PRIVACY / PRACTICAL GUIDE
Privacy questions for therapy AI scribes
A plain-language review of recordings, transcripts, vendors, BAAs, and data minimization.
Read the guide ↓Know exactly what is captured, transmitted, retained, reused, reviewed by humans, and deleted—and ensure the contract and configuration match.
Audio changes the risk picture
A recording can contain far more than the final note: identities, third parties, locations, trauma details, and incidental conversation. Ask whether raw audio is necessary and how quickly it can be deleted.
Check state recording and consent law with qualified counsel. HIPAA does not replace every other legal or ethical obligation.
Follow the entire vendor chain
Identify transcription, model, storage, analytics, support, and subprocessor services. Confirm which are included in the BAA and what configurations are required.
Ask whether data is used for model training, product improvement, or human review, and whether those uses can be disabled contractually and technically.
Compliance is a workflow, not a label
A product name, model name, or marketing page cannot make a healthcare workflow compliant by itself. The organization using the tool still has to determine whether HIPAA applies, understand what information enters the system, document permitted uses, configure access, train its workforce, and manage risk.
For a cloud service that creates, receives, maintains, or transmits electronic protected health information on behalf of a covered entity or business associate, HHS guidance centers the business associate agreement and the regulated organization’s own risk analysis. Those are operational responsibilities, not badges that can be inferred from a homepage.
- Identify the data before selecting the tool
- Confirm the contract and covered services
- Document access, retention, review, and incident handling
Keep the human decision visible
Generative output can be fluent and still be incomplete, outdated, or wrong. A useful implementation names who reviews the output, what they compare it against, which changes they must make, and where the approved final record lives.
Human review should be proportionate to the consequence of error. A draft staff announcement and a patient-specific clinical recommendation do not belong in the same review lane. High-consequence decisions require qualified professional judgment and authoritative sources.
Turn the idea into one bounded workflow.
Write the input, data, reviewer, source of truth, destination, failure consequence, and fallback on a single page.
Continue to the guide library ↗