Updated July 2026 · 9 min read · ← All guides
Ambient AI scribes record real patient conversations to draft your notes. That convenience comes with real privacy obligations. Before you let any tool listen in the room, here are the consent, storage, and HIPAA questions to settle — in plain terms.
An ambient scribe is recording a conversation with a patient. Patients generally have a right to know that and to decline. Most organizations that deploy these tools build a consent step into the workflow — a verbal notice, a posted notice, or documented consent. Requirements vary by state, since some states have stricter recording-consent laws than others. The safe default is transparency: tell the patient an AI tool is helping you take notes, and honor a "no." Never record covertly.
Under HIPAA, a vendor that handles protected health information on your behalf is a business associate, and you (or your organization) need a business associate agreement with them. This is the contract that legally binds the vendor to safeguard the data. If a tool won't sign a BAA, that's a hard stop for clinical use. In a health system, legal and compliance handle this; if you're an independent clinician evaluating on your own, confirm the BAA exists before you record a single patient.
Ask exactly what happens to the audio and the transcript. Where is it stored? Is it encrypted in transit and at rest? How long is it retained, and can it be deleted? Some tools discard audio after generating the note; others retain it. Some may use de-identified data to improve their models — you should know whether that's happening and whether you can opt out. None of these questions is rude to ask; a serious vendor has clear answers.
| Question to ask the vendor | Why it matters |
|---|---|
| Will you sign a BAA? | Legal requirement for handling PHI |
| Is data encrypted in transit and at rest? | Baseline security expectation |
| How long is audio/transcript retained? | Limits exposure window |
| Is my data used to train models? | Controls secondary use of PHI |
| Can data be deleted on request? | Supports patient rights and cleanup |
Know when the microphone is active. Tools with always-on wake words raise the question of what gets captured between visits or during side conversations. Understand how to start and stop capture deliberately, and make sure it isn't recording hallway conversations, other patients, or colleagues who haven't consented. The cleaner your control over when it listens, the smaller your risk.
One more responsibility that isn't strictly a privacy issue but belongs here: you verify and sign every note. An AI draft can hallucinate, mishear, or omit. Reviewing the note isn't just good documentation — it's part of protecting the patient whose data you just captured.
General information only, not legal or compliance advice. HIPAA and state recording laws vary and change; confirm current requirements with your organization's compliance team or a qualified professional.
Do patients have to consent to an AI scribe?
Generally yes — patients should be told an AI tool is recording and be able to decline. Requirements vary by state, and covert recording should never be done.
What is a business associate agreement?
It's the HIPAA contract binding a vendor that handles protected health information to safeguard it. A tool that won't sign a BAA shouldn't be used clinically.
Is my patient data used to train the AI?
It depends on the vendor. Ask directly whether your data is used for model training and whether you can opt out.
Get The ICU Notebook Newsletter
Clinical tools and career insights for ICU nurses. One email per week, no fluff.
Yes, send it freeNo spam. Unsubscribe any time.