Before You Trust an AI Note-Taker With Patient Data
Know what to verify before sharing clinical information with an AI tool, from BAAs and model training to retention, deletion, and subprocessors.
The BAA Was Signed. The Questions Weren’t.
Before using an AI note-taker in his private practice, the therapist asked the vendor for a Business Associate Agreement.
The vendor provided one. He signed it, saved a copy, and started using the tool.
A few weeks later, he began onboarding with a clinic. Among the forms was a request for details about any software he planned to use with its patients.
He attached the BAA and sent it over.
The clinic came back with four questions:
- Which companies process the recordings?
- Can any of them use patient data to train or improve models?
- How long are recordings and transcripts kept?
- What gets deleted, and what remains in backups?
He opened a reply and started typing.
“Session recordings are deleted…”
He stopped. After transcription? When he deleted the session? Did the same rule apply to the company handling the audio?
He opened the vendor’s retention policy, then its list of processing providers. The information was more detailed than the security page he remembered.
He pulled up the BAA alongside them. This time, he was checking how the agreement, policies and account settings fit together.
The clinic hadn’t asked for another reassurance that the tool was secure. It had asked him to explain what happened to its patients’ information.
His first reply had taken less than a minute.
He wasn’t ready to send the second.
What to Ask Before Trusting an AI Note-Taker
A BAA is only the start. Check who handles patient data, how AI providers use it, how long it is kept, and what deletion really means.
| What to ask | Answers that need clarification | Evidence to request |
|---|---|---|
| Will you sign a BAA? | “We’re HIPAA compliant” without explaining the agreement or scope. | The actual BAA and who it covers. |
| Who touches patient data? | “We use trusted providers” without naming them or what they receive. | Subprocessor list and data-flow details. |
| Is patient data used to train or improve models? | “We don’t sell data” or vague language about “service improvement.” | Written AI/model-training policy and provider terms. |
| How long is data retained? | “Only as long as necessary” without concrete retention periods. | Retention policy for audio, transcripts, notes, and backups. |
| What happens when data is deleted? | “You can delete your data” without explaining copies, backups, or third parties. | Deletion policy covering primary storage, backups, and subprocessors. |
Start Your Free Trial
Take 14 days to see how well it fits the way you already practice.