schedules and exportable audit logs. Run the 9:10 cardiology workflow with synthetic data, including a failed upload and deletion request, before allowing real patient information into the system.