AI Scribe Security: Audio, Retention and BAA Vendor Questions

Before signing for an AI scribe, ask where raw audio, transcripts, drafts and final notes go; how long each survives; who can access them; whether any data trains models; and how deletion is proved. Require a sub-processor list, breach-notice terms, a data processing agreement or business associate agreement where applicable, and a test of access and export controls.

The decisive answer is rarely “we are secure”. A practice needs a data-flow diagram, contract schedules, configurable retention settings and a demonstration using test data. Make the vendor answer for the exact plan and integration you will buy. A standalone recording app, an EHR-connected scribe and a team account can expose different data and permissions.

Follow me on Instagram@sagnikteaches

Trace every copy of one consultation

Begin with a single illustrative consultation and draw the journey: microphone, device or browser, transcription service, language model, scribe application, EHR, clinician export, support system and backups. Include the point where the clinician reviews the draft. A vendor may say it “does not store audio” while another service in the chain temporarily processes it. That could be legitimate, but the agreement needs to describe the processing and the deletion boundary. Ask which organisation is responsible for each step.

Connect on LinkedInSagnik Bhattacharya

Send the vendor a data inventory rather than a vague security questionnaire. List raw audio, streaming audio fragments, verbatim transcript, draft note, approved note, prompt and response logs, patient and clinician identifiers, support tickets, analytics and backups. For each, request storage location, processor, retention period, deletion trigger and export method. Do not accept one blanket “data retained for 30 days” answer unless it genuinely covers every item. A final clinical note may need to remain in the record while temporary audio should have a different life.

Subscribe on YouTube@sagnikteaches

An illustrative vendor response might say: “Audio is deleted after processing; notes remain until account closure.” The follow-up is precise: does processing end when transcription finishes or when the note is signed? Are audio fragments in error logs? How long do backups last? Can an administrator shorten note retention without deleting the EHR's authoritative copy? This is a better test than asking whether the vendor has a security certificate. The broader patient-data confidentiality checklist covers policy; this purchase needs a documented data path.

Ask for audio and deletion terms in writing

Question 1: Is audio recorded, streamed without persistence, or stored for review? Ask for the default and optional settings, and whether the answer differs between web, mobile and EHR integration. If a clinician pauses or restarts a session, are the fragments retained separately? If the microphone picks up a bystander, can that segment be removed before a note is saved? The practice needs a workflow for accidental capture, not an assurance that it never happens.

Question 2: What starts the retention clock? “After consultation” is ambiguous if the draft is edited for two days. State whether the trigger is recording end, transcript generation, note approval, account deletion or contract termination. Specify the number of days for each data class and who controls the setting. Ask whether support staff can extend it during a fault investigation and how that extension is approved. A setting shown in a demo should match the signed contract.

Published vendor answers show why the follow-ups matter. Freed's pricing FAQ says audio recordings are saved temporarily until note summaries and quality checks are complete, then deleted automatically: ask how long quality checks can take and whether a failed note extends that window. Dentally's clinical AI notes FAQ says audio is processed in real time and not stored, while transcripts stay in the note's audit trail for support and troubleshooting after the note is completed. Both are clear answers to different questions, and neither states a backup schedule. Enter each statement in the data inventory against the item it actually covers, and leave the other rows open until the vendor fills them.

Question 3: What does deletion mean technically? Ask whether copies are removed from active storage, search indexes, analytics stores, model-provider systems and backups; when each stage happens; and what evidence the vendor supplies. A reasonable deletion schedule may allow backups to age out, but the practice should know the maximum time and the access controls during that interval. Ask for a test account deletion report. If the vendor cannot evidence deletion, score that as unknown, not as a pass.

Question 4: How do we retrieve our notes if we leave? Request a structured export format, the time allowed after termination, support fees, handling of attachments and the deletion sequence after export. The practice must not depend on an expired subscription to reach its own clinical records. Test one exported note and one correction, including date, clinician and patient linkage. A PDF dump may be readable but harder to migrate or audit than a structured record. Where a BAA applies, compare its termination clause with HHS's sample provisions, which offer two routes: return or destroy all the information and keep no copies, or keep only what the vendor needs for its own management or legal duties and protect it for as long as it is held. Ask which route the vendor's agreement takes and what it keeps under the second.

Separate model training from service delivery

Question 5: Does the vendor or any model provider use identifiable or de-identified patient content to train, fine-tune, evaluate or benchmark models? Ask whether the default is opt-in or opt-out, whether the choice covers audio, transcript and notes, and whether it can be changed by a clinician or only a practice administrator. “We never sell your data” does not answer training or evaluation use. Require the contract to name permitted purposes and the controls that enforce them.

Question 6: What does “de-identified” mean in the vendor's process? Audio can contain names, unusual clinical histories or voices that make people recognisable. Ask what is removed, who checks the result, whether data is pooled with other customers and whether the practice can prohibit secondary use altogether. A clinician's free-text correction might also reintroduce identifiers. If the vendor cannot explain its de-identification process, do not treat the label as a privacy guarantee.

For an illustrative procurement test, a vendor's sales page says “your data is yours”, but the terms permit “service improvement” using uploaded content. The practice should ask for a contract clause that defines service improvement and excludes training or evaluation on its patient material unless separately authorised. If the vendor will not narrow the clause, record the risk and ask the qualified privacy adviser whether the proposed use is acceptable. Do not rely on a sales representative's spoken interpretation of the terms.

The same pattern appears in real answers. Dentally's FAQ says patient data from clinical AI notes is not used to train third-party AI models, then adds that limited data may be used under strict controls for support and product improvements. Jane's AI Scribe page says clinical data is never used to train AI models. The first answer leaves “product improvements” to define; the second is a broad promise to pin into the contract. Put the same follow-up to both kinds of vendor: which data, used by whom, for what purpose, and where is that written?

Identify the other companies in the chain

Question 7: Provide the current sub-processor list with each party's role, data categories, location and retention. Include transcription, model inference, hosting, telephony if relevant, analytics, support and logging. Ask how the vendor notifies the practice before adding or changing a sub-processor and whether the contract gives an objection route. A “cloud provider” entry without the service and data handled is not enough to assess the flow. For the level of detail to expect, Dentally's FAQ names AWS Bedrock as the route to its summarisation models and says the feature runs in the same AWS region as the rest of the platform.

Question 8: Which data can leave the agreed location, and through what support or failover arrangements? A regional hosting claim may describe the primary database while model processing, backups or support access happen elsewhere. Ask for a diagram that shows both storage and transient processing. For a practice buying across borders, have a privacy adviser assess the transfer mechanism and contract terms. This tutorial is a question list, not a substitute for jurisdiction-specific advice.

Question 9: Who can see a patient's session? Ask for clinician, assistant, administrator, vendor support and sub-processor roles. Require role-based access, individual accounts, multi-factor authentication, session timeout, access logs and a method to remove a departing clinician promptly. Test with two test clinicians: can one open the other's patient session without a legitimate reason? If shared templates require a team plan, confirm that sharing a template does not also share patient content.

An illustrative access failure looks small: a practice administrator invites a temporary locum and accidentally grants access to all historical notes. The scribe may have excellent encryption, yet the wrong role exposes material. Ask the vendor to demonstrate the least-privilege role, audit the invitation, revoke it and show that access ends immediately. Include mobile devices and cached exports in the test. The shared-template tutorial addresses the operational side; permissions must be reviewed separately.

Demand usable incident and contract clauses

Question 10: What events count as a security incident and what is the notice clock? Ask when the vendor informs the practice after discovery, what facts are included, how updates arrive, who contacts sub-processors and what support the practice receives for investigation. Avoid a contract that promises notice only after the vendor finishes its own investigation. The practice's legal adviser should check these terms against applicable duties and the organisation's response plan.

Question 11: What happens if the scribe produces a note for the wrong patient or the EHR write-back fails? These are information-integrity incidents even if no data leaks. Request event logs showing patient identifier, operator, timestamp, original draft, clinician edits, destination and write result. The system should make a failed write visible and avoid a misleading “saved” state. The note-error review checklist helps the clinician assess content; the vendor must provide the trace to investigate a system error.

Question 12: What independent assurance can be shared? Ask for the scope and dates of security audits, penetration tests and certifications, plus remediation of material findings. A certificate for the vendor's corporate office does not prove the scribe application and every integration are in scope. Ask whether a new model or hosting provider changes the assessment. Seek a contract commitment to notify customers of material changes and to preserve logs for an agreed period.

Question 13: Which legal agreement applies? For a workflow governed by HIPAA, the HHS guidance on cloud computing says a covered entity using a cloud service to create, receive, maintain or transmit electronic protected health information needs an appropriate business associate agreement, or BAA. It adds that a provider storing only encrypted data without the key is still a business associate, so “we cannot read your data” does not remove the need for the agreement. Check which plan carries the agreement too: Heidi's help centre lists an organisation-wide BAA among the features of its Enterprise team plan, so a smaller practice should ask which agreement covers its own plan. Elsewhere, the practice may need a data processing agreement, or DPA, with the required processing terms. The exact agreement depends on the practice and data flow. Have a qualified adviser review the executed document, including sub-processor and breach schedules, before any patient data is sent.

Question 14: What controls remain the practice's job? The vendor may secure its service while the clinic must manage devices, user access, patient notice, consent, clinician review and record retention. Ask for a shared-responsibility matrix. If a vendor claims the software makes every note “compliant”, ask which practice actions that claim assumes. An AI scribe is a draft-making aid; the clinician must review and correct its output. That clinical responsibility also affects what logs and draft history need to be available.

Score evidence, not the polish of the demo

Use a weighted sheet and set non-negotiable gates. Give each topic a score from 0 to 3: zero for no answer, one for a sales claim, two for a documented policy or contract clause, and three for a documented answer demonstrated in the proposed configuration. Multiply the score by a weight. A nice interface cannot compensate for an unsigned required agreement or an unknown audio retention period.

In an illustrative comparison, Vendor A scores 3, 3, 2, 2, 2 and 2 across the six rows, producing 15 + 15 + 8 + 8 + 6 + 4 = 56 weighted points out of a possible 69. Vendor B scores 2, 3, 3, 3, 1 and 3, producing 10 + 15 + 12 + 12 + 3 + 6 = 58. B's slight lead is not decisive if its incident clause remains vague. The practice should ask for a revised clause and retest the score, while any missing required BAA or DPA remains a stop gate regardless of total.

Keep a column for “not verified”. A security page may mention encryption, but the proposed integration could send a transcript through a separate service. Ask the supplier to name the exact plan, region, integration and model route in every answer. Send the completed sheet back for written confirmation, then file it with the contract and the practice's risk assessment. The medical-practice scribe comparison covers clinical fit and EHR choice; this sheet is the security gate before that purchase.

Prove the answer with a small test account

Run a demonstration with fabricated consultation content, never live patient information before approval. Create a test session, change a note, export it, revoke a user's access, request deletion and inspect the audit trail. Ask the supplier to show both application screens and any administrative evidence. Note the time each step takes and whether a practice administrator can do it without vendor support. A feature that requires a support ticket may be workable, but it must be represented accurately in the contract and workflow.

A second illustrative test uses an intentionally unusual phrase in a fabricated transcript. After the vendor confirms deletion, search the test workspace, exports, clinician account and available logs for that phrase. This cannot prove that every backup copy is gone, but it can catch an incomplete active-data deletion. The vendor should explain the remaining backup schedule in writing. Record the test date and configuration so future product changes can be compared with the approved state.

Ask for a support-access test as well. Create a fabricated note with a distinctive but harmless phrase, then open a support ticket that describes a formatting problem without giving the patient identifier. Does the support worker need explicit approval to view the note? Is access time-limited and logged? Can the practice see who opened it? A vendor that says support “may access data to resolve issues” should define how approval, access scope and termination work. If support is outsourced, that party belongs in the sub-processor list. If the vendor can diagnose most issues from technical logs without seeing clinical content, ask whether that is the default.

Include a model-change clause in the review. A scribe may move transcription or note generation to a new provider while retaining the same product name. Ask how much notice the practice receives, whether the new provider changes processing location or retention, and whether the practice can refuse a material change. The change should trigger a review of the data-flow diagram, agreement schedules and deletion test. An illustrative failure is a new feature that sends drafts to a secondary model for “quality improvement” even though the original contract allowed only primary note creation. The feature may be useful, but the practice must assess it before it is enabled.

Define the exact evidence packet to keep. It should contain the executed agreement, current sub-processor list, data-flow diagram, retention schedule, deletion and export results, role matrix, incident-notice clause, relevant assurance reports and the practice's own approval record. Put a review date on the packet. If the vendor changes a plan or integration, the packet shows which assumptions need reconfirmation. Do not accept a downloaded marketing PDF as a substitute for the executed terms. Assign one person to track contract notices so an update does not sit unread in a shared inbox.

Consider an illustrative two-clinician clinic with 18 consultations a day and a proposed 30-day raw-audio default. At 20 working days, that could leave audio from roughly 360 encounters available during a rolling month if every encounter is recorded. That number is a planning calculation, not a claim about any vendor. If clinicians only need the transcript long enough to review a note, ask whether the audio can be deleted sooner and whether any correction workflow requires it. The question turns a vague retention preference into a documented reason and a concrete setting to test.

Finally, link security review to clinical sign-off. Patient notice and consent, note accuracy, retention in the medical record, and escalation of a wrong-patient write need owners. One data-protection regulator's AI guidance says that in the vast majority of cases AI use involves processing likely to be high risk, which triggers a legal requirement for a data protection impact assessment, judged case by case; have the relevant lead determine the requirement for this deployment. If the vendor cannot answer the core questions with documents and a test, pause the purchase. The practice can still compare scribe features without exposing patient data while those gaps are resolved.

Security questions that survive the sales call

Is a claim of HIPAA compliance enough without a BAA?

No. For a covered workflow that requires a business associate agreement, obtain the signed BAA before sending patient information to the service. The agreement must cover the actual entity and services that create, receive, maintain or transmit protected information. A website badge or sales email is not the contract.

Does deleting the audio delete the generated note?

Not necessarily. Ask for separate retention periods and deletion steps for raw audio, transcripts, drafts, final notes, prompts, logs, backups and support copies. Have the vendor demonstrate what disappears from a test account and explain what remains for security or legal purposes.

Can a practice accept a vendor's standard retention setting?

Only after the practice checks it against its records policy, clinical workflow and applicable obligations. A default can be too long for raw audio or too short for information the clinician needs to review. Document the agreed setting, who may change it and how deletion is verified.

Further reads

• ChatGPT for Medical Notes: A Safe Drafting Workflow for Small Practices — Separate approved scribing from ad hoc note drafting.
• How to Roll Out an AI Scribe Without Losing Patient Trust — Plan patient communication and opt-out routes.
• Is an AI Scribe Worth It for a Small Private Clinic? — Assess the operational value after the security gate.
• AI Medical Transcription Services vs Human Transcribers for Small Clinics — Compare the data path for different documentation methods.
• AI Dictation Software for Doctors: Dictation or Ambient Notes? — Dictation or an ambient scribe? Running cost per clinician, which consultations suit each, and a two-week trial a small practice can run.
• AI Medical Coding Software: Audit Trails and Upcoding Risk — Suggest or submit? Who signs, what the audit trail must record, how to spot upcoding drift and what to test on 100 old charts.
• AI Platform for Doctors: One Suite or Separate Scribe and Phone Tools? — A buying rule for small practices: when one suite wins, when separate scribe and phone tools win, and the integration test to run first.
• AI Receptionist for a GP Surgery: The 8am Rush and Hand-Offs — A practical overflow test and clinical hand-off plan for a surgery considering an AI phone receptionist.
• AI Scribe for Dentists: Will It Write Back to Your Software? — A dental scribe comparison that starts with the saved clinical note, not a vendor integration badge.
• AI Scribe for Psychologists: Notes, Reports and Consent Checks — Session notes and assessment reports need different things from a scribe. Consent wording, storage checks and four tools compared for psychologists.
• AI Scribe for an NHS Practice: Registry, DTAC and DPIA Checklist — NHS England's guidance turned into a practice checklist: registry, clinical safety officer, DCB0160, DPIA, DTAC, EPR write-back and a time-limited pilot.
• AI Software for Chiropractors: A Data Export Checklist Before You Switch — A chiropractic clinic's checklist for leaving or joining a practice system: export formats, notes ownership, exit terms, a migration test and a cut-over plan.
• Assisted Living Software: AI Features to Ask For on a Demo — A demo checklist for assisted living operators: which AI features are real, what to ask for, and how to score two vendors side by side.
• Best AI Note Taker for Therapists: Recording or Dictation Style? — Ambient recording or post-session dictation? A therapist's guide to SimplePractice, Jane, Carepatron, Heidi and Freed, with consent wording.
• AI Tools and AI Development: The Complete 2026 Guide — the AI hub, including every tutorial in the AI-for-business series.

Sources: HHS, Guidance on HIPAA and Cloud Computing; HHS, Sample Business Associate Agreement Provisions; ICO, Guidance on AI and data protection (archived copy of 21 September 2026, live page behind a bot check); Freed pricing page FAQ; Dentally Help Centre, Clinical AI notes FAQs; Jane AI Scribe page; Heidi help centre, Heidi Teams article (vendor answers quoted as examples, not as a universal standard). Checked 4 November 2026.