All about AI scribes: FAQs for health systems and providers

Generally, yes. More than a dozen states are all-party consent states, meaning that state law requires all parties to a conversation to consent to being recorded. As a best practice, you should get any required consent from patients and caregivers each time an AI scribe tool is used. There are various ways to present and record consent, depending on how you prefer to manage patient experience and liability (and whether the interaction takes place in person or via telehealth).

Here are a few to keep in mind:

• Think about everyone the AI scribe might record. If family members or other individuals are in the room at the time of the recording, you should get their consent as well. Institutions should establish protocols for how to provide notice of the recording to all parties and how to manage associated business risks.
• Know your AI scribe’s features. Specific AI scribe features may raise additional privacy and consent considerations. If the tool continues to record when a call is placed on mute or after someone hangs up, for example, parties should be made aware so they don’t incorrectly assume their conversation is private.
• Understand wiretapping rules. Third-party AI platforms (including electronic health record vendors and other AI-enabled tools) that help the provider make the recording should consider their own liability-limiting steps in light of state and federal wiretapping rules.

Patients (and other consenting parties) can change their minds and ask that the recording be stopped. AI scribes typically have a real-time “off” feature, but you still need to consider whether to keep the already-created recording.

Under the Health Insurance Portability and Accountability Act (HIPAA), patients can ask to obtain a copy or amend any protected health information (PHI) that a provider maintains in the form of a designated record set (DRS). A DRS includes the billing record, medical record, and any other record used to make decisions about a patient. Patients do not have the right to access or amend drafts or copies of a DRS, however. The AI scribe’s recording and transcript may constitute a DRS, depending on context, use case, timing, and provider work patterns. Institutions and providers should address this ambiguity and clarify whether AI scribe outputs will be considered part of the DRS, and under what circumstances.

HIPAA sets a six-year retention period for certain compliance-related documents, and providers must retain medical records consistent with state retention periods. If you retain AI scribe recordings or transcripts, evaluate whether they constitute part of the medical record subject to state retention obligations.

Some institutions might want to keep recordings or transcripts for operational purposes, such as model training, provider training, and quality control, or for liability-related purposes (such as documentation of aggressive patient behavior). These non-treatment use cases for retention should be considered against the backdrop of the DRS analysis, storage considerations, and other liability-related considerations.

Many healthcare institutions are exploring the benefits of AI in diverse clinical and administrative contexts. At the same time, AI is garnering substantial attention in the media and in broader online conversations. Gaining consent for use of an AI scribe tool presents an opportunity to talk to patients about how your institution uses AI to improve care outcomes and the patient experience.