What happens to your notes? Honest answers about AI Charting and patient data

Protecting patient information is a habit built into clinical practice. It shows up in how EHR access is logged, how hallway conversations are handled, and how patients are verified before information is shared over the phone. Patient privacy and safety have always been a top priority, and that standard applies to an AI scribe as well. Applying it raises practical questions about where the audio from a session goes, who can access it, and how long it is kept. This article covers how patient data, including your notes, is handled, and what to ask before you adopt a tool. 

What patients think about AI scribes and privacy

AI scribes are still new, but early research offers insight into what makes patients comfortable with one in their visit.

Patients are more accepting when they understand the tool

In an early 2024 UC Davis Health survey taken before an AI Scribe rollout, most patients were positive or neutral about the tool. Note accuracy was the most common concern, notably ahead of privacy and being recorded. UC Davis leaders say patient education shaped how the tool was received. Their takeaway was that patients who trust their clinician and understand why the tool is used tend to accept it. 

Transparency builds trust

A 2026 evidence synthesis on patient and caregiver perspectives found that trust and acceptance are shaped by three things: transparency, consent, and clinician oversight. In practice, that means patients respond to being told what the tool is, being asked whether they are comfortable with it, and knowing a clinician still stands behind the note.

What this means for your practice

Patient concerns about AI scribes are specific, which makes them addressable. Patients want to know that the note is accurate and that their information is handled with care. As the clinician, you can address these concerns: you review every note, and here is where the audio goes. Patients who hear that up front are likely to feel more comfortable speaking openly, which supports a good history. How you introduce an AI scribe is part of the visit, and the sections below cover what to ask vendors and what to tell patients.

What happens to patient data when you use an AI scribe?

Quick answer: With an AI scribe, audio is processed by a vendor, a draft note is returned for your review, and the recording is either kept or deleted depending on that vendor’s policy. Retention, storage location, and training use differ from product to product, so confirm each one in writing before you adopt a tool.

7 questions to ask any AI Scribe vendor about data security

1. Will you sign a business associate agreement (BAA)? This is the baseline for any tool that handles protected health information.
2. Where is patient data processed and stored? Ask where the servers are located and whether patient data stays in the US.
3. How long are recordings and transcripts kept? Get a specific number of days, and ask what happens to the transcript once the note is final.
4. Is patient data used to train models? This answer should be in the contract, not just on the website.
5. Who can access the data, and is that access logged? AI activity should be auditable the same way other record access is.
6. Does anyone else touch the data? Ask which outside companies, such as cloud hosts or AI model providers, handle the audio or notes, and how you’ll be notified if that changes. 
7. Can I check the draft against the source? You should be able to compare the note with the transcript or audio before it enters the record.

Written answers to these questions give you what you need to explain your choice to patients. Expectations for AI scribes are still developing, so your own policy sets the bar.

How to implement an AI scribe in your practice

Once you have chosen a tool, rollout comes down to two things: how you introduce it to patients and how you keep review in your hands.

AI scribe patient consent: how to introduce it

Timing matters when you’re introducing change. Patients are more comfortable when the scribe isn’t a surprise, so mention it at scheduling, in appointment reminders, or at check-in, and make sure your front desk can answer the same questions you would.

In the room, a few sentences cover what patients need to know: what the tool does, who processes the audio, how long the recording is kept, and that you review every note. Patients should be able to decline with no effect on their care, and you should be ready to switch the scribe off without discussion. Record the decision in the EHR so it carries from visit to visit. 

How to keep control of AI-generated notes

AI scribe tools listen to visits and draft notes, but a qualified clinician still reviews, edits, and signs every one. CMS guidance treats AI like a human scribe: the signing clinician authenticates the entry. That makes the review step where accountability sits, and it is the point in the workflow where your clinical judgment matters most.

A few habits keep that review reliable:

• Choose one AI scribe for the whole practice. When each clinician picks their own tool, there is no consistent process to follow.
• Treat every note as a draft. Review it while the visit is still fresh.
• Keep a record of changes. Ask your EHR or vendor to save the original AI output and every edit made to it, so any error can be traced to its source.
• Know where the data lives. The practice owner should be able to say where recordings and notes are stored, who can access them, and how long they are kept. Write it down, and revisit it if the vendor changes its terms.
• Spot-check the tool. Every so often, compare a few notes with the transcript or audio to see how well the scribe is performing. This tests the tool, not the clinician. 

Choosing an AI scribe for your practice

Protecting patient data with an AI scribe comes down to the vendor you choose, how you introduce the tool to patients, and how you review what it writes. A vendor that answers the questions above clearly, and in writing, makes the rest much easier.

Healthie’s AI Scribe is designed to keep the clinician in charge. It works inside the Healthie platform, so patient information stays in the client’s profile, protected by encryption, access controls, and audit logs. Healthie states that it does not store raw audio, that transcripts are kept for the retention window you choose, and that session data is never used to train AI models. Notes arrive as drafts for you to review and approve, a provider can stop transcription at any point in a visit, and AI Scribe can be turned on or off for each provider.

AI scribe privacy FAQ

Q: Is an AI scribe HIPAA compliant?
A: It depends on the vendor, the contract, and how the tool is configured. A signed BAA, encryption, access controls, and clear retention terms are the starting points. 

Q: Do AI scribes keep audio recordings?
A: It varies by vendor. Some delete audio shortly after the note is generated, while others retain the note for longer periods of time. Ask for your vendor’s exact policy.

Q: Who is responsible for the accuracy of an AI-drafted note?
A: The clinician who signs it, which is why review and a record of changes matter.

Q: Do I need patient consent to use an AI scribe?
A: Recording consent law varies by state. Telling patients early and offering an opt-out is a sound practice either way.

‍