AI Note-Taker Evaluation Checklist

← Choosing an AI Note-Taker for Mental Health: HIPAA & Privacy Questions

Record answers and evidence for the specific AI product, plan and workflow you intend to use. Complete this worksheet in your practice's approved workspace.

For US clinician practices. BAA means Business Associate Agreement. A BAA sets obligations for permitted uses and safeguards; it does not replace your practice's risk analysis. [1, 2, 3]

Product being evaluated

Review detail	Your entry
Vendor / product
Plan and enabled features
Intended use
Reviewer / date

Five areas to verify

What to ask	Details to confirm	Evidence to save
Will you sign a BAA?	The signing entity and the services, plan and features it covers.	Executed BAA, incorporated terms and relevant account settings.
Who handles patient data?	Which companies receive recordings, transcripts, notes or logs; what staff and support teams can access.	Provider list, data-flow explanation and access policies.
Is data used to train or improve models?	Uses of patient information and derived or de-identified data; differences by provider, feature or setting.	Written permitted-use and training terms, including defaults and optional settings.
How long is data retained?	Retention periods or criteria for each data type, who keeps it, and when the retention clock starts.	Retention policy and applicable settings.
What does deletion remove?	Timing, provider copies, backups, exceptions, and whether needed records can be exported first.	Deletion, export and termination terms.

Answers that need follow-up

A reassuring answer is not the same as a specific one. Ask for the detail behind statements like these.

If the vendor says	Follow up with
“We’re HIPAA compliant.”	Will you sign a BAA, and which services, plans and features does it cover?
“We use trusted providers.”	Which providers receive recordings or transcripts, and what does each one receive?
“We don’t sell your data.”	Can patient data be used to train or improve any model, including by a provider?
“Data is kept only as long as needed.”	What is the retention period for each data type, and when does it start?
“You can delete your data anytime.”	What remains in backups or with providers after deletion, and for how long?

Record the data handling

Use “not provided” where the vendor has not answered; do not infer an answer from a marketing claim.

Data type	Who receives or can access it?	Retention period / trigger	Deletion timing / exceptions
Recordings
Transcripts
Generated notes
Support and service logs
Backups and provider copies

Evidence saved

Record document names, versions or dates, links to policies, and written answers. Note any account settings that your decision depends on.

Document or written response	Version / date	Link or file reference

Questions still open

Question	Who will resolve it?	Next action / due date

Review outcome

Choose one for the next step in your practice's approval process:

More information needed.
Ready for internal review.
Do not proceed.

Other checks: Access controls, authentication, encryption, incident reporting, export and recovery, and applicable recording-consent and record-retention requirements still need review. [2, 3]

This worksheet is not a legal opinion, compliance certification or complete security assessment. Its questions are practical review prompts, not an official HHS form. Completing it does not authorize uploading patient information.

Reference guidance

Sources checked October 29, 2026. These references support the legal and security context, not every individual worksheet question or any vendor's compliance claim.

Start Your Free Trial